Hi @dung,
Just to add to what @ctgraham said, you can control how OJS sets the permissions on files it creates by working with the umask setting in config.inc.php. But I’m not sure removing the x bit will have the effect you’re looking for; for example, .php scripts still get executed through the web server regardless of their executable bit state. (That’s part of why it’s important to keep the files directory outside of the web root.)
Regards,
Alec Smecher
Public Knowledge Project Team