I seem to be having issues with folder (and maybe file) permissions getting changed possibly by an FTP client. The WordPress install is using https. It started primarily with permissions in the wp-content/uploads folder not allowing anything to upload to the Media Library. Changing the uploads folder's permissions to 777 fixes this. Is there any risk in having the uploads folder and/or the entire wp-content folder permissions set to 777? I couldn't seem to find a clear answer at http://codex.wordpress.org/Changing_File_Permissions. Although I assume it changes from host to host.
1
-
What are the group and user ownership of the files? What user does PHP run as?– Chris_OFeb 8, 2012 at 1:31
Add a comment
|
1 Answer
As listed down the bottom (http://codex.wordpress.org/Changing_File_Permissions#The_dangers_of_777) having 777 permissions allows anybody with know how to go in and modify and execute your code making it available to hackers.
I was reading an article yesterday and it stated that about 80% of all hacks came from uploading/inserting a file into the uploads folder creating a backdoor that they could use to steal information and lock you out etc. So while you may think "it's only my uploads directory" you are making it easier to do the most common hack on your site.
Sorry I can't find the source on my info, have an automatic history cleaner plugin.
EDIT: Found the reference: http://ottopress.com/2009/hacked-wordpress-backdoors/
