我应该为IIS7上的Wordpress 3.9.1安装设置哪些文件夹权限？

Question

When you install WordPress (3.9.1 currently) manually through the zip file over at wordpress.org, you're given a folder structure, I've outlined it below but I've only gone two folders deep to illustrate my question.

In IIS7, the default user is IUSR

What I'd like to know is, what permissions should I give this file structure so that logged in users can upload files, update plugins as well as the core (with new releases) via the WordPress administration area... without opening up hack holes.

Is it safe to allow IUSR these permissions on the entire structure? (X, not checked on, O, checked on)

• [X] Full Control
• [O] Modify
• [O] Read & Execute
• [O] List Folder Contents
• [O] Read
• [O] Write
• [X] Special Permissions

I'm afraid that if I open up this gate, that it'll allow hackers to exploit my server's file system within this website, potentially opening up more dangerous possibilities. I've read into their suggesstions over at http://codex.wordpress.org/Changing_File_Permissions but this document outlines Linux settings, not IIS. I can't seem to find one for IIS.

/* Begin File Structure

/wordpress/
    /wp-admin/
        /css/
        /images/
        /includes/
        /js/
        /maint/
        /network/
        /user/

    /wp-content/
        /plugins/
        /themes/

    /wp-includes/
        /Certificates/
        /css/
        /fonts/
        /ID3/
        /images/
        /js/
        /pomo/
        /SimplePie/
        /Text/
        /theme-compat/
*/

Looking at this file structure, it seems that in order to allow people who are logged into the administration area of the website to upload files, update the core, add/remove plugins, I'd have to give the whole thing crazy amounts of access giving anyone the ability to upload anything if they find a loophole in WP's code.

Answer 1

This is a good resource: http://forums.iis.net/t/1178859.aspx

In summary of that post and from my previous experience on other servers:

You can use the standard permissions for IUSR.

The theme / plugins / uploads folders are what require you to have write permissions. In your example you are missing the uploads folder under wp-content. I would create it manually so you don't want to give wp-content write permissions.

The additonal resouces from the post: http://www.iis.net/learn/get-started/planning-for-security/understanding-built-in-user-and-group-accounts-in-iis

http://www.iis.net/learn/get-started/planning-for-security/secure-content-in-iis-through-file-system-acls

http://weblogs.asp.net/owscott/securing-iis-thwarting-the-hacker-week-23