4 ms·

I agree. Why not run the webapp as the user account the code belongs to. With virtualenv and pip, normal users can install modules into their own site-package

I agree. Why not run the webapp as the user account the code belongs to. With virtualenv and pip, normal users can install modules into their own site-package in their home folder, and any runserver started as them will only have permission to access anything they have access to. The only thing that is possible to exploit is what they've allowed in their code, but that's pretty much the same issue you have with php.

LeafStorm 15y ago
Because (a) mod_wsgi is nowhere near as easy to sandbox as PHP (again, php.ini settings), (b) configuring proper production servers to run as specific users is a pain, and (c) this is a university where people have access to sensitive student information and research data in the AFS system. How bad do you think it would be if a random student could exploit their professor's site and change their exam grade?