I work at a company where I noticed that most of our Magento 2 file system is owned by
www-data and in the
www-data group on our Ubuntu server.
Furthermore, the docroot directory
/var/www/<websitename> has the same ownership, and an exceeding amount of directories in the Magento file system have both
www-data ownership and
777 permissions, e.g.
var amongst others.
The main user that is used for CLI work is not in the
Is this an acceptable practice in some situations? Or is it always bad practice? Should I tell the webmaster to consider changing this? I consider this to be unnecessary and a dangerous security vulnerability, but I want to know whether it's permissible in some cases.