Joomla! Discussion Forums

I've been looking into my FTP 550 errors for the past two hours and came to the conclusion that Joomla isn't setting correct file and folder permissions on component installs (perhaps bot and modules as well)?

The permissions are set to Nobody (99) + Nobody (99) (viewed from MamboXPlorer), when they should be account name (8033) and nobody (99). This is extremely serious as I'm not able to develop the site to 'how I would like', and often on component installs (as per a recent Joomla SMF component), the installer stops and cannot upload certain files. Sure you know that developing a real Joomla site requires you to edit code direct with Dreamweaver or GoLive using FTP.

I'm on a virtual server with safe mode ON (most hosts do this).

Can some 'expert developer' please CONFIRM THIS VERY SERIOUS ISSUE. Surely, it should be as prior to 4.5.2 of Mambo, where the account holder is the primary owner and not the php module.

THIS IS SERIOUS!

You seem to be rushing from a symptom to a conclusion. It is more likely an issue of safemode than it being a virtual server. I use virtual servers for all but 1 of my clients with no problems. But, safemode is off.

Yes, there is a known problem with "safemode on" and Joomla; it is a feature request. Please see this:

http://developer.joomla.org/sf/go/artf1 ... F08A?nav=1

I do not agree that developing a "real Joomla site requires you to edit code direct with Dreamweaver or GoLive using FTP." I have been using Mambo and Joomla for nearly two years and have never used either tool on a live site.

There are a number of quality hosts - even those that specialize in Mambo and Joomla, that use virtual servers and safemode off. If you have just started with this hosting company, perhaps they will give you a refund if they are unable to accomodate your cms of choice.

wr

Thanks for your reply, appreciated!

I've been using this host for 5 years and Mambo for 3 with custom-made templates and the problem only started appearing after the 4.5.2.3 upgrade on Mambo and the move to Joomla (which went without a hitch).

I take it from your answer that there is no solution at present then and will have to wait for a fix?

Can I ask how you go about coding your site and templates without using Dream or Golive?

Thanks again,
f

Just a small additional comment:
The reason that you cannot access/modify files is NOT the safe mode... the safe mode only restricts the access within a PHP script.
The reason is the server configuration and that PHP usually runs as the web server process. A safe mode patch (as soon as it will be available for the current release) will still help because it workaround that same cause by using the FTP account to create directories for example.

Some background info:
http://bugs.php.net/bug.php?id=24604

As for the template... uninstall it and just install it by uploading it to the proper folder using a FTP client. (templates can be installed by just uploading it... this doesnt work for other addons though)

I've just had work back from my provider and safe mode is OFF, so that's not the issue. 

In your global configuration... did you try to change the chmod setting for newly created directories/files?

I did, both to leaving it to server and the default settings.

Honestly, this looks to me like the com/mod/bot installer is not setting the correct OWNER permissions on install. They shouldn't be set to 99 + 99 (as per the info' from MamboXplorer), they should be 8033 + 99 for correct ownership.

I also thought it might be an .htaccess issue, but that's not it either.

IMHO, this has little to do with the php issues in the above link. It has got to be something to do with the Joomla comp installer. I'm running OS X here and no file should ever be set to Nobody as a primary owner.

Actually the installer does not set the owner by itself... try it with a previous Mambo version... is the owner really different?
The only thing that i believe is different between the versions is a bit how the permissions are set...
The following is a line the installer sets globally (while the new installer restores the setting):

You can try to place it in the /administrator/components/com_installer/admin.installer.php as one of the first lines.

Btw. I never tried mamboXplorer by myself... is it actually possible to change the owner with it or just the permissions?

It cant change the owner, but since it resides in the application permissions can be set on some server configs

permissions only.

My heads' nipping at this point, maybe working on something else and coming back to it might help  :o

Thank you again.  8)

Ok, thats what I thought... I just read others reporting as if it were able to change the owner.

However, you can try it to change the permissions to 777... if you then still cannot access the files using FTP than there is not much you can do beside using a safe mode patch (I really do hope that this will get integrated soon... but then its one important thing along with others to integrate).

As I've found out, it's got nothing to do with safe mode, which is off, and going back to my first post, this is a very serious issue if a user cannot backup their site via FTP due to owner permissions.

At this moment in time, I just can't understand why I can rename a folder via FTP but not download it

Did you read the link I posted you before? It should explain a few things. I could even give you a link to a very very long thread on the other forum... but unfortunatelly it is more full of frustrated people than true knowledge... only few know about the background... many just see the symptoms.

However... even with safe mode off a safe mode patch will help... because it does workaround what is even a bigger problem when the safe mode is on: the ownership (the problem you have now as well)... and it does this by using your ftp account.

Yeah, I get the jist of what you're talking about from the link and the following text taken from it. However, it doesn't explain that nothing has changed my end apart from the recent 452 upgrade and then the move to Joom. Reading the change notes on this site, there's definitely been alterations to the installers. I think a core dev needs to step in here and explain what the situation is otherwise it's just pure guess work from well known and documented php issues. The bug you're referring to goes back to 2003 btw, so it would have been a much more prevalent issue to Mambo users before now.


">Use cgi-php.
>And no such problems at all.

Tell that 99% of all internet hosters. They just won't do it - for
certain reasons. And there will be problems - just read my bug report
again why this is not revelant to cgi-php.

>They _NEVER_ do this. Because to change user,
>process must be owned by
>root. It's mean no security.

Not necessarly. I suggested to change the safe mode logic, not the
creator to create directories.

>My opinion - not needed. Just read aboud mod_php.
>It's always run as apache user.

Yes, but again: Read my bug report carefully. Try it out yourself. If
you know about how unix and linux systems are setup, you'll quickly
discover why it fails. Also remember: Most providers provide PHP, but
only uploads via FTP. Thus, the user id's with which people upload files
don't match the user id of the webserver in most cases.

>File_uploads can working with 'chuid' script, for example.

Most providers also don't do this. What you are recommending here are
workarounds, but not solutions.

>Just turn safe_mode OFF and disable system, popen, >exec... functions

Again, Providers turn on SAFE_MODE because they think they make PHP
secure - but in fact, they are disabling file operations via the web and
3rd party software (i.e. all scripts you can get on the web) pretty
useless.

Or to use plain words:

"Heck, I can create a directory but I cannot write to it afterwards?"

Just like to add the following error I'm receiving when trying to install the Joomla > SMF component:

Warning: copy(/home/****/public_html/site/administrator/components/com_smf/smf.xml): failed to open stream: Permission denied in /home/*****/public_html/site/administrator/components/com_installer/installer.class.php on line 356

As said I once compared the installer of the Mambo versions... and the only difference which should make any difference (what a sentence) is that the umask is used different... in addition (I am not 100% sure now) you were not able to change the default permissions values... they were always 777... no the default is to leave as server default... so when you set it in your global configuration to 777 for directories and files... then the umask should be the only difference left.

Here's the code from the installer line 356 where it's stopping:

if( !( copy($filesource,$filedest) && mosChmod($filedest) ) ) {
$this->setError( 1, "Failed to copy file: $filesource to $filedest" );
return false;

It is a pain in the butt.

That listle bit of script @umask(0) does NOT work.

Installing components, fine, it installs OK
BUT,

Once it is on the server, Apacahe, the folders and files are owned by Apache, no if's or. but's

mamboXploere can't change these permissions.
In order to work with these files and folders I HAVE to delete the folder within mamboXplorer and resinstall those using ftp.
Not a nice way of doing it but at least it works.

I did post on the other site, no one ever came with a proper solution.
By no one I mean none of the developers.
Maybe they do not have that problem.
Maybe they use their own server but I am sure that a very large proportion of the users of this CMS are sharing a server.

I have been told that it is a Apache server problem but why did I not have that problem when using the older versions of mambo?
Unlucky for me, I do not have an older version anymore.

Maybe in the installer there should be an option of deleting the just installed components and auto ftp them back again?

Yes, I used to run into that permissions problem with Mambo 4.5.2 and 4.5.2.3 but it was transitory. I got around it pretty much the same way Chris did. Copy the data to a new folder, delete the folder, rename the copied folder the original name. I have not had the problem since going to Joomla! Why you and not me? I don't know. I don't think I'm doing anything differently than I used to.

To answer Frankie's earlier question, I usually can find a free template that looks close enough to what the customer wants that I can use it with only minor edits. If I roll my own, I usually code by hand in CSE HTML Validator (http://www.htmlvalidator.com/), and then package and upload through the installer. If I use Dreamweaver, I use it offline and clean it up with CSE and test it carefully before I upload it. Once uploaded and installed, if I have to make tweaks, I do not trust Dreamweaver to do this, I either use the editor in my ftp client or I have used the html editor in the administrator; I have found it to be very helpful. In this way, I can ensure that my code is cleaner and I don't risk Dreamweaver deciding it knows how to code better than I do. Not that I'm any great shakes, but hopefully, I can do something better than a machine. I do not use GoLive.

wr

If apache has the "right" setup... you should have no problem!

tell your hosting Co. to check USER on apache, and mod_suexec.

many hosting Co. don't want to use user or mod_suexec because to work apache needs to be run as root... eventhough if used well, it should not pose a security issue (in the very old versions of apache, the main "hole" of running apache as root was that all of the log files would be written as root, and then an incredible well crafted request could pose a security thread... Apache >2 has a very complex an through schema to allow the http server to run as root and each virtual ansewering request as the user). The hostmaster would be much more protected by making /tmp a separate partition an making it noexec.

another solution (for the hostmaster) would be to have all users with the same uid than the "user" than runs apache, be sure to have a chroot for ftp, and not to have a general /tmp dir... which will force each user to define their own /tmp directory....

RobInk suggest in  Topic: Selectable /tmp folder? (http://forum.joomla.org/index.php/topic,10108.0.html) the following:


I do think that problems like the ones that started this topic should be solved by the hosting co. working together with the customer! Unluckily enough there are too many "hosting companies" that are simple resellers and are unable, or unwilling or do not know how to help the customer

Good Luck
Marcos

My 'good' and helpful host done what I asked and changed the ownership on all installed components (files folders) to 8033 and 99, no change whatoever, the Joomla > SMF Bridge doesn't install fully and I cannot d/l files (24 out of 45) from Remisotory to GoLive for customisation. I can't even download my components directory via FTP to do a back up and as suggested above, remove the directory and replace it.

I'm on Apache 1.33, but in my honest view this is an issue that's crept up in Mambo 4523 and Joomla 1 - WITHOUT DOUBT, and I'm estimating that the installer isn't doing what it should be doing and giving ownership to the user account. Even if Apache is running under an Admin account or as Root shouldn't make a difference as it's still applying ownership permissions to User accounts.

I'm going to try 4.5.1a later today, which should definitely clarify the matter. A good test btw is installing remository 320, and then trying to download the installed remo comp directory.

frank.

I am also having these problem.
I ftp upload whole contents of Joomla 1.0.2 packages to my webserver root or subfolder (tried both), it install normaly as i do that a lot of time, then i install component, and there begins the problem.
Joomla installation is owned by the ftp user, and new installed component,template etc are owned by apache (nobody 99),i have mamboxplorer but it can edit only files installed after installation, if can edit default installed files, and then ftp can only edit installation files not new files, i preferer one owner for this (or ftp user or apache)
I didnt change anything in CHMOD permision in installation used default details.

Server info(hosting):


Any help is welcome,
here is my post in Installation section: http://forum.joomla.org/index.php/topic,11276.0.html

Edit: Which permision you add to the folder in 1 step installation: I am puting 707 mybe that can be the problem but it dont have any connection with the ownership ((.



Thnx

This has been going on for quite some time.

Apart from telling us to have the people that manage the server to change it for you or to ask them to change the Apache setup.
Yes, if asked, they will change the ownership for me.
And No, they will not change their Apache setup.
The reason is, that is their policy.

It would be great if installations of components, modules, mambots and the like scripts, could be handled in the same way as the template folders and files.
Like, just ftp your templates to your site and Joomla will recognise and make them available.
If it can be done for templates, why not the other folders and/or files?

Also, that is how it works in some of the other CMS's

I asked my hosting company what to do here is they respons about changing ownership:


I am trying thins whole day without success, is there any of DEV ppl that see this post can you respons to use, tell some suggestion what to do on which way to install...

Thnx

No, I don't think it is a long procedure.
My host told me, just tell us the name of folders/files and they would change it.

That is not really my idea of doing business.
If I have a small problems I like to solve those myself and bother them only if there are server problems.

I said wrote before, my solution is:

Install component.
ftp back to my Dev machine (also the administrator folders/files!).
Use mamboXplorer to delete the folders/files owned by Apache.
There is a facility for that in mamboXplorer.
mamboXplorer most of the time will succeed doing that.
Otherwise, move all to a special folder with, say, the name delete and ask your hosting people to delete that folder.
That would be a very simple procedure for them
After all that, ftp the copied files back to your site.
Do NOT delete tables that are set-up during those installations.
When all done, you can use all those folders/files as if owned by you and not apache.

It is a solution but not very elegant.
Also time consuming.

And you know what, mamboXplorer is also owned by Apache.
I don't care about that though.

If your hosting company will not CHOWN the files for you, you are in a bit of a pickle. Perhaps you can delete the files via your control panel, either way.. that is quite disgraceful that they won't do their job.

brad wrote:


I don't think that hosting companies that will not chown file will have that facility available in the control panel.
At least, that is my conclusion of reading all the threads about the problem of having files owned by Apache.

By the way, will people who are using companies that you are associated with have no problems?

I use http://www.1and1.com to host 6 websites - shared hosting.

I know the problem you guys are talking about, because I have been experiencing this problem on the www server at work since I started using -ambo at version 4.5.

I've never had this problem with 1and1 Internet.

this means the files not there re upload all the smf files and this should go away, my guess is that there is summit on your pc which is preventing correct acitoning of your ftp program... (spyware etc)

the difference is that the installers run the sql statments through the install package and add the tables to database i guess, it might be possible to ftp the component up and run the sql via phpmyadmin or the like if you can extract it ?

any one know if this is the case?