[oldengine]

Just a point of observation:

I run my server in Safe Mode.

I also run my PhP scripts in the name of the user account rather than nobody. (This is done with PhpSUexec compiled into Apache.)

While running the Gallery scripts, the data directory can be chmod 755 and the photo files can be chmod 644.

It is the script that is writing the file, not the outside person doing the upload. (The script is running under the name of the server account holder.)

For security's sake, I avoid chmod 777 where ever possible. After changing the data directory (1) to chmod755, I note that a new photo uploaded still comes in at chmod 777. I would like to change that portion of the script that deals with this chmod assignment.

This may only be true of Linux in Safe Mode, so your mileage may vary.