Once more, this time with feeling: spartacus and permissions

[yellowled]

Hey guys,

something, as John Cage would say, troubles me.

I have successfully managed to ignore spartacus for quite some time, and have now switched to using it for plugin installation. Almost any time there's an update for any of the plugins I use (I do not use that many, actually), spartacus complains about the file permissions, very likely because I uploaded those plugins manually in ancient times.

Now, that's no biggie for me. Being a linux user, I'm quite firm with file permissions (at least I think so ), so I fire up gFTP and change those permissions. But.

Maybe I'm doing it wrong, but in order to make those files writeable for spartacus use, I have to make them (and the directories they reside in) world-writable. Isn't that some sort of security issue? Should they be only writeable for user and group (I have to admit I never tried that ...)

YL

[garvinhicking]

Hi!

Basically only PHP needs to have write permissions to that. But usually the apache user is never in the same group as your FTP user.

So you only have those options:

- Make the files writable for your FTP user, but not for Apache ("Others"). This would defy spartacus.

- Make the files writable for Apache (by assigning the owner/group to apache). But then you'd loose FTP write privileges to those plugins

- Make them world-writable.

- Ask your hoster to create a usergroup that holds both apache and your FTP user. Then give max permissions to that group and you don't need the world-writability.


HTH,
Garvin

[yellowled]

I just now fiddled around with it a little bit: I installed the PageRank sidebar plugin via spartacus 'from scratch' (i.e. I didn't have it installed before). Now those dirs/files are assigned to www-run:nogroup whereas the files I uploaded manually are assigned to <user>:<user> (Gee, I hope I'm not exposing my whole installation posting this ). Those files are writeable for www-run only, yet I still do have write access via FTP. I think this is what you meant by your last point, right?

My hoster does indeed offer a tool to set file permissions, so if I set the whole plugin directory to this permissions, spartacus should work properly, right?

YL

[garvinhicking]

Hi!

Yes, then your case should be usable like that, if you set all owners to the www-run:nogroup

Regards,
Garvin