Wordpress and suPHP - GoFuckYourself.com

3xmedia · 06-26-2012, 01:51 AM

On two of my hosts (VPS, Liquidweb and Servint) I can't get wordpress media upload working (as well as wordpress/plugins auto update):

Quote:

"Unable to create directory /home/xxxxx/public_html/wp-content/uploads/2012/06. Is its parent directory writable by the server?"

Host's recommended method for solving this issue is to enable suPHP. And yes, it's working when I run suPHP. However, suPHP requires more server resources. Is this the only solution? Well, I don't consider chmod 777 or turning off PHP safe mode as a solution. Thanks!

AdultEUhost · 06-26-2012, 02:14 AM

php safe mode is deprecated since 5.3
http://php.net/manual/en/features.safe-mode.php

you should upgrade your php first if you are concerned about security

I would advice suphp, especially with wordpress which get hacked a lot
Your normal sites can still run mod_php

3xmedia · 06-26-2012, 03:17 AM

Thanks, actually I run only wordpress on those accounts.

Brujah · 06-26-2012, 05:08 AM

Change the owner of wp-content to apache or whatever is required to allow you to upload images. Note: this may not let you modify or delete any of those files through FTP later.

If that doesn't work because of safe mode, you're stuck with using FTP to do all your uploads manually.

careerbuilder · 06-26-2012, 05:56 AM

imho

create a new user who has apache and ftp permissions then

chown the new user

is what you need., i had the same issue., you most likely cant update wordpress too.

raymor · 06-26-2012, 07:32 AM

You are correct suPHP is the WRONG answer. suPHP is the same as chmodding ALL of your files 777 - it let's all scripts write anywhere they want. Stupid. Very stupid.

Along with chmodding that directory (and only the required directory) 777, use a <Directory> entry outside of that directory to lock it down - "deny from all" if possible, at least turn off PHP for that directory.

If you want to get fancy, you can bind mount the directory noexec.

3xmedia · 06-26-2012, 01:41 PM

Thanks guys for your advices.

fris · 06-26-2012, 02:24 PM

they probably have nobody/nobody as the apache user

06-26-2012, 02:14 AM	#2
AdultEUhost ORLY? Industry Role: Join Date: Oct 2005 Location: NL & US Posts: 2,579	php safe mode is deprecated since 5.3 http://php.net/manual/en/features.safe-mode.php you should upgrade your php first if you are concerned about security I would advice suphp, especially with wordpress which get hacked a lot Your normal sites can still run mod_php __________________ ICQ: 267-443-722 / leon [at] adulteuhost [dotcom] Nominated for an XBIZ Award as "Webhost of the Year" in 2007, 2012, 2013 and 2014

06-26-2012, 05:08 AM	#4
Brujah Beer Money Baron Industry Role: Join Date: Jan 2001 Location: brujah / gmail Posts: 22,157	Change the owner of wp-content to apache or whatever is required to allow you to upload images. Note: this may not let you modify or delete any of those files through FTP later. If that doesn't work because of safe mode, you're stuck with using FTP to do all your uploads manually. __________________ Free Premium Domain Lists and Tools at Clickmojo.com For Sale: Obscenity.com

06-26-2012, 07:32 AM	#6
raymor Confirmed User Join Date: Oct 2002 Posts: 3,745	You are correct suPHP is the WRONG answer. suPHP is the same as chmodding ALL of your files 777 - it let's all scripts write anywhere they want. Stupid. Very stupid. Along with chmodding that directory (and only the required directory) 777, use a <Directory> entry outside of that directory to lock it down - "deny from all" if possible, at least turn off PHP for that directory. If you want to get fancy, you can bind mount the directory noexec. __________________ For historical display only. This information is not current: support@bettercgi.com ICQ 7208627 Strongbox - The next generation in site security Throttlebox - The next generation in bandwidth control Clonebox - Backup and disaster recovery on steroids

06-26-2012, 02:24 PM	#8
fris Too lazy to set a custom title Industry Role: Join Date: Aug 2002 Posts: 55,372	they probably have nobody/nobody as the apache user __________________ Since 1999: 69 Adult Industry awards for Best Hosting Company and professional excellence. WP Stuff

06-26-2012, 03:17 AM	#3
3xmedia Confirmed User Industry Role: Join Date: Apr 2004 Posts: 5,726	Thanks, actually I run only wordpress on those accounts.

06-26-2012, 05:56 AM	#5
careerbuilder Registered User Industry Role: Join Date: Jun 2012 Posts: 51	imho create a new user who has apache and ftp permissions then chown the new user is what you need., i had the same issue., you most likely cant update wordpress too.

06-26-2012, 01:41 PM	#7
3xmedia Confirmed User Industry Role: Join Date: Apr 2004 Posts: 5,726	Thanks guys for your advices.