6 ms·
There's nothing inherently wrong with PHP security. You can write crap and insecure applications in any language.
by sandis 13y ago
There's nothing inherently wrong with PHP security. You can write crap and insecure applications in any language.
- mverwijs 13y agoYes, however, chmodding folders to 777 and placing sqlite databases in unprotected folders accessable for the entire interwebs does tend to give me little hope that these guys can actually produce secure PHP code. sadly, as the software is pretty awesome featurewise.
- claar 13y agoThere's never an excuse for chmod'ing something 777. That's just being too lazy to figure out the proper permissions.
- riquito 13y agoIf the parent's folder limit access to a certain user or group there aren't security problems and may be exactly what you need. for example, if you work with other people and you have a command to generate thumbnails from the shell, you may have a layout like this one chmod user group path 2770 www-data devs /srv/www 2777 foo devs /srv/www/site/thumbnails/ /srv/www/site/thumbnails may be accessed only by people in the 'devs' or 'www-data' group ('foo' can read it only if he's in the group 'devs'). The obvious alternative would be to set that directory as owned by 'www-data', but you need root access to do that (unless you put everybody in group 'www-data', but then everyone can access every site). This way every user in the group 'devs' can make directories usable by both his teammates and the webserver, without having root power or being in group www-data. Have more than one team? Use different groups for each team.
- drdaeman 13y ago0777 (or more like 02777) is a perfectly valid permission for world-writeable directories. Except that the case "anyone may do anything here, this is a free and unrestricted file sharing area" is quite rare. And almost certainly not for anything under /var/www served by httpd with PHP support.
- akbar501 13y ago> There's never an excuse for chmod'ing something 777 Agreed. Biblical implications aside, chmod 666 and chmod 777 are rarely a good idea. (http://www.gotothings.com/linux/permissions-with-the-chmod-command.htm http://www.gotothings.com/linux/permissions-with-the-chmod-c...)
- jiggy2011 13y agoThe installation doesn't tell you to do that.
- Timmmmbob 13y agoThat's not true. There are many thinks inherently wrong with PHP security. And while you can write crap and insecure applications in any language, PHP actively encourages it.
- w-ll 13y ago> PHP actively encourages it. How so?
- st3fan 13y agoBrowse through the OwnCloud release notes. Almost every version has fixes for XSS and remote code execution. Fixes are great but the developers seem to be making the same mistakes over and over again. It is just too easy to do that in PHP.
- sandis 13y agoXSS has nothing to do with PHP at all.