Hi everyone,

if the permissions settings for files directory --under sites/default directory-- are

FOR DIRECTORIES AND SUBDIRECTORIES

owner: apache web server
group: group account name

permissions: 754 (rwxr-xr--)

FOR FILES INSIDE THE ABOVE DIRECTORIES

owner:apache web server
group: apache web server

permissions:664(rw-rw-r--)

Is it a security risk to have apache as the owner of files directory?

thanks in advance

Comments

beasley’s picture

Try running the Security Review module to see if you've given the wrong permissions anywhere:
http://drupal.org/project/security_review