So would it make sense to establish a best practice (or requirement) where themes should not (or must not) create files at all? In other words, themes would need to ship with those files already in place, even if only to function as placeholders to be overwritten.<br>
<br>Regarding the 666 permissions and Editor, why not have WP do a simple check for unsafe permissions and alert/remind the user to change them back to a more secure setting?<br><br>I'm just thinking out loud here.<br>
<br><br><div class="gmail_quote">On Sat, Jun 25, 2011 at 8:20 AM, Otto <span dir="ltr"><<a href="mailto:otto@ottodestruct.com">otto@ottodestruct.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div class="im">On Fri, Jun 24, 2011 at 6:02 PM, Darren Slatten <<a href="mailto:darrenslatten@gmail.com">darrenslatten@gmail.com</a>> wrote:<br>
> WordPress writes data to theme files via the Appearance => Editor admin<br>
> panel, without requiring FTP credentials. It only requires that the file<br>
> being edited has '666' permissions, which I assume the user has to configure<br>
> manually.<br>
<br>
</div>Few things about that.<br>
<br>
1. They keep trying to remove that functionality from WordPress. I<br>
keep arguing for it to be left in there.<br>
<br>
2. Writing to existing files doesn't change ownership of them.<br>
Creating new files as a different user leaves them with the ownership<br>
of the creating process, which is the main problem with creating files<br>
on (non-setuid) shared hosting.<br>
<br>
3. Files having 666 permissions is dangerous as hell too. It is not<br>
recommended. Standard permissions in WP are 644 for files and 755 for<br>
directories, as we state on the codex.<br>
<br>
4. If a site is using setuid methods (like I described in the previous<br>
email), then that editor doesn't require 666 permissions. It works<br>
perfectly happily with 644 perms.<br>
<div><div></div><div class="h5"><br>
-Otto<br>
_______________________________________________<br>
theme-reviewers mailing list<br>
<a href="mailto:theme-reviewers@lists.wordpress.org">theme-reviewers@lists.wordpress.org</a><br>
<a href="http://lists.wordpress.org/mailman/listinfo/theme-reviewers" target="_blank">http://lists.wordpress.org/mailman/listinfo/theme-reviewers</a><br>
</div></div></blockquote></div><br>