Hi,
My current host called my attention that I had incorrect permissions on some files and folders (777). Another host i tried before also said the same thing
[font=arial, sans-serif][size=3]"All directories should have a maximum of 755 as permission ([/size][/font][font=arial, sans-serif][size=3]777[/size][/font][font=arial, sans-serif][size=3] is NOT allowed and not needed, no matter what your software developer may say in the documentation; it has to do that many hosting companies use a very insecure way to load PHP processes which need directories to be fully world readable and writable, and thus insecure as well). "[/size][/font]
[font=arial, sans-serif][size=3]What are your thoughts on this? Who should I listen to? 
[/size][/font]
Hi,
yes, your host is right because they use probably suPHP or FCGI PHP handler.
Under suPHP configurations, PHP running as a CGI with “suexec” enabled (su = switch user, allowing one user to “switch” to another if authorized).
Your php scripts now execute under your own user/group level. Files or directories that you require your php scripts to be able to write to no longer need to have 666 and 777 permissions. In fact, 666 and 777 permissions are no longer allowed, having 666 or 777 permissions on your scripts or the directories they reside in will not run and will instead cause a “500 internal server error” when attempting to execute them, this is done to protect you from someone abusing your scripts.
Your scripts and directories can now, only have a maximum of 644 (for files) and 755 (for folders) permissions (read/write/execute by you, read/execute by everyone else).
Thanks Martfox. So is it safe to ignore this kb then? CS-Cart Documentation — CS-Cart 4.15.x documentation
[color=#555555]The [/color]var[color=#555555],[/color]images[color=#555555], and [/color]design[color=#555555] directories and all their subdirectories and files should have the 777 permissions. This is required to allow CS-Cart to upload files to these directories for routine operations. As regards the[/color]config.local.php[color=#555555] file, it must have the 666 permissions (in the installed CS-Cart).[/color]
Yes, it's safe and you can ignore the KB article.
Now, you will have to change permissions of all files to 644 and all folders to 755.
Also you will have to change this line in the config.local.php from:
// Default permissions for newly created files and directories
define('DEFAULT_FILE_PERMISSIONS', 0666);
define('DEFAULT_DIR_PERMISSIONS', 0777);
to
// Default permissions for newly created files and directories
define('DEFAULT_FILE_PERMISSIONS', 0644);
define('DEFAULT_DIR_PERMISSIONS', 0755);
I'll chime in, at the risk of muddying the waters and hijacking the thread.
We're on 2.2.5 (and happy with it), running under cPanel, and still have the var and skins set as 777… do these 'new' permissions recommendations apply too all versions and servers? Reason I ask is, they may not, and therefore this may confuse those thinking their cart will work with 755 and 644 when it may not.
Clarification once again on permissions would be great, especially from CS, and especially if KB articles are outdated.
Thanks for any advice. For any of us.
[quote name='wwgreen' timestamp='1395157992' post='179534'] I'll chime in, at the risk of muddying the waters and hijacking the thread. We're on 2.2.5 (and happy with it), running under cPanel, and still have the var and skins set as 777… do these 'new' permissions recommendations apply too all versions and servers? Reason I ask is, they may not, and therefore this may confuse those thinking their cart will work with 755 and 644 when it may not. Clarification once again on permissions would be great, especially from CS, and especially if KB articles are outdated. Thanks for any advice. For any of us. [/quote]
Hi,
you will have to ask your hosting provider which php handler they use on the server you are on. Below are the chmod permission settings for all php handlers:
DSO - files 666, directories 777
CGI - files 644, directories 755
FastCGI- files 644, directories 755
SuPHP- files 644, directories 755
Also read these article:
http://www.martfox.com/handlers-explained/
http://www.martfox.com/confusion-in-suphp-suphpexec-and-apache-suexec/
I have this in my config.local.php:
define('DEFAULT_FILE_PERMISSIONS', 0644);
define('DEFAULT_DIR_PERMISSIONS', 0755);
however the new cache files generated by cs-cart are still in 666. Any ideas how to fix this?
thanks!
Does anyone know if CS-Cart has plans to fix their default file & folder permissions and update their official installation instructions at [url=“Install CS-Cart — CS-Cart 4.15.x documentation”]https://www.cs-cart.com/installation.html[/url]? I wish I hadn't had to hunt through the knowledge base and this forum to fix my installation!