security settings for folders

Permalink
Hello, so I've noticed we've changed the folder permissions for a few folders to 777, which means ALL/world has read/write/execute. Do ALL really need write permissions to stay? It seems like that would allow files to be uploaded/sent to the site.

 
mesuva replied on at Permalink Reply
mesuva
No, it's really only if your webserver is mis-configured that you'd need to do this.

These folders are the only ones that need write permissions:
/packages
/files
/updates

Then, these folders should only need permissions for the user that the webserver is run as. In most cases, you should be able to set the permissions to 755.

Some servers however, use a different user to run the webserver than is used to mark the ownership of uploaded files. In these cases you might need to have something like 775 (if the users are in the same group), or the dreaded 777. I'm always weary of servers that require 777 on folders to work... 777 is ok-ish if you are running a VPS or something where you only have one user (and it's you), but on a big shared server with hundreds of users it's just asking for trouble.

Just to be clear though, 777 on a folder doesn't mean that visitors can upload files into the directory, it means any _users_ on the server can write to that directory - i.e. someone logs into the server, navigates around and finds your user directory and finds they can read and write to it.