php process not allowed to create files

[charled]

Hi everyone,

New to this forum as I first installed Xampp 5.6.31 in Mac OS X 10.9.5. And first problem.

I manually created a folder in htdocs/eefic/ and added the script which automatically installs my cms (contao.org).

First step : the script tests if it can create files and folder. But for now, the answer is no : "proprietary of folder test is deamon (should be root)" ; "proprietary of file test is deamon (should be root)".

What is wrong with my installation/configuration/permissions ?

Thanks for help.

[charled]

Hello,

Little up.
Does someone know how I can do to make proprietary of folders "root" ?
Thanks.

[Beltran]

Hi,

You can launch a terminal from the XAMPP UI and run the following command to change the files owner to 'root':

sudo chown -R root /opt/lampp/htdocs/eefic

[charled]

Hi Beltran,

Thanks for your answer. But But I'm on Mac and Xampp isn't installed in /opt/ but in /Applications/XAMPP/xamppfiles/htdocs
I applied the command to /htdocs/eefic/ folder and to /htdocs/ btu I still have the same problem.

[Nobbie]

If i get it right, the contao installation scipt runs a test with self-created folders and files and checks the ownership. It expects "root" as ownership. There is only one way to achieve this, run Apache with root permissions. Edit httpd.conf and look for "User daemon" and replace it by "User root" (or whatever the root account is in an OSX environment). Then restart Apache.

BUT: this is very very unlikely and in a real server environment it would be HUGE security risk.If any PHP script is infected by trojans (like many WordPress plugins are!), the attacker runs his attack with root permissions - what a horror!! Therefore i really cannot understand, why contao needs to create files and folders with ownership root. That is extremely weird and you definately should ask contao if this is really what the want?! Of course, in your private LAN and on your private Mac there is no risk, but probably contao also runs on public servers and i cannot believe that there is any provider which runs Apache with root permissions. Thats a pain!

Last not least, that might be an issue of the installer, which probably is designed to run in a linux environment only and is not yet tested in an OSX environment. Again, ask contao for support on that. Finally, that step is only a check, maybe contao installs well anyway. Or does it fail? If it does not fail, simply ignore that message.

[charled]

I use Contao in production for many years now on shared hosting. I never had pb with its security.

it can be installed two ways :
- manually by ftp,
- with this script.

This script tests 2 things :
- if php can create files and folder, i suppose because while it will download all necessary,
- if we can use Composer for plug-in management.
Both tests send an error. So I could install manually but i'd like ton understand.

Until now, I was using MAMP Pro with no problem but I'd like to learn Xampp as I want to work on Linux too.

Could you be kind to test it yourself. Perhaps do I miss something. Here you can download Check : https://github.com/contao/check/zipball/master .

Bonus : here (https://community.apachefriends.org/f/viewtopic.php?f=29&t=75849&start=15#p258737) you can see I tried xampp-vm too. But I'm on OS X 10.9.5 and it seems to be too old to find hypervisor.framework.

[Nobbie]

Could you be kind to test it yourself.

No. I neither have any Mac PC, nor can i support contao. You should ask contao instead.