#36 Severe security issues

[Pierre ROGE]

mods/ directory is not enough protected :

- this can allow a user to gain access to the database
using scripts enclosed in the mods, not enough
securised but supposed to be removed after the install.

- same thing with the backups : if a mod modify the
config.php, a regular user will get easely the
connection user and pass hitting the backup/config.php.txt

[Eric Faerber]

Logged In: YES
user_id=657440

This is something we were going to look into further.
Probably add .htaccess, change file permissions to only
owner readable or something like that, and probably halt
processing of MODs that edit config.php. We'll think about
it some more. Any ideas you have would be great as well.

[Pierre ROGE]

Logged In: YES
user_id=902793

Maybe plan also the ability to download saves, and to drop
all from the remote server.

[David Smith]

Logged In: YES
user_id=420754

How about the ability to specify a path that is outside
public_html, I believe gallery allows you to do the same
thing with photos that shouldn't be publically viewable?