WordPress (3.9.1) MultiSite Permissions. Is chown the answer?

Question

The situation:

I'm working on a WordPress MultiSite for a charity. They have a Dedicated Apache Server running multiple Domain Names (Accounts).

I preparation for Development & Production, which will occur on the same Domain Name within that Dedicated Server, I made a few test installations on a separate Shared Hosting Environment using different Domain Names. No problems whatsoever during these tests on Shared Hosting.

I understand the reason why I'm getting the following errors, and I am happy, during Development (which is Password Protected) to switch CHMOD File Permissions of /uploads/ & uploads/site/2 to 0777 in order to be able to Upload from within WordPress, but obviously I'd prefer not to use 0777 for the Production Release.

A question of Hosting Support Time

The charity I work for have a fixed and pre-agreed support contract, which doesn't, at the moment, include Server Support for WordPress. So I want to make sure I approach the Hosting Provider (a Web Design Agency / Hosting Reseller) with a set of definite instruction on how to solve the Server Side issue.

Basically, I don't want to run the risk of a seemingly simple Server Support request turning into a lengthy discussion on solutions - I would prefer to provide them with a definitive guide to solving the Server Side / Permissions issue, which is what they'd also prefer, actually.

What specific instructions should I give to the Hosting Provider in order to solve the Errors that I've outlined below?

The Problem:

1. Error:

The uploaded file could not be moved to wp-content/uploads.

And for the 2nd Site...,

The uploaded file could not be moved to wp-content/uploads/sites/2.

And for Plugins installation...,

Download failed. Destination directory for file streaming does not exist or is not writable.

My Technical Predicament:

From what I've researched, possible solution:

• chown?

you need to chown your installation to the php user too. i.e. if your user is www-data and they're a member of www-data you'd do $chown -R www-data:www-data /var/www/wp-content/uploads/sites/ - Source

• WP_TEMP_DIR?

I'd try adding the following to your wp-config.php file to force it to use the wp-content directory define('WP_TEMP_DIR', ABSPATH . 'wp-content/'); - Source

Point #1 - I have no experience of dealing with chown, so I'm not sure if this would be the correct guidance I should provide to the Hosting Provider.

Point #2 - from what I've read, it is NOT a good idea to define Constants for /temp/ Directories in this way. And, actually - I would prefer not to extend the wp-config.php as a fix.

I'd appreciate your input.

Answer 1

There's a section on WordPress file permissions in the Codex article on Hardening WordPress. The article doesn't talk much about Multisite, but it should be treated similarly to the rest of wp-content -- ie, the server process needs to be able to write to it.

I'd steer clear of doing chown www-data:www-data [/path/]wp-content/uploads/sites -- you should be able to achieve the same effect by using chgrp, which changes the group permissions on the files & directories. Something like

chgrp -R www-data wp-content/uploads/sites
chmod -R g+w wp-content/uploads/sites

might be what you're looking for.

The first line changes the group that owns the directory in question (and the -R applies it to all files and subdirectories too). The second line changes the "mode" (the permissions) so that the group can write files and directories. (-R again does it recursively; g+w is the group-writeable part.)

Caveat -- every setup is different; you should probably double-check with your hosting company if this setup is kosher.