Hey, ok I configured a new virtual host with the web server and made a copy of the current cbox folders there, so that the permissions would be be equal.
The vhost config:
<VirtualHost *:80>
DocumentRoot /home/cbox/demo
ServerName demo.commonsinabox.org
CustomLog logs/demo_log combined
ErrorLog logs/demo_error
SecRuleRemoveById 970901
</VirtualHost>
The folder:
[root@commons ~]# ll /home/cbox/demo/
total 176
-rw-rw-r--. 1 cbox cbox 1766 Oct 3 14:28 env.php
-rw-rw-r--. 1 cbox cbox 600 Oct 3 14:25 env-sample.php
-rwxr-xr-x. 1 cbox apache 395 Oct 2 13:34 index.php
-rwxr-xr-x. 1 cbox apache 19929 Oct 2 13:34 license.txt
-rwxr-xr-x. 1 cbox apache 9177 Oct 2 13:34 readme.html
-rwxr-xr-x. 1 cbox apache 4264 Oct 2 13:34 wp-activate.php
drwxr-xr-x. 10 cbox apache 4096 Oct 2 13:34 wp-admin
-rwxr-xr-x. 1 cbox apache 1354 Oct 2 13:34 wp-app.php
-rwxr-xr-x. 1 cbox apache 271 Oct 2 13:34 wp-blog-header.php
-rwxr-xr-x. 1 cbox apache 3522 Oct 2 13:34 wp-comments-post.php
-rw-rw-r--. 1 cbox cbox 1332 Oct 3 14:27 wp-config.php
-rwxr-xr-x. 1 cbox apache 3177 Oct 2 13:34 wp-config-sample.php
drwxr-xr-x. 7 cbox apache 4096 Oct 3 14:33 wp-content
-rwxr-xr-x. 1 cbox apache 2726 Oct 2 13:34 wp-cron.php
drwxr-xr-x. 9 cbox apache 4096 Oct 2 13:34 wp-includes
-rwxr-xr-x. 1 cbox apache 1997 Oct 2 13:34 wp-links-opml.php
-rwxr-xr-x. 1 cbox apache 2395 Oct 2 13:34 wp-load.php
-rwxr-xr-x. 1 cbox apache 29084 Oct 2 13:34 wp-login.php
-rwxr-xr-x. 1 cbox apache 7712 Oct 2 13:34 wp-mail.php
-rwxr-xr-x. 1 cbox apache 9916 Oct 2 13:34 wp-settings.php
-rwxr-xr-x. 1 cbox apache 18299 Oct 2 13:34 wp-signup.php
-rwxr-xr-x. 1 cbox apache 3700 Oct 2 13:34 wp-trackback.php
-rwxr-xr-x. 1 cbox apache 2788 Oct 2 13:34 xmlrpc.php
Then I reloaded the web service:
[root@commons ~]# service httpd configtest
Syntax OK
[root@commons ~]# service httpd reload
Reloading httpd:
[root@commons ~]#
Hope everything works. Just let me know.
I'll keep an eye on the traffic/load of the demo site, if it gets out of control it may be advisable to move it to the dev server though. I'm assuming that the code that goes into the demo site is pretty well vetted, right?