i recently moved a site to a new host, but i now have a permissions issue in a folder where the CMS allows users to upload content to. This is probably pretty basic but I'm not sure exactly how to request that the permission are fixed.

Basically, i have a folder, uploads, within which CMS users should have full read/write access. The owner of the uploads folder is webmaster.mysite. Since the site move, any new folders created or files uploaded have apache as the owner (which I think is correct, PHP running as apache?), files are set to 755, folders to 775. The problem is that new folders can be created, but files can't be uploaded within them.

Is the fix here to ask that the uploads folder should be owned by apache? I suggested this and the host said it would be a security risk...


Yes, it is a security risk for your uploads folder to be owned by Apache, because that means that any other site on the server has the ability to write (and modify) those files.

What really should happen is for the PHP scripts to be run as a dedicated user, using suPHP (or FCGI), then the permissions on the upload directory set such that that user can write to it (I like to use extended ACLs for this, as it keeps ownership permissions more sensible, and default ACLs are great for making sure that subdirectories maintain correct extended permissions).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.