Safer way to access image folder than 777 Permission

March 30, 2015 3.6k views
DigitalOcean LAMP Stack Security Drupal

Hi
For my photos to be uploaded to my drupal website and to show on the web pages

I have to change all my file and image folders to 777 permission
which seems a bit of a security risk

Any suggestions?

5 Answers

I think this should be fine as they are static content.

Just make sure that you don't give permission to modify your PHP files, They should all have read-only access by the web server.

Also you can add some security rules in the htaccess files to disallow malicious code in those folders which have 777. Allow files only with specific extensions.

I wholeheartedly disagree with @freelancer . There is never a time where you need 777.

For ubuntu/Debian, run this (changing the value for web_folder if it's not right):

web_folder='/var/www/html/'
chown www-data:www-data $web_folder -R; find $web_folder -type f -print0 |xargs -0 chmod 644; find $web_folder -type d -print0 |xargs -0 chmod 755;

For Fedora/CentOS (Again, change the value for web_folder if it's not right):

web_folder='/var/www/html/'
chown apache:apache $web_folder -R; find $web_folder -type f -print0 |xargs -0 chmod 644; find $web_folder -type d -print0 |xargs -0 chmod 755;

The simple rule is you only give permissions that you need. Never more. Any good admin will say the same thing.

EDIT: here's what the script does:

  • changes the files to the proper owner
    • (apache for RPM-based, and www-data for deb based systems)
  • sets all files to 644
  • sets all folders to 755.

I somewhat agree with @JonsJava , But since most of the Drupal content managers would need to upload/delete the static assets and they use FTP for it. So we should have to allow access to both web server user and the FTP user to have full access to the upload directory. Hope i clarified my answer.

JonsJava what is facl?

  • Sorry. I just noticed your question. facl is "File access control list".

    I have a simple write-up here that will walk you through what you need to do.

Can I do it the same way as wordpress?

sudo chown -R www-data:www-data ~/wordpress/

i.e

sudo chown -R www-data:www-data ~/sites/defaults/files/images

Have another answer? Share your knowledge.