View Issue Details

This issue affects 1 person(s).
 4
IDProjectCategoryView StatusLast Update
20618Bug reportsDocumentationpublic2026-07-29 17:45
ReporterWLB Assigned Totibor.pacalat  
PrioritynoneSeverityminor 
Status closedResolutionwon't fix 
Product Version7.0.x 
Summary20618: Command given in documentation leads to warning
Description

In https://www.limesurvey.org/manual/Installation_security_hints, you
suggest running the following commands on a self-hosted instance:

$ chown -R myaccount:apache limesurvey/
$ chmod -R o-r-w-x limesurvey/
$ chmod -R -w limesurvey/
$ chmod -R 770 limesurvey/application/config
$ chmod -R 770 limesurvey/tmp
$ chmod -R 770 limesurvey/upload

The third command in this list, throws 20638 warnings (for 20638
individual filesystem objects), at least in our setup.
It is always the same warning, only the path and filesystem object name
change, e.g.:
chmod: limesurvey/.npmrc: new permissions are r--rw----, not r--r-----

Trying to enforce these permissions using
$ chmod -R ugo-w limesurvey/
instead breaks the installation.

Did you mean
$ chmod -R uo-w limesurvey/
instead or are we supposed to ignore the warnings?

Steps To Reproduce

Steps to reproduce

$ chown -R myaccount:apache limesurvey/
$ chmod -R o-r-w-x limesurvey/
$ chmod -R -w limesurvey/

Expected result

No output.

Actual result

Output consists of 20638 warnings (for 20638 individual filesystem
objects) of the
chmod: limesurvey/.npmrc: new permissions are r--rw----, not r--r-----
kind.

TagsNo tags attached.
Bug heat4
Complete LimeSurvey version number (& build)7.0.5 (260623)
I will donate to the project if issue is resolvedNo
BrowserFirefox 140.11.0esr (64-Bit)
Database type & versionmariadb-server, Debian package version 1:11.8.6-0+deb13u1
Server OS (if known)Debian 13 (Trixie)
Webserver software & version (if known)apache2, Debian package version 2.4.68-1~deb13u1
PHP VersionDebian package version 8.4.23-1~deb13u1
Git branch / Pull Request URLN/A

Users monitoring this issue

There are no users monitoring this issue.

Activities

tibor.pacalat

tibor.pacalat

2026-07-23 15:53

administrator   ~85257

@DenisChenu can you take a look into this?

DenisChenu

DenisChenu

2026-07-23 17:12

developer   ~85262

There is no way to set global instructions for ALL situation.

It's a server admin role here.
Some server need chmod -R 777, other need chmod -R 700 only ...
I use ACL on 2 of my linux server.

chown -R myaccount:apache limesurvey/ : it can be www-data , for me it's limesurvey:limesurvey

Maybe just
Could you perhaps just outline the main principles?

All directories should be read-only except for:
application/config, which must be writable at the time of installation; it can then be set to read-only
tmp/, which should be read/write for the web server user
upload/, which should be read/write for the web server user

etc...

DenisChenu

DenisChenu

2026-07-23 17:15

developer   ~85263

https://www.limesurvey.org/manual/index.php?title=Installation_security_hints&diff=381694&oldid=172297

I remove sample

tibor.pacalat

tibor.pacalat

2026-07-24 09:51

administrator   ~85270

Thanks Denis!

Issue History

Date Modified Username Field Change
2026-07-22 10:32 calvario New Issue
2026-07-22 10:56 calvario Reporter calvario => WLB
2026-07-22 10:56 calvario View Status private => public
2026-07-22 10:56 calvario Bug heat 6 => 0
2026-07-23 15:53 tibor.pacalat Assigned To => DenisChenu
2026-07-23 15:53 tibor.pacalat Status new => assigned
2026-07-23 15:53 tibor.pacalat Note Added: 85257
2026-07-23 15:53 tibor.pacalat Bug heat 0 => 2
2026-07-23 17:12 DenisChenu Note Added: 85262
2026-07-23 17:12 DenisChenu Bug heat 2 => 4
2026-07-23 17:15 DenisChenu Assigned To DenisChenu => tibor.pacalat
2026-07-23 17:15 DenisChenu Status assigned => ready for testing
2026-07-23 17:15 DenisChenu Note Added: 85263
2026-07-24 09:51 tibor.pacalat Note Added: 85270
2026-07-29 17:45 tibor.pacalat Status ready for testing => closed
2026-07-29 17:45 tibor.pacalat Resolution open => won't fix