{"record":{"id":"65ab7fb168914cec","repo":"phpmyadmin/phpmyadmin","slug":"wrong-permissions-on-configuration-file-should-not-be-world","errorCode":null,"errorMessage":"Wrong permissions on configuration file, should not be world writable!","messagePattern":"Wrong permissions on configuration file, should not be world writable!","errorType":"exception","errorClass":"ConfigException","httpStatus":null,"severity":"critical","filePath":"src/Config.php","lineNumber":279,"sourceCode":"     */\n    public function checkPermissions(): void\n    {\n        // Check for permissions (on platforms that support it):\n        if (! $this->config->CheckConfigurationPermissions || ! @file_exists($this->source)) {\n            return;\n        }\n\n        $perms = @fileperms($this->source);\n        if ($perms === false || ! ($perms & 2)) {\n            return;\n        }\n\n        // This check is normally done after loading configuration\n        if ($this->isWindows()) {\n            return;\n        }\n\n        throw new ConfigException(__('Wrong permissions on configuration file, should not be world writable!'));\n    }\n\n    /**\n     * sets configuration variable\n     *\n     * @param string $setting configuration option\n     * @param mixed  $value   new value for configuration option\n     *\n     * @throws ConfigException\n     */\n    public function set(string $setting, mixed $value): void\n    {\n        $parts = explode('/', $setting);\n        if (! $this->setValueRecursive($this->settings, $parts, $value)) {\n            return;\n        }\n\n        $this->config = new Settings($this->settings);","sourceCodeStart":261,"sourceCodeEnd":297,"githubUrl":"https://github.com/phpmyadmin/phpmyadmin/blob/70d713dc39f5f7e0683c0ee38ab816b7e72b6a49/src/Config.php#L261-L297","documentation":"As a security hardening measure, Config::checkPermissions rejects a configuration file whose permissions are world-writable (world-write permission bits set), because anyone on the host could modify config.inc.php and thus compromise phpMyAdmin. On Windows the check is skipped. The message tells the operator to tighten the file mode.","triggerScenarios":"Calling checkPermissions() (part of the load flow on non-Windows systems) when stat(config.inc.php) shows the world-writable bit set, e.g. file mode 0777 or 0666.","commonSituations":"Running `chmod 777` to 'fix' a permissions problem, copying config.inc.php from a FAT/USB filesystem or extraction tool that set 0777, or provisioning scripts with umask 000.","solutions":["chmod 640 (or 644) config.inc.php to remove world-write, owned by the PHP user","Fix the provisioning/copy step that applied world-writable permissions","Check the containing directory permissions too and remove group/world write there","Re-run the phpMyAdmin setup or page load to confirm the check passes"],"exampleFix":"// before\n-rwxrwxrwx config.inc.php\n// after\nchmod 640 config.inc.php","handlingStrategy":"validation","validationCode":"$perms = fileperms('config.inc.php'); if ($perms & 0x0002) { chmod('config.inc.php', 0640); }","typeGuard":null,"tryCatchPattern":"try { $config->loadFromFile($path); } catch (ConfigException $e) { if (str_contains($e->getMessage(), 'world writable')) { chmod($path, 0640); $config->loadFromFile($path); } }","preventionTips":["Never chmod 777 config files; use chown/chgrp to grant access instead","Set umask 022 in deploy scripts","Include a filemode assertion in your deployment checks"],"tags":["permissions","security","config"],"backgroundTag":"permission-denied","analyzedSha":"70d713dc39f5f7e0683c0ee38ab816b7e72b6a49","analyzedAt":"2026-09-13T19:13:03.620Z","contentChangedAt":"2026-09-13T19:13:03.620Z","schemaVersion":2},"datasetVersion":"2026-09-20T23:17:15.980Z"}