Using one-click plugin upgrade feature securely on suexec server

Question

I've been searching for a definitive answer to this question for a couple of hours but can't find anything.

I'm running multiple sites on a server using suexec. The owner and group of all files and directories is root with the exception of the uploads directory and subdirectories which are owned by the system user associated with the site. Let's call this user user for his discussion.

I'm trying to get the "one-click" plugin updates and installation to work but I am not having success. I have tried temporarily changing ownership of wp-content and all files and directories in wp-content to user and I have have double checked the execute and write permissions on all directories which are 755.

None of this has worked.

The only thing that has worked is changing the ownership of all files and directories on my WP install to user. This is a gaping security hole (as I've learned the hard way) and I want to avoid doing this.

So what directories do I temporarily change ownership of to get one-click updates and installs working?

Answer 1

Here is a section specific to suexec file permissions.

Answer 2

After looking at the code inside file.php, I discovered you don't have to change the ownership of file.php (see original answer below for reference). Instead, you can add the following line to wp-confg.php:

define('FS_METHOD', 'direct');

This will force WordPress to use the direct method for retrieving the plugins.

You still must manually change the ownership of wp-content and wp-content/plugins directories to the owner to the suexec user the site runs under. It's probably a good idea to change these back once you have finished making your updates and/or installed new plugins.

Answer 3

Well, after some trial and error and a hint from WP documentation, I discovered that you have to change the ownership of the wp-admin/includes/file.php file to match the suexec user the site is running under.

You also have to change the ownership of the wp-content and the plugins directory below it (and probably the directory of any plugin you are looking to update as well).