Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Run PHP as www-data and alter permissions to allow uploads #369

Closed
wants to merge 1 commit into from
Closed

Run PHP as www-data and alter permissions to allow uploads #369

wants to merge 1 commit into from

Commits on Sep 30, 2015

  1. Run PHP as the www-data user 

    This commit changes the PHP-FPM config to run as www-data, and also
changes the deploy script so that the "uploads" folder has group write
permissions, so that wordpress can store and modify uploaded files.

The prior set up PHP-FPM run as the same user that owns the
files in the web root, giving PHP write access to the entire web
root. This is a security risk. The correct solution is to have PHP run
as www-data in the www-data group, and have the files be owned by a
different user. Then, only those files which we want PHP to
be able to write to have the group write permission set.  See e.g.:
http://codex.wordpress.org/Hardening_WordPress#File_Permissions
    @culturedsys
    culturedsys committed Sep 30, 2015
    Configuration menu
    Copy the full SHA
    9b1f5c6 View commit details
    Browse the repository at this point in the history