I'm currently making my first experiences with a CMS called "DokuWiki" (Link). This CMS needs only PHP and writes the information to files (seems to be /dokuwiki/data/pages).
At the moment I gave the whole dokuwiki-folder + subfolders and files the rights 777. I am the owner of the files / folders.
Which access rights should be given to the folder? Should I change the owner (e.g. to www-data)?
Do you know any attack based on to many rights for folders/files? I could only imagine an attack which uses a PHP vulnerability to get access to the filesystem and then uses the rights to do harm.
edit: I've just found install:permissions. Is my assumption right, that the following set of permissions is the minimum needed by DokuWiki to run?
$ sudo chown www-data -R /var/www/wiki $ sudo chmod 400 /var/www/wiki -R $ sudo chmod 600 /var/www/wiki/data -R $ sudo chmod 600 /var/www/lib -R $ sudo chmod 600 /var/www/conf -R $ sudo chmod 700 /var/www/wiki/data /var/www/wiki/data/tmp /var/www/wiki/lib var/www/wiki/lib/plugins /var/www/wiki/conf