From: Sylvain M. <sy...@me...> - 2004-12-08 17:55:12
|
>>>Sylvain MEILARD wrote: >>> >>> >>> >>>>I think i won't be easy... Apache should have reading right on backup= ed >>>>files. >>>> >>>Or something in the web interface needs elevated privileges, like a >>>setuid program that is limited to only extracting the directory listin= g. >>> >>Yes, it could be a better solution. this program could be owned by >>root:apache, with execution right for the group, and no right for other= s. >>Apache should only use it to read directory used for backup. It would b= e very >>simple and fast to write it in C. If you lack time, i'm ready to do it.= It >>would simply consist in using opendir(), readdir(), stat() ? and closed= ir(). >>[...] >> >> > You'll have to dig into the source code to see where to hook in the > setuid program. I'm not very familiar with the web interface portion. I will have a look at it today, and i'll tell you tomorrow regards, sylvain |