Re: [cobalt-users] Major security issue - PHP

[flash22@xxxxxxx]

On Thu, 3 May 2001, Simon Pierce wrote:

> Hi,
> 
> > It should not be able to have write access to site2 files (or
> > delete them). It may read and execute them though. Do ls -l
> > /home/sites/site2/web and see for yourself:
> 
> Okay, I did this:
> 
> ls -l /home/sites/site2/web/index.shtml
> 
> and it came back with this:
> 
> -rw-rw-r--   1 admin    site2        
6117 Mar 28 16:08 /home/sites/site2/web/index.shtml
> 
> But yes, it just allowed site3 to make changes to site2 with no
 error messages, permissions problems or 
requests for passwords right from their PHP script.

If you don't have site-adm for both sites, then by default they both have
'admin' as site owner, so they also are both owned by the same user, so
of course, they are writable by each others scripts ;)

gsh