In order to tighten security of D6 against malicious XSS file uploads, I am wondering what files and folders can have go-x permission where the group is webserver.


All folders need +x perhaps you're referring to +w ? In which case, only the files folder e.g in /sites/default/files needs to be +w by the webserver. All other folders can be owned and writeable by root only.

Here's some find commands to recursively chmod the file/folder permissions correctly

;Change all directories to 755 (-rwxr-xr-x):
find /var/www/mysite -type d -exec chmod 755 {} \;

;Change all files to 644 (-rw-r--r--):
find /var/www/mysite -type f -exec chmod 644 {} \;

;Change ownership of files directory and files to webserver user, e.g www-data
chown -R www-data:www-data sites/default/files

Update: example nginx conf to disallow .php file access in the files directory:

# Do not attempt to serve php files within sites/default/files
location ~* ^/sites/default/files/.*\.php$ {
    return 404;
  • David, the problem that I'm struggling is that, when I allow execution on files, people upload malicious images and do session hijacking. When I remove execution permission form folders the can not do that but then no uploaded images is displayed. Any suggestions to avoid this? Thanks – alfish Jan 22 '14 at 22:38
  • You can't remove +x from folders and +x shouldn't be on most files in the first place. Images should only by jpg,png etc.. not executable files. Files in the files dir can't be executed either if using the standard core .htaccess file handler in there – David Thomas Jan 22 '14 at 22:49
  • well I'm using nginx in front of php-fpm so .htaccess can not help. – alfish Jan 22 '14 at 23:03
  • 1
    Also make sure you have try_files $uri =404; under your location ~ \.php$ fpm settings (source) – Clive Jan 23 '14 at 1:26
  • 1
    Yes, that will prevent trying to execute image.jpg as a php script if image.jpg.php is requested (and it doesn't exist) see also: wiki.nginx.org/Pitfalls > Passing Uncontrolled Requests to PHP – David Thomas Jan 23 '14 at 1:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.