PunBB Forums - pun_repository security

Re: pun_repository security

2009-06-25T12:35:12Z

When we developed pun_repository we faced an issue. If a user has only FTP access he can't delete an extension directory created via pun_repository. We decided to set permissions to 0777 to avoid this issue.

Re: pun_repository security

2009-06-25T11:53:06Z

Parpalak wrote:

The permissions for the "cache" directory should be 0777 too. This directory contains executable PHP code. So pun_repository isn't less secure than the whole forum.

Those directories only need to be writable for the httpd user, not everyone.

Re: pun_repository security

2009-06-25T11:23:27Z

The permissions for the "cache" directory should be 0777 too. This directory contains executable PHP code. So pun_repository isn't less secure than the whole forum.

Re: pun_repository security

2009-06-14T06:57:09Z

yeah, we should manualy chmod from cpanel,,, , ,maybe it should automatic chmod after instalation of extension,,,

pun_repository security

2009-06-13T20:16:17Z

In my opinion the phrase...

NOTE! Web server's system user will be set as an owner of the files and directories created while extension downloading and installation. Access mode for directories created will be set to 0777.

...isn't secure enough. It would be better idea to set it to 0755 (system user can do read,write,execute and all others just read and execute)

The reason why I'm asking this, is because i'm getting attacked by outside world repeatedly and my outdated pun_pm got hijacked by somebody and that made me to worry about others: the reason was the nasty chmod 777.