Ok, so I tried out what you suggested here… creating the directories, setting the appropriate ownership and permissions, and then turning safe mode back on. The results aren’t the best. Anyway, first of all, here’s what I did to set up the directories and set the perms:
# world-writeable directories are bad
chmod 755 wp-content
cd wp-content
chmod 755 cache
chown -R me:me cache
cd cache
# full salted directory path not shown
chmod 755 c4ca4238a...
chmod 755 userlogins users
cd c4ca4238a...
chmod 755 category options pages
cd ../..
# set up 10 years' worth of directories
cd uploads
for YEAR in 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015
do
for MONTH in 1 2 3 4 5 6 7 8 9 10 11 12
do
mkdir -p "${YEAR}/${MONTH}"
done
done
cd ..
chown -R me:me uploads
chmod 755 uploads
Now file uploads work, but strangely:
-rwxrwxrwx 1 apache apache 13364 Dec 28 16:17 P.jpg*
-rw-r--r-- 1 apache apache 2205 Dec 28 16:17 P.thumbnail.jpg
Note that the uploaded file is created with permissions of 777, but the thumbnail generated by WordPress has permissions of 644. In both cases the files are owned by the Apache user/group. There are no problems deleting these files. I am a little surprised that the created files are owned by apache:apache, because my reading of the safe mode documentation — https://www.php.net/features.safe-mode — leads me to believe that created files should be owned by me:me (ie. the owner of the scripts) even though created directories are owned by the Apache user/group. By using the phpinfo() function I’ve been able to confirm that safe mode is definitely enabled in the directory where my WordPress install resides; and my WordPress scripts are all definitely owned by me:me.
The cache, on the other hand, doesn’t seem to work at all. I tried clearing out the cache and no matter how many pages I visit no new object files are written to the cache.
Finally, for the weirdest part of all; with the wp-content permissions set to 755 I couldn’t view my weblog at all! The admin pages worked, but all the public pages returned zero byte non-HTML pages (that is, my browser attempted to download them instead of displaying them). I set the permissions back to 777 and the problem went away. Then I set them back to 755 and everything continued to work. I suspect that there is something fishy in the cache code. I am going to take a look at it.
