4

I am having a strange issue when uploading an image through the backend of magento. I currently have my /media/ permissions set to 777, however whenever I upload an image it changes the permissions to 600 which makes it not viewable until I change it manually back to 777. Is there a way to set it as default to be 777?

  • 2
    Possible duplicate of Security Patch SUPEE-7405 - possible problems? – MagenX Jan 30 '16 at 9:16
  • After applying SUPEE-7405 v1.0, apply SUPEE-7405 v1.1 to change permissions back. There were 4 items that caused grief on the version 1 patch that are addressed by the version 1.1 patch. – Fiasco Labs May 9 '16 at 4:20
10

Basically, the latest Magento security patch SUPEE-7405 affects file permissions on images uploaded from the Magento admin dashboard. Before applying the patch, uploaded files via admin panel such as product images, cms pages etc. used 0777 permissions and the patch changes these permissions to 0640 and 0750 which make them inaccessible for all users.

For easier demonstration, you can check the changes in this file: lib/Varien/File/Uploader.php

diff --git lib/Varien/File/Uploader.php lib/Varien/File/Uploader.php
---
---
-        chmod($destinationFile, 0777);
+        chmod($destinationFile, 0640);
---
---
-        if (!(@is_dir($destinationFolder) || @mkdir($destinationFolder, 0777, true))){
+        if (!(@is_dir($destinationFolder) || @mkdir($destinationFolder, 0750, true))){

A new version of SUPEE-7405 has been released to resolve this issue but even without this revised version, you can permanently fix it with one of the following ways:

Option 1:

You can perform a manual change on the file the file lib/Varien/File/Uploader.php to adjust the 0640/0750 permissions.

Option 2:

Because Magento expects the webserver to own the site files:

http://devdocs.magento.com/guides/m1x/install/installer-privileges_after.html#privs-after

The other way to resolve the problem is making the webserver the owner of the files

chown -R web-server-user-name magento/root/path

The webserver user name is commonly www-data or apache.

For more details, you can visit this tutorial

|improve this answer|||||
1

Magento use 700 permissions (drwx------) for the media/ and var/ directories give full control (that is, read/write/execute) to the owner and no permissions to anyone else.

Magento expects the webserver to own the site files:

http://devdocs.magento.com/guides/m1x/install/installer-privileges_after.html#privs-after

You can resolve this problem by making the webserver the owner of the files.

chown -R web-server-user-name magento/root/path

The webserver user name is commonly www-data or apache.

If you follow the instructions in the above link, the webserver will have read access to all files, and write access to media files and var files. This should be all you need for typical site operation. If you need to use Magento Connect you'll have to temporarily give the webserver write access to all files.

All file permissions are being set to CHMOD 640 which makes them inaccessible to all users.

Only the webserver user needs access to the files. There is no need to grant any permissions to all users.

You may want to grant access to a specific user if, for example, you need to edit or upload files via FTP. In this case, what I do is set a user who owns the file system and set the files' group to the webserver:

cd magento/root/directory

# Set ownership 
# 'username' should be the file system owner username
# 'webserver' should be the webserver username
chown -R username:webserver .

# Give the user read/write access to all files.
# Give the webserver read access to all files
find . -type f -exec chmod 640 {} \;
find . -type d -exec chmod 2750 {} \; 

# Give the user and the webserver read/write access to var and media
find var/ -type f -exec chmod 660 {} \;
find media/ -type f -exec chmod 660 {} \;
find var/ -type d -exec chmod 2770 {} \;
find media/ -type d -exec chmod 2770 {} \;
chmod 2770 includes
chmod 660 includes/config.php

The above commands will give your file system owner read/write access to everything and the webserver read access to everything. The webserver will also be able to write to the media and var directories.

This is a patch 7405 bug, look my search source

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.