Msg#: 3541763 posted 4:10 pm on Jan 8, 2008 (gmt 0)
I'm no security expert, but I know that 777 is generally bad news (full read/write for any user/group) - but 755 is usually ok, as it gives full rwx only to the owner (apache). In any case it's definitely better than 777.
Msg#: 3541763 posted 4:17 pm on Jan 8, 2008 (gmt 0)
You normally have to assign 777 to any directory/folder that can be manipulated by a script (adding/deleting/renaming of subdirectories/subfolders where script generated content is stored). I see no problem with this as it's quite common. It's the script files that need security...
Msg#: 3541763 posted 1:11 am on Jan 9, 2008 (gmt 0)
apache-owned and 755 permissions would be way better than 777. i would wonder why the server or MT needs write permission for the root directory. it would be better to understand and solve the problem securely than to settle for whatever works first.
Msg#: 3541763 posted 1:53 am on Jan 9, 2008 (gmt 0)
Your particular server setup will make a large difference to how much of a risk 777 is. A dedicated server with appropriate additional safety measures in place and a good chroot can make it acceptably safe for many people.