Read, write, execute to everyone on every Sugar file?

[jmugauri]

Been trying to use the upgrade function in SugarCRM, and it's list of files with bad permissions contains pretty much every file in the Sugar directory which is not already chmod 777 after installing application and various modules.

Is this right? What are the security implications on an apache server?

[sanjaykatiyar1]

Instead of given 777 to each file and directories just change the ownership of sugar folder to
apache (or webserver user)

[jmugauri]

Done that, which is an excellent idea..

But the upgrade wizard still won't proceed past the checks, because it's finding files with bad permissions.. Can't we just put a check condition here which only does the file permission check AFTER verifying that apache is not the owner of the files (and hence Sugar will have no access to them)?

[chrisky]

Done that, which is an excellent idea..

But the upgrade wizard still won't proceed past the checks, because it's finding files with bad permissions.. Can't we just put a check condition here which only does the file permission check AFTER verifying that apache is not the owner of the files (and hence Sugar will have no access to them)?

Spectacular idea! And you sure can add such condition, and it'll probably work beautifully in preventing further permissions issues..

[andydreisch]

jmugauri, I'll ask the Dev team to comment on this.

Andy

[sugarchris]

Even if file/folder owner is apache (recommended way to run Sugar), there is an edge-case where the permissions are set in a way that apache cannot write/overwrite the file. This will cause the upgrade wizard to fail mid-upgrade, hence the full check on every upgrade.

The test we run is is_writeable() which doesn't care who owns the file, just that PHP via web server can overwrite the file.

Basic web-admin best-practices is the chown the entire folder structure to the apache user. This does not guarantee that apache can actually *create*, *delete* and/or overwrite files. We have to check for it regardless.