0

After migrating from Apache server to IIS (7.5), I have some permission problems in Drupal: modules don't seem to have the permissions to delete (unlink) or create files, not even from/into "sites/default/files" folder.

What really interesting is, that if I create my own test.php with a simple file_put_contents in it, it does create and unlink files without any error messages.


BUT for example from AddThis module I got the following error message:

unlink(sites/default/files/addthis/addthis_widget.js) [function.unlink]: Permission denied in C:\<mydrupalpath>\source\includes\file.inc on line 481.

After that, I right clicked the mentioned file, Properties > Security tab > added Everyone with "Full control" rights. Not surprising, this way unlink was already successful.

BUT after that, I can see this it in the Drupal log:

"The directory sites/default/files/addthis is not writable, because it does not have the correct permissions set"


OK, tried to set the right permissions with icacls with granting "modify" and "write" permission to sites/default/files directory like this:

c:\<mydrupalpath>\source\sites\default\files /t /grant "IIS APPPOOL\MyDrupalAppPool":(OI)(CI)(M,W,RX)

OK, result is "Successfully processed 228 files".
Refreshing Drupal site in browser...
Hmm, didn't work, the same error message again (permission problems)...

I don't understand... if I query the rights with icacls on "files" OR files\addthis directory, it says my application pool does have "modify" rights:

IIS APPPOOL\MyDrupalAppPool:(OI)(CI)(M)

I do have permission problems with Gallery module too... :(

What should I do not to have permission problems in "files" folder when modules try to delete from/write into it?

Thanks in advance!

1

From here I got the idea to run the following command on a console ("Determining the account used as IIS anonymous identity"):

%windir%\system32\inetsrv\appcmd.exe list config "MyDrupalAppPool" ^ /section:anonymousAuthentication

The result was the following:

<system.webServer>
  <security>
    <authentication>
      <anonymousAuthentication enabled="true" userName="IUSR" />
    </authentication>
  </security>
</system.webServer>

And then running the following command seems to have solved the problem of writing to/deleting from the "files" directory:

icacls c:\<mydrupalpath>\sites\default\files /t /grant IUSR:(OI)(CI)(M)

I don't know if it's secure enough... Please leave comments if you think there is any kind of problem with this approach. Thanks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.