4 ms·
That was my initial idea I proposed as a fix. However I am not really comfortable with it and came to the conclusion I don't think it's a good fix. Ultimately
by hannob 9y ago
That was my initial idea I proposed as a fix. However I am not really comfortable with it and came to the conclusion I don't think it's a good fix.
Ultimately that makes a pretty bold assumption: That if you have database credentials on a host this allows you to control other people's webapps in some situations. That's not reasonable. I could just be another customer at a webhoster and I don't think it's reasonable to assume that customers are allowed to hack each other.
I think a real additional authentication step for all installations is the right solution.
- tyingq 9y agoSure. Shared hosting usually uses remote databases, though I suppose you could install a DB locally and fire it up. That assumes you land on the same physical host as your victim, which isn't likely at all but the smallest hosts. And, shared hosting is pretty risky anyway :). But I do get your reasoning.