IIS, PHP, OpenSource CMS and rabbits

Personally I consider hosting open-source projects on Windows Server a sacrilege, a stupidity and a moral defect. But sometimes there is a project where the main site of the client is written in .NET and next to it lies a small blog on WordPress or another CMS.

So all of this is served by the set Win2008+PHP+ASP.NET+MSSQL+MySql+IIS7.

Today I hit the following problem:
I go to the WordPress admin, create a new post, add a media file to it, pick the image size Full and.. The image is not shown. The scaled down images work, but the full one does not. Going to the direct link to the image gives a 500 error.

It turns out that when we upload a file through a php form, it (the file) first goes to the C:\Windows\Temp folder (that is the default value of php.upload_tmp_dir). Then from that directory the uploaded file goes to the right place (something like /wp-content/uploads/2014/2). And the file inherits the permissions of the C:\Windows\Temp folder. The scaled down variants of the image are created already in the final folder, they are shown without errors because the IIS user (AppPool user) has all the permissions on them.

To fix this misunderstanding you need to give the IIS user the modify permission (even read is enough) on the C:\Windows\Temp folder.

First you need to look at who the ApplicationPool of the site runs as:
Start IIS Manager -> Application Pools. Right click on the pool you need and pick Advanced Settings from the menu that drops out:

In the Process Model section look at Identity.

If the pool runs as ApplicationPoolIdentity - you have to give the permissions to the IIS_IUSRS group or the IIS_IUSR user on the C:\Windows\Temp folder.

If it says NetworkService there - then give the permissions to the NetworkService group.

After these changes all the newly uploaded files will work correctly.

For the files that are already uploaded you have to set the permissions by hand. You can just re-apply the access permissions on the parent directory. All the subdirectories and files will inherit the permissions from the parent.

ps: I did not think I would end up with an IIS category 🙁