-
☆ A M B ☆
- 24,524 Posts
If you want a script to be able to upload files, the folder must be 777 so the script can write to the folder. When a script uploads a file, however, that file belongs to the user the script runs as (apache, www, nobody - whatever user the apache server runs as). The uploaded file will not by default be 777 when it is uploaded. Your FTP user (you) will not be able to edit or delete these files; you’ll need to use another script (such as the MODx Manager’s file manager) to access them.
For this reason, I have for years made sure that any host I use has PHP running as CGI/suexec instead of as an apache module. This causes the script to change user to my FTP user (me) when it runs, so now it has access to all of my folders without having to make them 777. Any files the scripts upload will belong to the user the script runs as, in this case me, so I have full access with my FTP user.
Quote from: albert_hp at May 05, 2007, 05:06 AM
i can upload files into only folders that changed to 0777. i must change all folder i want to upload into, is this work secure for site?
i can’t delete and edit files in all folders even 0777s.
In general, when you set a folder’s permissions to 777 this doesn’t change the permissions of the files that are already there within it. If you already uploaded files via FTP, they will still have the server’s default permissions unless you change them for each file as well. Files that you upload via the File Manager, however, should automatically have the correct permissions set (so you’ll be able to edit/delete those without changing anything).
As for security, setting 777 permissions on shared servers can sometimes be a risk if the server is improperly configured, infected with a worm, etc., but it’s a very common practice (and necessary on most standard setups). Susan’s suggestion about getting a host that offers suexec takes care of that issue, but many hosts still don’t offer it. If yours doesn’t, just follow the other security-related instructions in the documentation (setting register_globals to off, for example) and you’ll be fine.
This problem couldn’t possibly have anything to do with the DHTML script that you installed, so I wouldn’t go looking there for insight. It seems to me as if you just need to make sure that you follow the installation steps exactly, since setting these permissions is a necessary part of the process. It doesn’t sound to me as if you’re encountering anything abnormal really; you just need to doublecheck that your permisions are right and keep in mind that when you upload files via FTP you probably won’t be able to delete/edit them using the File Manager unless you also set their permissions to 777 after uploading them.
The only files that you will be able to edit or delete in the file manager are the ones that you have uploaded via the file manager (or if you specifically edit those files’ permissions after uploading them via FTP). The file manager is not meant to be used for much more than just easy uploading of images, Flash, and other files that you want to insert on your pages, so it sounds to me as if you might just be trying to do something with it that it’s really not intended to do. You definitely should NOT be able to edit the MODx PHP files via the file manager, since that would be a huge security risk.
What is it that you’re trying to edit exactly?
☆ A M B ☆
). 
.