@Gents
This is not a Joomla! problem per' sai' but is brought about by the hosts configuration, most likely running PHP as an Apache module. This means that PHP scripts have to run under the WebServers user account, hence when you upload something through Joomla! ( or any other Web Based Application ) the uploaded files are owned by the WebServer ( this can be any defined user, but is normally apache or nobody, the numbers you are seeing are the UserID's of this user instead of the name, that is all )
The interim/temporary fixes are as discussed;
1. Use JoomlaExplorer, because this runs as the WebServer User account, it gives access to these mis-owned files.
2. Have your host chmod (change-mode) directories to 777, which is pretty dangerous...
3. Have your host chown (change-owner) the group to the WebServer User and owner to your account
then chmod directories 775, and files to 664, which still is not a great fix...
4. Have your host chown all files and directories to your account and chmod directories to 755, files to 644...
Or you could give your host a hard time about re-configuring their server
more appropriately for WebBased Applications...
Apache running PHP in CGI mode, PHP5, and install phpSuExec, which will then allow the WebServer to run temporarily as the users account, negating all these ownership problems.
Running scripts as the WebServer user ( apache or nobody ) has its own security implications depending on server configuration.
As for the quoted forum post elsewhere stating that this configuration is insecure, with PHP5, register_globals off and a fair server configuration, this is more secure than running in module mode, with less problems.
As an aside,
why is PHP running as a module insecure or problematic?Well, apart from the above mentioned ownership problems for WebBased Applications, this configuration also actually provides quite a breeding ground for exploits, also making exploits difficult to detect, directly or indirectly through mod_security or host based tools. Because scripts runs as the WebServer user, there is no easy way to determine who the real account was that the WebServer ran the script on-behalf of, so.....
1. If the script goes zombie or hangs, there is a chance it will hang the WebServer parent process too.
2. If the script goes rogue or run-away, the WebServer account has certain resource rights that a user doesn't
3. If the script is rogue or an exploit, the script may now has access across multiple accounts on the server
4. If the script is rogue and is doing something nasty, it is hard to track down where it is? as it has no user account responsibility
5. If the script is rogue and Apache allows it, it can run servers, like IIRC servers without the knowledge of the account owner
6. If the script is rogue and PHP allows it, it can send heaps of SPAM mail through the PHP mail function
7. If the script is rogue and PHP allows it, it can effect attacks from inside or co-ordinate external DDoS or alike
8. and the list goes on.....
This is not to say that PHP in CGI mode does not have its short-fallings also, but on the whole, they are less scary than in Apache Module mode....
Continuing with permissions, the default permissions are assigned in the absence of a directive, the defaults are;
Directories = 755
Files = 644
This is determined by the system or user UMASK, this number is taken away from the maximum permissions to acheive the systems default. Remember that permissions are managed in "octal" not "hex" or "decimal"
Most systems UMASK's are set to "022" , thus....
Max Mode = 777
UMASK = 022 -
-----
755 For a directory
Because most "normal" files are not executiable, the maximum mode is actually 666, thus...
Max Mode = 666
UMASK = 022 -
-----
644 For a File
For additional information, please refer to the following posts/FAQ's;
What does Joomla! have to do with Unix file permissions? [url=http://www.joomlatutorials.com/faq/view/joomla_security_tips/permissions_under_phpsuexec/60.html]
Unix Permissions Under phpSuExec[/url]
Joomla and Windows File Permissions - ExplanationHope this helps clear a few things up for you....
so i would change the file permissions in Global Configuration under the server tab. Then change File Permissions and Directory Permissions to 777 under (CHMOD new files) on both also check (apply to existing files) on both as well. Thats it when I do that I can change, edit, overwrite, delete, and upload anything to any directory. Just don't forget to change the it to (Dont CHMOD new files) when your done. I hope this helps somebody 