- install drupal modules/themes as root:daemon rather than www:www
(only the files/ directory needs to be writeable by 'www').
- don't install 'settings.php' world-readable since it contains the
DB password. Use 640, owner 'www' instead.
- bump all modules.
tested in production, including upgrade szenarios.
ok sthen@ and landry@, maintainer timeout.
the Drupal core "Upload" module including:
* Per-field upload control (file extensions, file size).
* Per-node upload size limits.
* Multiple fields per content type.
* Customizable paths for saving uploads (plus token support for dynamic paths).
* Icons for uploaded file types.
Most importanttly, it's a prerequesite for imagefield.
