Give the web server appropriate ownership/permissions for the required directories without making the entire OJS installation world-writable.