serversmust have write access to the enclosing directory if the file doesn' yet existor to the file itself if it does to help isolate uploadsthe script stores all uploads in whatever server directory is named in the uploaddir global on one linux serveri had to give this directory mode of (universal read/write/execute permissionswith chmod to make uploads work in general this is nonissue with the local web server used in this but your mileage may varybe sure to check permissions if this script fails the script also calls os chmod to set the permission on the server file such that it can be read and written by everyone if it is created anew by an uploadthe file' owner will be "nobodyon some serverswhich means anyone out in cyberspace can view and upload the file on one linux serverthoughthe file will also be writable only by the user "nobodyby defaultwhich might be inconvenient when it comes time to change that file outside the web (naturallythe degree of pain can vary per file operationisolating client-side file uploads by placing them in single directory on the server helps minimize security risksexisting files can' be overwritten arbitrarily but it may require you to copy files on the server after they are uploadedand it still doesn' prevent all security risks-mischievous clients can still upload huge fileswhich we would need to trap with additional logic not present in this script as is such traps may be needed only in scripts open to the internet at large if both client and server do their partsthe cgi script presents us with the response page shown in figure - after it has stored the contents of the client file in new or existing file on the server for verificationthe response gives the client and server file pathsas well as an echo of the uploaded filewith line count in line-by-line reader mode notice that this echo display assumes that the file' content is text it turns out that this is safe assumption to makebecause the cgi module always returns file content as str stringsnot bytes less happilythis also stems from the fact that binary file uploads are not supported in the cgi module in (more on this limitation in an upcoming notethis file uploaded and saved in the uploads directory is identical to the original (run an fc command on windows to verify thisincidentallywe can also verify the upload with the getfile program we wrote in the prior section simply access the selection page to type the pathname of the file on the serveras shown in figure - if the file upload is successfulthe resulting viewer page we will obtain looks like figure - since the user "nobody(cgi scriptswas able to write the file"nobodyshould be able to view it as well (bad grammar perhapsbut true nonetheless server-side scripting