Re: [PHPiCalendar-DEV] security suggestions for publish.php

[Jo R. <jr...@sv...>]

On Sat, Sep 16, 2006 at 07:37:30PM -0700, Wesley Miaw wrote:
> I guess this is all a result of publish.php being something that was  
> tacked on as a completely external feature. I guess if Jim thinks it  
> makes sense to merge publish.php in as a real PHP iCalendar feature  
> (giving it full-fledged status) then things like defining a log file  
> location and auth realm in the config file makes sense.
 
Exactly.

> I don't think we should necessarily specify a specific publish.php  
> log file directory with a .htaccess checked into SourceForge. We  
> could default to /var/log/ and leave any sort of access controls or  
> different destination directories up to the installer.
 
I would make a variable near the top.  But if we defined a "safe space"
that was protected I would default it to that place.

> I am wondering if the logmsg() function should be changed to not open/ 
> close the file every single time.
 
Yes that can absolutely be done.

-- 
Jo Rhett
senior geek
SVcolo : Silicon Valley Colocation