We have a web server running Lighttpd on FreeBSD.
Some of our clients demand FTP access to their server. With most of them, chrooting them with the FTP daemon into a "files" directory so they can upload pictures of their kids or whatnot suffices, and then we just have Lighty configured to not fire up FastCGI if a request is made for a file in that directory. But at least one client needs access to their whole webroot. Okay, so I set up the FTP daemon to umask 022 all uploaded files (so the permissions become rw-r--r--) and thought I was very clever.
However, it has come to my attention (thankfully not the hard way) that PHP scripts are executable on the server if the file merely has the relevant read bit set; the execute bit (or lack thereof) is ignored. What's up with that? I assumed the execute bit would have to be set in order for the file to be, you know, executed…
Is there simply a way to stop Lighty and/or PHP from executing scripts without execute bits? (I've already tried #lighttpd on Freenode, but they didn't seem to think it was possible.)