I think what we have here is one of those famous "failure to communicate" problems. It happens sometimes despite everyone's best efforts. So I'll give it one more try.
I do understand that setting 777/666 permissions on all of Zenphoto's zp-core folders and files is NOT RECOMMENDED by you, or by me, or by anyone else with any intelligence. That is certainly NOT what I am wanting or trying to do, but that's what is happening during Zenphoto's set-up process, unlike any other web application set-up process I've ever used.
The central point I was making is that SUexec doesn't want that either and, in fact, will not allow it. Not only does SUexec NOT "force" Zenphoto to set such ridiculous permissions, it actually halts the entire process immediately as soon as 777/666 permission are set on those PHP folders and files. In other words, far from requiring those permissions, SUexec actually prohibits them and will not allow ANY process to continue after they are set on the PHP folders and files that are being used.
Your colleague claims that "it has nothing to do with Zenphoto" because the Zenphoto "setup script provides sane defaults" and that it "attempts to ensure that Zenphoto's files are secure." Maybe so, but the only default chmod that I can see is the following:
if (!defined('CHMOD_VALUE')) { define('CHMOD_VALUE', 0777); }
It would be difficult to get much LESS secure than that.
I want to be very clear that I think Zenphoto's PHP coding is generally superb and I like the application very much. In trying to avoid any need for any controlling intervention whatever by the user in its set-up, however, I think it may be just a little too "smart" for its own good.
In conclusion, assuming that ordinary folks on shared hosting services form any part of your target group, you're not going to be able to ignore the growing presence of SUexec amongst those services for long. My own hosts (Hostgator/The Planet) are generally regarded as NA industry leaders with excellent mod_security rules for the protection of all concerned. For your own sake (as well as for folks like me) I can only hope you'll be able find some way to accommodate the trend.
