So I tried deleting a file on the IFS and the only permission a user needs is *OBJEXIST.  So make sure your not granting public or QTMHHTTP *OBJEXIST permission blindly and to lock down the $filename passed to unlink to make sure you don’t have someone deleting all your files.

<?php
if(unlink("test.txt"))
echo "true";
else
echo "false";

view raw
unlinkTest.php
hosted with ❤ by GitHub

Description