• Registered: 2011-02-18
  • Posts: 13

Topic: Paperclip create images with the wrong access rights

On my production server (ubuntu, passenger, capistrano), i can add images using paperclip (stored in public), and i can delete them, however when accessing those images with a browser i have a forbidden error.

The user running the ruby process is admin, if i create a file in the public folder logged as admin the access rights are : -rw-r--r--

The folders and images created with paperclip use those rights : drwxr-x---

All of them belong to admin admin

How can i set my rails/apache/paperclip/imagemagick to have the copied files readable by public web browsers ? I'd like to do it the "clean way"

Last edited by Sylario (2011-06-30 09:25:32)

  • Registered: 2011-02-18
  • Posts: 13

Re: Paperclip create images with the wrong access rights

Ok, i looked a little bit more in details, the problem is not on the files it is with the folders access rights. It gives access to the owner and the group, but not to others :

drwxr-x---

Is it paperclip creating folders with the wrong rights, or are the rights corret and apache or passenger configured differently to allow the use of folder?

  • Registered: 2009-07-31
  • Posts: 253

Re: Paperclip create images with the wrong access rights

Note that passenger runs the app in the name of the user who owns the config/environment.rb file.  See: http://www.modrails.com/documentation/U … _switching  (Took me quite some time to figure out...  I've got a capistrano recipe to make sure it's owned by www-data:web on deploy.)

I believe that files are created in the name of the user running the app that creates them; try changing the owner of config/environment.rb to www-data (or whoever normally accesses files on the server) and try again.

  • Registered: 2011-02-18
  • Posts: 13

Re: Paperclip create images with the wrong access rights

If i do a chown to www-data it fails because after that the chmod done by capistrano (BTW i do not found that command in my local/deploy.rb) is impossible as the user using capistrano cannot change files he does not own.

Do you use www-data user in the "set :user" of Capistrano?

  • Registered: 2009-07-31
  • Posts: 253

Re: Paperclip create images with the wrong access rights

This is the relevant section of my deploy.rb:

namespace :deploy do
  task :start do ; end
  task :stop do ; end
  task :restart, :roles => :app, :except => { :no_release => true } do
    run "#{try_sudo} touch #{File.join(current_path,'tmp','restart.txt')}"
  end

  desc "Change the user in whose name the application (Phusion process) will be run"
  # this is determined by the owner of environment.rb... (see: http://www.modrails.com/documentation/Users%20guide%20Apache.html#user_switching)
  task :change_phusion_user do
    run "#{try_sudo} chown www-data:web #{current_release}/config/environment.rb"
    restart
  end

end

after 'deploy:update_code', 'deploy:change_phusion_user'

notice the try_sudo stuff

  • Registered: 2011-02-18
  • Posts: 13

Re: Paperclip create images with the wrong access rights

Environnement is owned by www-data but paperclip still create the folders as admin admin.

How can i know who is running my apps? ps aux|grep httpd return nothing and grep apache returns a bunch of apache 2 process all owned by www-data.

  • Registered: 2009-07-31
  • Posts: 253

Re: Paperclip create images with the wrong access rights

For me the easiest way is to restart the app after re-chown-ing config/environment.rb.  There must be better ways...

I've got no clue at this point, let me get back later.  May somebody else knows off the top of her head.

  • Registered: 2011-02-18
  • Posts: 13

Re: Paperclip create images with the wrong access rights

Ok, i learned a lot about capistrano, but my problem come from here :

https://github.com/thoughtbot/paperclip/issues/214

Thanks Boomerang, learned a lot anyway.

  • Registered: 2011-02-18
  • Posts: 13

Re: Paperclip create images with the wrong access rights

The new gem is now availlable with the correction, but it still create rwxr-x--- folders. I am lost where can i search to resolve this problem?