Re: re[4]: [Phpwebsite-developers] Security

[Matthew M. <ma...@tu...>]

> Again, if the plan is for shell access to be a requirement, I need to
> know it now before I spend my money developing modules for phpWebSite.
>
> I'll be disappointed. But, I'll find another CMS I can live with.

Geoff,

Don't go :) Let's try to settle this.

I am not the Unix guru on the team (Jeremy is) but I hope this should
answer your questions.

The shell script (written by Jeremy BTW) was meant to make life easier.
Instead of telling people to make certain directories writable, we thought
it would be easier to just include a script to assist them. You don't HAVE
to use either script.

If you want set_config.php to create your config.php file for you, your
conf/ directory must be writable. If it is not, there is an option to save
the file and then you can upload it yourself. In any case, once you save
your config.php file, you can make the directory root writable only.

The other directory you can make writable is images. If you do not, the
modules will not be able to make their image directories during
installation. Again, this is not a big problem as you can just create them
yourself afterwards. The module image directories do need to be writable
to save images however.

Finally, if you want to use textpad to alter docs, you would need to make
the docs/ directory writable as well.

0.8.3 had the config file already supplied. Therefore you didn't need to
touch the permissions of the directory was in. However, 0.8.3 did have an
image directory and it had to be writable.

So I guess shell access would make your life easier. However, if you did
not have shell access, you would need to specify what directories you need
to be writable to your sysadmin.

Let me know if that helps.

Best Regards,

Matthew McNaney
Internet Systems Architect
Electronic Student Services
Appalachian State University
Phone: 828-262-6493
phpwebsite.appstate.edu
ess.appstate.edu