October: Unable to create / edit Asset files in the CMS

[Somel1978]

New User of OctoberCMS ... Well was trying but will need to move on to different systems as this is a quite annoying issue and from what I could gather reading online....
An issue that has been detected in 2014 apparently.

Initially we had planned to deploy this within azure on a windowsNT build with the correct stack installed.

Issues:
Whenever we try to edit any file we get error 403 within the CMS app.
Whenever we upload a image file, and try to open that file we get a error 500.

We though, it's clear a directory permissions and we can just change and we will be sorted.
We couldn't be more wrong. It does in fact solve the problem temporarily but every time you install a new theme or run a force update those manually set permissions are gone.
So manually setting permissions is not an option. As for some reason the install/update scripts rewrite the permissions.

We went a little further and had a shared host account (namecheap) and we try to install it there.
We got exactly the same behaviour, with fresh installs.
We even try to add mod_security.c off to .htaccess to no avail.

It seems the issue is OS agnostic and has something to do how the scripta (install/update) set the permissions for CMS.

Any ideas welcome.

[Somel1978]

Ok so this is in essence two separate issues.
One is related to Windows NT directory permissions
The other is related to mod_security in Apache. We had to white list rules 212980 , 212970, 212890, 212860, 212740, 212340.

[bennothommo]

@Somel1978 so are you saying that the permissions are being affected by Windows NT and mod_security, and not October?

[Somel1978]

No....

We own WindowsNT servers and tried installing OctoberCMS with the proper stack installed. When we installed October CMS everything went well except when we start looking into themes.

• We realized that we could edit, save pages and partials. When we tried to upload additional images or edit any file within the assets folder we received an error 500. Under further investigation we noticed, that the assets folder did not have writing permissions. Strangely enough it seems that was the only folder that did not respect inherit permissions.
  So we manually changed the permissions and everything seem to be looking good. Until we decided to test another theme. So we download a new theme and activate it. For our surprise on the new theme we had the same issue again. Keep in mind that we had previously manually set the permissions correctly from the root folder and subsequent theme directories.
  From our findings every time we use the install/update the permissions for the assets folder files and subs are incorrectly set and do not respect inherit permissions.
  This is the first issue.

The Second issue.
As we have a namecheap shared hosting as well, as part of our troubleshooting, we tried to install October in the shared host.
We did find that the directory structure were properly set and directory permissions were ok.in Linux...
However we ended up running on some issues, on the namecheap host, with Mod Security. After troubleshooting we had to white list the rules mentioned above. We still need to test this furthe, but seems ok now.

So in essence we have two distinct issues in two distinct platforms.

Hope it clarifies

[LukeTowers]

See https://octobercms.com/support/article/ke-1 and with regards to your permissions errors check cms.defaultMask: https://github.com/octobercms/october/blob/master/config/cms.php#L348-L357

[Somel1978]

Had seen the article from 2015 related to mod security. Hence why we contacted namecheap for the white list.
However being an old article an update stating that this is still valid in 2020 would be a good idea, as apparently is an issue with 5 years
At least there is a workaround, (a solutuon would imply a permanent fix).

Not sure what I'm suppose to look at on the tip you sent related to permissions but will forward it to the system admin.

Thanks in advance

[LukeTowers]

@Somel1978 you might need to set default permission masks to use on new files with that config setting, otherwise I'm not sure if your server might just be creating files with permissions that are too restrictive.

[Somel1978]

Gotcha.....

I just find it odd that as far we can tell it only happens with the CMS Assets folder and not with every file created directory created.

[LukeTowers]

It might be because the Asset class is it's own separate logic while the rest of the theme files are handled by Halcyon models: https://github.com/octobercms/october/blob/master/modules/cms/classes/Asset.php vs https://github.com/octobercms/october/blob/master/modules/cms/classes/CmsObject.php

[Somel1978]

Interesting any particular reason why is this?!

[LukeTowers]

@Somel1978 I believe it's because Halcyon models aren't designed to deal with large files (as asset files often are). No idea why the difference would cause permission errors though, AFAIK it is still using the same underlying filesystem driver.

[github-actions[bot]]

This issue will be closed and archived in 3 days, as there has been no activity in the last 30 days.
If this issue is still relevant or you would like to see it actioned, please respond and we will re-open this issue.
If this issue is critical to your business, consider joining the Premium Support Program where a Service Level Agreement is offered.

[simpltek]

@LukeTowers
I have this same issue, and as I can assume above it was never explained or resolved, however, it persists in the most recent version of OctoberCMS.

I have an Apache 2.4 environment on shared hosting, with a fully defaulted public/ folder. Here's what I did to replicate this issue:

• I downloaded the install-master.zip and extracted it
• SFTP uploaded all the extracted files to my public/ dir
• I accessed the install.php page
• As expected from freshly uploaded files, I failed the permissions check
• As per the docs, I grant writing permissions on all dirs and files in public/ ("chmod -R 777 public/")
• I refresh the install page, I pass permissions check
• I proceed to install OctoberCMS, using all the defaults, other than choosing SQLite for the database instead of MySQL
• I get to the pick a theme page, and choose "Start from scratch"
• OctoberCMS installs to public/ as expected
• I check the permissions of public/themes/demo/assets/, and it still shows as 777, seemingly good news
• I log into the backend, and go to try and edit the theme.css in the assets/css/ folder: it saves, cool
• However, when I try to create a new file and hitting "Save", I get a 500 error message:
  

Nothing else was changed. I get this error on a fresh install everytime, no matter what I do. For whatever reason, you cannot create new files in the assets folder of a theme.

I would greatly appreciate if this issue was at the very least explained.

[LukeTowers]

@simpltek I'm unable to replicate locally, perhaps @bennothommo is able to try out your instructions?

[bennothommo]

@simpltek @LukeTowers on a fresh VPS with Apache 2.4 and following the instructions to the letter, I can confirm I see the same issue. Taking a look now.

[bennothommo]

@simpltek The issue is related to this commit (sorry @LukeTowers): https://github.com/octobercms/october/commit/2b8939cc8b5b6fe81e093fe2c9f883ada4e3c8cc

When determining the file path of the new asset, the realpath call there returns false because the file does not exist (yet). Because of this, it cannot save a new file, but it can edit files just fine.

We have fixed this, but the fix is within our Laravel 6 upgrade which is not yet published as a stable release.

You have three options at this juncture:

• You can simply create the files as needed through FTP or your IDE, and use your IDE as the primary development tool - this is probably not ideal for your situation.
• Or, you can install October CMS via Composer (or alternatively, convert your Wizard installation into a Composer installation - details for that are on the same page) and install version 465 of October, which was our last stable build before the above commit. You can do this by editing the composer.json file that you retrieved from GitHub and changing all october/*** requirements to use v1.0.465.
• Or, you can install October CMS via Composer and use our Laravel 6 update by following these instructions.

You could also just revert the changes manually in the commit above in your installation, but this would be overridden on the next update.

[simpltek]

Thank you so much @bennothommo for looking into this. I will probably just modify my Asset.php file for now and not update until the Laravel 6 update is stable.

Cheers 👍