Hey!
I installed X3 a couple of times now an meanwhile everything works like a charm but I think I need some help with chmod and chown. After uploading the whole x3 directory the check page says that my check, app and content folders are not writeable with the rights 755. So I finally have to set the rights 777 to these folders to make everything work. If I change the owner to "www-data" the check page an all other folders are fine with the rights 775. Should I go for this because 777 is less secure than 775?
Could anybody please tell me how I should set the those rights (PHP-user or not)? What is the difference in terms of security between PHP-user and mine?
Thanks in advance!
Kind regards,
George
X3Photo Gallery Forums
X3 Photo Gallery Support Forums
Re: X3 installation - permissions & more
Good questions. Server permissions vs ownership can be complicated. Are you running your own server? As specified in our X3 permissions docs, if you are fortunate to be on smart hosting, they have already set it up so that FTP user is the same as php/www user. This means that default permissions 755 (writeable only by owner) is sufficient for the application to write to files and folders.
Normally, the problem arises when the FTP user is a different user than the www-user (the user that triggers the PHP scripts). In such case, you need to extend permissions so that group/others can also write to some files and folders, which would be 757 or 777. The question is, what other users are there on your server? Likely none that are not under your control. If you are on a shared hosting, there are likely users that are limited within their subfolder as you are.
To be honest, depending on how your server is setup, I don't think there is much security issues either way. Its not like permissions allows the outside world to do anything, unless you have scripts that allow illegitimate read/write operations.
Sorry, my expertise in this area is limited, but my experience tells me it is a bit irrelevant.
Normally, the problem arises when the FTP user is a different user than the www-user (the user that triggers the PHP scripts). In such case, you need to extend permissions so that group/others can also write to some files and folders, which would be 757 or 777. The question is, what other users are there on your server? Likely none that are not under your control. If you are on a shared hosting, there are likely users that are limited within their subfolder as you are.
To be honest, depending on how your server is setup, I don't think there is much security issues either way. Its not like permissions allows the outside world to do anything, unless you have scripts that allow illegitimate read/write operations.
In my opinion, it is best if you can assign the same user so that you can stick to 755 permissions. However, security implications depend on how your server is setup. Are you running your own server? If so, it doesn't really make any difference.tschortsch wrote:If I change the owner to "www-data" the check page an all other folders are fine with the rights 775. Should I go for this because 777 is less secure than 775?
Sorry, my expertise in this area is limited, but my experience tells me it is a bit irrelevant.
-
-
tschortsch
Experienced
- Posts: 150
- Joined:
Re: X3 installation - permissions & more
Thanks for your help, Karl! No, I am not running my own server, it is a hosted solution where FTP/PHP-user are separated apparently. Well, if I give the rights 755 to the folders app, check and content and then change the owner from FTP to PHP everything is fine and the check page say "Damn good"! 
There is only "open_basedir" enabled but this is purposed by my hoster because of security reasons and therefore not changeable. I did not check already if this prevents X3 from removing unused PHP template files...
I love X3!!
There is only "open_basedir" enabled but this is purposed by my hoster because of security reasons and therefore not changeable. I did not check already if this prevents X3 from removing unused PHP template files...I love X3!!