• At this link http://codex.ww.wp.xz.cn/Updating_WordPress

    it is clear that WordPress is advising to make all files owned by the user the web server is running as and to make them writeable by that user. It appears that (in 3.9.1) you cannot update a plug in or WordPress itself using the panel unless you do this – or set equivalent permissions. Basically it uses the files system running as the web user to write files. (This seems to me to be a change; I thought it used to use FTP for the whole update; and thus you could make your directories owned by a system/FTP user and writeable only by them). Anyway. It seems to me this is pretty insecure. Do we really want to allow all directories to be writeable by the web user? I’ve just spent a day cleaning malware out of my client’s uploads folder – which does have to be writeable by the web user (hence the vulnerability). But all directories and files? Really?

Viewing 9 replies - 16 through 24 (of 24 total)
  • Thread Starter justinwyllie

    (@justinwyllie)

    Esmi – it a serious question. I just spent some time looking through the files. Please could you kindly either address it (if you are able to), direct me to a forum where it might get answered if such exists, or drop out of the conversation since your off-topic posts are distracting from the question. Thanks.

    Please answer the question: are you running your own server? It’s really not a difficult one to answer but the answer will impact upon any responses.

    Thread Starter justinwyllie

    (@justinwyllie)

    I wish you would not keep drowning the thread with this irrelevant and distracting question. We now have 6 posts between this one and the last serious post. It is totally irrelevant. WordPress is one code-base where ever it runs. There is one Codex. My question is about how it is supposed to be working. My set-up is irrelevant.

    If you understood my question you would not ask the question you are asking. The reason I am not answering it is that to answer it will distract from the question and the answer I was hoping to get.

    If you cannot answer that one simple question, then I cannot possibly help you. Sorry. 🙁

    justinwyllie,

    We’re trying to help you but it appears you’re not really helping us get you the answers to your question. WordPress is used by millions of users. The Codex is read by millions and it’s edited and reviewed by many. It’s a very well thought out system and those in support here work very hard to help you with issues such as these.

    To be clear, your setup IS relevant.

    Thread Starter justinwyllie

    (@justinwyllie)

    It is/was a theoretical question. So the setup is not relevant. I have not answered the “simple” question because to do so would be misleading. Hopefully someone will drop by who understands the question.

    Thanks

    Wouldn’t it be easier to answer the question and then we can determine whether it is relevant or not? It seems like this has went off trail more because the question wasn’t answered then if it was just simply answered.

    I think there’s a misunderstanding of how WordPress, permissions, and how the server is all related to this.

    Thread Starter justinwyllie

    (@justinwyllie)

    A man goes into a car showroom. He points to a car and says to the sales person “Is that a reverse lever?”. The sales person goes “What terrain are you planning to drive the vehicle on?” The man goes “I’m just asking if that is a reverse lever. What terrain I’m planning to drive it on is irrelevant”. The sales person, like a robot, goes “What terrain are you planning to drive the vehicle on?” And so on.

    As briefly as humanly possible:

    1. The WordPress system which uses FTP (ftpext setting for FS_METHOD) asks for an FTP account. I have always assumed this was so e.g. /wp-content could be owned by the ftp user (the one entered into that little box) with permissions set to 755 (read/write/execute for the ftp user account and read/execute for everyone else). This would be the permissions scheme detailed here: [http://codex.ww.wp.xz.cn/Changing_File_Permissions] Is this a correct understanding of the FTP update mechanism?

    2. During the plugin upgrade process it appears (tested for 2 plugins in WordPress 3.9.1) a temporary file or directory is written into wp-content. E.g. /wp-content/myplugin.tmp. Is this the correct place or is this an error in the plugins?

    3. The point is. If we set the permissions to those detailed in point 1) above this fails. I have not analysed in detail but (again) in /wp-includes/class-http.php an attempt is made to create a temporary file in /wp-content/ which fails because wp-content is not writeable by the web server user.

    Either a) my expectations for the FTP method are incorrect or b) this method is broken in in WordPress 3.9.1 or c) my plugin should not be trying to create a file/directory /wp-content/mypluginname.tmp – it should perhaps be trying to do this in /wp-content/upgrade/mypluginname.tmp

    It would be fantastic if someone who knows how the FTP plugin upgrade method is supposed to work could tell me which is the case.

    For those for whom it is important to know what my setup is I have a VPS.

    Moderator Jan Dembowski

    (@jdembowski)

    Forum Moderator and Brute Squad

    *Walking gingerly into the topic*

    1. The WordPress system which uses FTP (ftpext setting for FS_METHOD) asks for an FTP account.

    It uses that as a method if applicable, yes. I believe it’s a last resort thing.

    I have always assumed this was so e.g. /wp-content could be owned by the ftp user (the one entered into that little box) with permissions set to 755 (read/write/execute for the ftp user account and read/execute for everyone else). This would be the permissions scheme detailed here: [http://codex.ww.wp.xz.cn/Changing_File_Permissions] Is this a correct understanding of the FTP update mechanism?

    If updates, themes, plugins, etc. are installed using that method then the file ownership would be determined by the FTP daemon. That’s host specific and dependent on how you setup your FTP server.

    (No one should use native FTP as clear text passwords are E-V-I-L BTW but that’s another discussion.)

    I’m not sure about item #2 but it sounds correct.

    3. The point is. If we set the permissions to those detailed in point 1) above this fails. I have not analysed in detail but (again) in /wp-includes/class-http.php an attempt is made to create a temporary file in /wp-content/ which fails because wp-content is not writeable by the web server user.

    What’s your FTP server log saying? Which one are you using? The reason I’m asking is that you can increase the logging level and see what’s going on command wise on your FTP server if that’s what you are using.

Viewing 9 replies - 16 through 24 (of 24 total)

The topic ‘Security?’ is closed to new replies.