[cobalt-security] PHP upload/dir permissions

["Andy Clyde, oxfordmusic.net" <cobalt-security@xxxxxxxxxxxxxxx>]

i've just had to help a client out with uploading via a PHP script.

i have 'open_basedir' and 'upload_tmp_dir' set on a per site basis in
/etc/httpd.conf but this still wasn't working - the script was defaulting to
/tmp and not /home/sites/siteXX/tmp as it should have been. i eventually
solved this by changing the permissions on /home/sites/siteXX/tmp to 777.
it also seems that i need to chmod 777 all the directories in the path where
the tmp.uploaded.file is to be saved.

this seems a bit dangerous. is there a workround? or is it safe?

cheers

andy