[cobalt-users] user's access rights via PHP and telnet

[michael@xxxxxxxxxx]

Hi all,

I'm new to a RaQ3 and wonder that the default setup allows all telnet 
users to read ALL files ? at least all the files in the sites 
directories. Not only the own site! 

This problem was easy to fix: I created a user "http" and assign this to 
all site groups. Then I remove all World-Rights from the directories (# 
chmod -R o-rwx /home/sites/*).

But still, using a simple PHP skript in one of the sites (with fopen( 
"/home/sites/a-site-of-sombody-else/...", "r")) I can access and even 
write files of other sites on the same server.

Has anybody found a solution for this severe problem?

Thanks a lot
	Michael