2

I was trying to install a plugin, and I kept getting the following error:

Unpacking the package…
Could not create directory.

I'm on Localhost on a XAMPP stack on Mac OS X Yosemite.

The way I solved this was by changing the wp-content folder's permissions in Finder, so that everyone could write to not only the folder but also to all enclosed items.

Per the image below, I right clicked on (1), then changed (2) to "Read & Write" and then chose "apply to enclosed items" in (3).

The proper way to solve this would have been to give the correct user write permission to the wp-content folder by using the chown command.

I didn't use the chown command because (1) I'm still learning how to use it, and (2) it's not clear to me which user is supposed to be given permission to... whether it's the apache user or the ftp user (I'll figure it out eventually).

My question is, if I were to migrate this wordpress site to an online domain based on an Ubuntu server, what are the security implications of my having given everyone write access to this folder and how should I deal with them?

enter image description here

Improve this question

2 Answers 2

Reset to default
2

Wp-content contains plugins and themes. So, if I can read and write into those files, I could add malicious code very easily. This malicious code can then do interesting things. You are basically inviting a lot of trouble.

As for not understanding permissions:

http://www.thegeekstuff.com/2010/04/unix-file-and-directory-permissions/

http://codex.wordpress.org/Changing_File_Permissions

Improve this answer
2
  • Thanks. As I understand it, there's an apache user, and a Wordpress ftp user. Which user should get access to this folder? Also, what's the relationship with www-data? No need to explain it here, if you have a great article you can recommend, that'll be fine.
    – thanks_in_advance
    Commented Mar 1, 2015 at 3:20
  • Both, in fact. www-data is the user under which Apache runs. So, www-data (in a way =Apache) needs read, write and execute permissions to run all the code. Usually this user will have ftp permissions (ftp user), as well to fetch plugins, themes or WordPress itself for installations and updates. That's that. Infact, all this isn't special about WordPress. These are general linux concepts: serverfault.com/questions/357108/… fideloper.com/user-group-permissions-chmod-apache
    – Saurabh Shukla
    Commented Mar 1, 2015 at 5:38
1

I followed several links that suggested to:

  1. Get ownership of wp-content folder: sudo chown -R <usernam> wp-content
  2. Set the correct uploads folder through the wp-content/option.php file: sudo nano wp-admin/options.php
  3. Own the Plugins folder: sudo chown www-data:www-data plugins -R
  4. Own the wp-content folder: sudo chown www-data:www-data wp-content -R
  5. Change uploads folder permissions: sudo chmod 755 -R uploads
  6. Change plugins folder permissions: sudo chmod 755 -R plugins

Even though all of them make sense, nothing worked. What worked for me was a much more simple solution.

sudo nautilus

and then i changed folder permissions thorough the GUI. enter image description here

It actually does exactly the same as above, but succeeds.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.