What should be the correct permission for folder

by 8 replies
10
Hi There,

I would like to know what should be the exact permissions for a upload folder in a wordpress blog. I want to allow my users to upload images, audio, etc. files. But also I want to prevent misuse of it from hackers.

Any input in to solve this problem will be very helpful.

Thanks in advance for any help.
#programming #blog #correct #folder #permission #wordpress
  • Most likely 700 or 777 should be okay. Keep in mind that even with 777, there still has to be an exploit in the script or server to execute malicious code. What file extensions you allow is important here. If, for example, you allowed someone to upload a javascript file, they could then run it, and exploit your server (potentially).
  • Turn off execute, but on only read/write: 666
    Yes, the number of the beast.
    • [1] reply
    • I believe that the only way to upload something to the uploads directory would be if someone logged into wordpress. So you may want to disable users from registering on your blog.

      Also, duval's suggestion to only allow certain file types is very good. and it can be done via a few directives in .htaccess.

      1. Create a file called .htaccess in your uploads directory (and with 644 permissions ).

      2. Enter the following code to limit uploads to only a few select file extensions. You can add or remove extensions from the list below by separating each with a "|". Just be sure to follow the exact format below, as .htaccess is very picky about syntax.

      Code:
      Order Allow,Deny
Deny from all
<Files ~ ".(jpeg|jpg|png|gif|gz)$">
Allow from all
</Files>
      Also, if you happen to have a cpanel based host, you will 'likely' ONLY need 755 permissions on the uploads directory, as they 'take care of it' for you
  • Hackers are always going to find new ways to hack servers, if they know what they're doing. Maybe 755 for the permissions will do good for what you need, instead of 777, which is a bit risky.
  • Never use 777 permissions for files / folders into your server.
    As its loop-hole for the hacker to read / write/execute the file as anonymous user.

    You can just give read & write permission for normal users & for the web (apache/wordpress) users you can give read/write/execute permissions.

    Particularly if you wish to give execute permission , make sure about the extension of the file & your server where the wordpress is hosted.

    If your script is hosted in windows , then 777 mode is definitely not recommended , as anonymous hackers can always execute executable / install files .

    Hope this helps
    • [1] reply
Join the discussion

Next Topics on Trending Feed