Eric Holtman
Member
I've got XF2.0 up and running. data and internal_data are set to 777.
Had some issues with a couple of add-ons that wanted /js/ and a couple other directories to be writable.
Is there a general rule for this? Seems like a security issue.
Currently I'm running nginx (as www-data), and I used to haver PHP also running as www-data, but the website was deployed as another use on the file system (so www-data couldn't write there unless I opened things up).
Now I'm testing letting PHP run as that other user, for that domain. The "cannot write" errors went away (as expected).
What do most people do?
What's "best practice"?
Had some issues with a couple of add-ons that wanted /js/ and a couple other directories to be writable.
Is there a general rule for this? Seems like a security issue.
Currently I'm running nginx (as www-data), and I used to haver PHP also running as www-data, but the website was deployed as another use on the file system (so www-data couldn't write there unless I opened things up).
Now I'm testing letting PHP run as that other user, for that domain. The "cannot write" errors went away (as expected).
What do most people do?
What's "best practice"?
