Permissions for all files and folders?

[spirelli]

Dear all, could you please give me guidance on what permissions (chmod) to set on the Contao files and folders on the FTP space?

Our site was attacked and we were advised to review the permissions. I'm not 100% sure what I should use and would be grateful for any help.

[ramjet]

The easiest way is to use your ftp programme to recursively set ALL folders to 755 and ALL files to 644.
Then run the system check tool, and it will show you any you WILL need to change.

http://www.contao.org/configuring-th...tem-check-tool
and
http://www.contao.org/installing-contao.html should be helpful

[grapio]

Also it is useful to use ftp for uploading files. FTP settings could be entered in Contao --> Settings. By using FTP you don't have to make certain files and directories writable for apache, only for the ftp user.

[spirelli]

Great, thanks for the replies. I have changed all the permissions as per ramjet's instructions and have also run the check tool.

Just a couple of questions about the check results - http://www.fightforsight.org.uk/typolig ... php?hide=1

- The errors at the top:
===========================
Memory limit • Recommended setting is 16M or greater.
Register globals • On Recommended setting is Off.
===========================
These are PHP settings as I understand. Is that something the hosting company has to set? Or can I do somehow? Or should I not worry about these?


- The errors under 'Files'
1. I actually don't see any that need the permissions changed. Am I right in thinking that permissions are now ok for my installation (all files 644 and all folders 755)?

2. There are a lot of .htaccess files missing. Should I worry?

3. There are quite a few files that say 'corrupt'. However, as far as I can see the Typolight installation runs perfectly fine. So again, I'm tempted to ignore.


Thank you for any further help.

[ramjet]

You should (it depends on your host) be able to set these by putting a file called php.ini in your root directory, with the following lines in it:

register_globals = 0
memory_limit = 128M

I would definitely reupload and overwrite the php files mentioned.... make sure you transfer them in ASCII mode, not binary mode in your FTP program.

Re the .htaccess.... I would, it won't take you long (again ASCII mode).
Your permissions are all good.

[spirelli]

Thanks ramjet.

I have checked with the host, and they say that for the memory limit the global setting for the server is 32MB (can't be changed), and the register_globals is also turned on and needs to stay on for this server.

So, two things for me to ask:

1) I wonder why TL check tool flags up Memory limit as 32MB is greater than the recommended 16MB. What's that about? And what are the implications of having a higher memory limit? I guess the site's faster, is that right?

2) What are the implications of having Register globals turned on? Does this make the site less secure or something?

In any case, they could move the site to a newer server at a cost with Register globals turned off and with 128MB memory limit. I guess it's worth it, but I'd like to understand a little more before I go for it.

Many thanks.

[ramjet]

http://nz2.php.net/manual/en/ini.cor...gister-globals

You want higher memory to deal with thumbnail conversion etc.... your host probably keeps it low because they have too many sites on the server or the server is old.

they could move the site to a newer server at a cost with Register globals turned off and with 128MB memory limit

You really want a hosting situation where you can control the server yourself via php.ini.
My advice is to ditch your host. They sound like they have old systems and are overcrowding them and are charging unneccesarily. Also their security sounds lax... chances are its their fault your site got "attacked" not yours.
If you put up a phpinfo.php file you will see whether Contao or your host is fibbing re Memory limit available to your site