Joomla! Discussion Forums

Here is my orginal post in Installation area:http://forum.joomla.org/index.php/topic,11276.0.html
The problem isnt SAFE MODE: ON (its OFF) all is green on 1 step of installation, i dont get it what is wrong, whay is new installed component are owned by apache, why cant joomla installation also be then owned by apache. Well mybe i didnt tell my hosting what to do in fine way i dont know what to tell my hosting about this.

Thnx

Because the seemingly most used server setup is that PHP is executed within the Apache process without any user context switch. That's it. Safe mode on/off doesn't matter. But when safe mode is on the very same PHP script that was just able to create a directory may not be able to access it anymore.
It's maybe like on your local computer... when you are logged in as User A, the files you create are owned by User A... and not User B, even if this may be your main user account. The Apache runs as a user and your FTP account is a different user account. It is possible that for PHP the user context is switched to the one of your FTP account. But this is something not done by the PHP script itself.
I hope that makes sense.

Yes it make sense now, but what i need to write to my hosting company, before this all was right and funkcioniren OK.
My english is not so good, and i dont know what to tell them what they should do for me.
In .htaccess i can write some switch like:

And this functionired OK mybe i can add something to make this working.
Its more sense to me that joomla also be owned by apache, then half owned by apache,half by ftp user.
Thnx to trying help.

Ideally (from the security/permission point of view) it would be if the host would set up the server to execute PHP as your FTP user account.
You should find a bit in this thread: http://bugs.php.net/bug.php?id=24604
(There seem to be the possibilities of using: suPHP, suexec and running PHP as CGI instead of a module)
Another issue is the performance... I have no idea whether it will really make any recognizable difference nowadays.

If that is not an option you could ask your host to change the owner of the files whenever you have a problem with it.
(Not every host will want to do this though... your host seem to be one of those)

In addition you should try the Joomla/Mambo-Explorer (or any other PHP file manager) and set the permissions of the files in question to 777. If you then still cannot access the files you could maybe ask your host to change the user groups somehow so that it is possible. (This of course may reduce overall security)

Someday there may be a safe mode patch available (or integrated)... this would also workaround your problem. (As said helps also with safe mode off).

(I doubt you will be able to do anything helpful with the .htaccess settings in regard to this problem)

So I don't know what you should write your host... but your host seem not be very happy to change/do anything at all anyway.

THIS PROBLEM IS 'OWNER' PERMISSION RELATED NOT 'FILE' PERMISSION.

My host fixed permissions on the files and folders as mentioned, but that's not really a long term usable solution, especially for developing and customising a site.

I feel the problem has to do with the new permission features brought out in 4523 ? and Joomla 1 under Global > Server > Set Permissions. No matter which setting you choose, either leave it to server or set permissions, Joomla does not set 'owner' permissions to the user account, which I believe it should do through PHP and it certainly does this on the main install for the main Joom software. Just browse any folder using XPlorer and you'll see it's only folders and files that are installed using one of the add-on installers. This is where the problem lies. The add-on installer just isn't setting owner permissions as it should, perhaps missing a setting from the Global Config or not taking into account the 'leave to server option' where the server would set the user account properly?

CAN WE GET OFFICIAL CONFIRMATION OF THIS PLEASE?  

p.s. safe mode is not a problem.

frankie777 that is what i am also talking. Look here at my post


Installation files are owned by ftp user, and every new installed component, module etc etc is owned by apache. And i think that this isnt OK ).

I hope there will be confirmation regarding files OWNER (permisions are not problem), and hope some fix.

Thnnx

Well, permissions and the user group configuration affects what you can do with the files using your FTP account.
But you cannot just change the owner to your FTP account using a PHP script (beside the workarounds actually using your FTP access info)... because of that and because the hosts usually won't change the configuration the permissions are the first things to try out extensively.

It may be possible that a script causes a file owner change to the Apache user. That could be another thing to look at but should not really involve directories/files created by the installer.

Nah, what I'm saying is that perhaps ownership isn't being passed to the server at all and that there's a bug in the installer.

FYI A 'better' installer for Joomla is in the works. This will ensure situations like this don't happen. The best you can do now is to ask your host to chown any files incorrectly owned.

So is there a bug in the installer or has something 'mysterious' crept in from 452? Just looking for definitives here 

It's not a Mambo/Joomla problem. I run active development using Dreamweaver all day long on our servers and have never once been denied access to a file installed by Mambo/Joomla. I currently develop on everything from the 4.5.x series through Joomla subversion releases

No bug.. it's a combination of how apache and how some webservers are setup. Joomla is not the only script affected by these issues FYI. An 'FTP installer' *may* solve the problem... as I said.. it is being worked on.

it is being worked on
For a lot of us, that will be a blessing.

So for accounts that don't allow FTP usage through PHP, will the new installer help?

And what is correctly owner of joomla and joomla files. FTP user owned all or apache (nobody) owned all , thnx for working on this situation, i will test whatever you post as fix to get all working .

THnx

Yes, that is the "old way." It can still be done. You should be able to see from the installation package what folder the files belong in and any sql script is generally easy to find. The installers are to make life easier. But, there are always those times when the "easier" way is the harder way.

Because the Joomla goal is to create a web based Applications Program Interface (API) the developers have created a very user friendly environment that Third Party Developers (3PDs) can write to. It is part of what makes Joomla so great and why there are so many different things that one can do with Joomla, which is part of why the community is so big and diverse.

Joomla continues to develop and get better, but going back to a more "techy" way for all when only a few have problems is probably not best for the community at large. Having heard that the installers are going to get better is even more reason for encouragement.



wr

I can try to write to my hosting so they FIX this, but i dont know what to tell them to do.
Waht is way php shoud be installed as cgi or other. etc etc, my hosting is http://www.hostdime.com (actualy i get the free hosting of freend that have by them Reseler account).

Here is 1 Step of Joomla 1.0.2 install all is green ((. THis is only in .htaccess insert:
php_flag magic_quotes_gpc On
php_flag register_globals Off

I dont wonna Joomla back to old install, but improve this one. I prefer all files and folder owned by apache.  ANd ppl what is your owner of installation files, and new installed components??? THnx

Crow, can you explain what you're doing with the .htaccess file? Are you aware of the optional Joomla Global On/Off file switch in the install notes under help above?

After all the above discussions, I can't see what the real benefit is in telling your host to set 'owner permissions' within your Joomla site directory to your user account as whatever new add-on you install will still revert to Nobody as owner, but it may help in the short-term.

While writing, is there developer documentation of the Global Configuration > Server features available?

You know, after all the hassles with issues like this and others, I'm tempted to move back to Mambo if they're moving to a corporate plan. 

I just put in /public_html/ file name .htaccess with this contents:

I know there is file in joomla that need to be renamed or so but i didnt use it(thinking that if in first step all is gree as you can see that all will work) But i also have tried without that htaccess file and there magic quotes and register globals are red, but it doesnt metther for installation. Installation is owned by ftp user, anything new installed by apache nobody 99 user.

I also dont see anything good to telling my host to set owner, as if i install something new then again is owned by ftp user.
Ownership as ftpuser:nobody will be perfect ).

I will stay with Joomla will not move to anything, just if of security aspect new installed stuff are owned by apache, then i wonna also the installation files of joomla to be owned by apache....

Thnx to all.

Solution provided by "Saka"

During installation in Step 3, choice to CHMOD  Files to 777 (chek all), and CHMOD  Direktoris to 777 (check all),
THe installation files and directory will be owned by ftp user, and the new installed component by apache, BUT BUT
You will have permision with FTP to edit that files. I have checked with com_mamboxplorer (i edited files by ftp, changed tooltip in english language and saved, uploaded normaly.

Hope this help to someone, and thnx to "Saka"

You wrote: "During installation in Step 3, choice to CHMOD  Files to 777 (chek all), and CHMOD  Direktoris to 777 (check all),"

Can you explain that?
What do you mean by step 3 ?
Where did SAKA wrote that?
Who wants to chmod ALL files and ALL folders to 777 and leave it that way?

Does this suggest that if I chmod ALL my files and ALL my folders to 777 and then install a non-core component I do not have ownership problems?

Step 3 of the installation process.

However you can also do it later:

Site - Global Configuration - Server
File Permissions - CHMOD new files to - Check all flags including "Apply to existing files"
Same for "Directory Permissions"

Edit:

Ownership problems are not solved this way. However since you can overwrite all files created by apache with your ftp account you no longer have problems to manage the site.

Personally I dont like to chmod 777 since I consider that a security risk. Unfortunately many hosters and providers are not able to provide a virtual apache server AND a ftp account running with the same user/group, otherwise life would be much easier and sites would be much more secure. I have been told lately that this is not because they dont see the problem, but because of constraints of cPanel which is used by many providers. I cannot say if that is true or just an excuse, however it really seems that many servers with other control panels than cPanel are set up properly while all cPanel based hosts I have come across so far have that problem of different user/group for apache and ftp.

There is an alternative for the hosting co. that chooses cpanel (I think)...

Change the primary group of all users (and make it for new users) to the same group that apache runs. (most of the time it would be nobody, apache or web).

Then, when installing Joomla you will need to do a chmod to 775 (or.. read/write/execute for user and group, and read/execute for world .. to be able to change permissions you need to check on "CHMOD files to:" and "CHMOD directories to:")

It's a little more secure than 777 (world would have write too), but still not the most secure. The ideal situation is that your provider runs apache with suexec or equivalent, in such a way that when php writes a file in your area the owner will be your ftp user.

The problem with 777 and 775 is that another user in the same system could be able to write files to your directories, and overwrite or erase your files, not thru ftp (that has a good "jail" or chroot system) but thru php, as long as it can guess the real path to your Joomla site. I guess that a well crafted php request could even read your configuration.php file, giving him/her direct access to your database.

This is not a Joomla! problem.. it could be a php problem (depending on the php configuration).

If you are looking for a host, a good question to ask is "will my Joomla be writing files as my ftp user or as the apache user?". and choose a host that answers you " as the ftp user".

Cheers!
Marcos

Let's just wait for what Brad said and wait for the ftp installer and separate DB table installer.

All other solutions are just not my choice with having to set permissions to 775 and/or 777

I think we all know now that it is not a fault of Joomla, php, the host or whatever but it could be done for us sufferers.

Exactly, good point, it works in dreamweaver, there is no problem with os-commerce installed on apache server, and most other php scripts, but the problem is within Mambo and Joomla....



Norgaard

Mod note: this is a pretty old thread. I think we might lock it. If you want to discuss this issue further, feel free to open a new thread.