I just updated my magento store to the latest SUPEE patches and shortly after when I was adding a new product to my site I found that something was wrong. When I upload a new image the jpg/png file won't preview like it used to. The exisiting images on other products load and preview when I place my cursor over them, but new images just give me the no preview icon. Where do I start to look here?

enter image description here

2 Answers 2


The problem is that Magento changed the permissions for newly created media files from 0777 to 0640.

This bascally means that you (or your hoster) have to make sure, that newly created files belong to the web-server User.

In some cases, this is not possible, then it should at least have the webservers group. This way, it can at least read the file.

If both are not possible (we have this problem with one hoster), you can create a cronjob which changes the permissions for your needs every x minutes.

Worst case would be, that the file is neither owned by, nor has the group of the webserver. In this case you would have to change the permissions to 0777 i think.

The cronjob entry would be looking something like this:

* * * * * chmod -R 0777 /your/magento/root/media

This is known issue.

The problem

The actual problem is when you upload the image from product edit page, it gets uploaded to all required folders, but not in the folder where edit area image thumb are kept. This is because security patch changed the media permission to prevent some attacks. Now, magento suggest we shouldn't have 777 permission in media folder.

How to fix it?

The web server must run as same user as PHP-FPM or be added to the PHP-FPM group. However, this will prevent an image from being removed from the product in the admin when you select the "Remove" checkbox on the Images tab.

To delete images manually, you must be logged to server as PHP-FPM user (not group, as the group permissions allow only reading of images).

This means, the physical image will be in your server, even after you delete it from admin area. This is to prevent some vulnerability on security.


If you have settings as above and still having problem, then Magento team has announced one more patch to fix it.

Today, we are distributing updates that improve our most recent security release. SUPEE-7405 v1.1, Enterprise Edition, and Community Edition add support for PHP 5.3 and address issues with upload file permissions, merging carts, and SOAP APIs experienced with the original release. They DO NOT address any new security issues.

This will fix the problem.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.