RE: [cms-users] Overwrite protection + some suggestions

[Alexandre G. <gr...@so...>]

Hi,

I'm not sure how the API will work yet. Should we work on a temporary
release with the submitted patches or get our heads down to the API-ready
release ?

> I am attaching an edited crm.cgi (3 miniscule changes) that will
> disallow upload, generates an error message if a file already exists,
> and log any attempt to jump to disallowed path.

The jump to disallowed path log entry is very interesting. As for the
disallowed upload if a file already exists, this is a must for the current
0.02 release.

> I think there should also be a configurable way to limit the hosts that
> the script can can validly be run from (limit referers).

That could  be easily done with a simple text file that contains the allowed
hosts or disallowed hosts. The check could be done at every execution of the
script.

> Would be nice if the crm generated admin files were kept out of the main
> folder (maybe simply created in a separate, parallel, tree structure -
> this could be done easily using a configurable path variable prefix in
> the crm.cgi?

By admin files, do you mean the logfile ?

Alexandre Gravel
Infivia Solutions
gr...@in...
http://www.infivia.com