#242 webmin user can read every file
When a Webmin user is set up, one can choose (in the
Global ACL page) to set the "root" for folder
navigation in a folder other than /
Anyway, when the user goes to MySQL administration and
loads a file for a SQL query the navigation window
correctly sets the root folder, but if the user knows
the name of a file on the filesistem he can load it.
Since for example /etc/shadow is there in every *nix
system, it is not difficult to load and read it.
If a root folder is set, the MySQL module should also
make sure it won't load files from any location other
than a subfolder of the root folder specified in the
Global ACL page. Otherwise, it's pretty useless to
limit directory navigation when an user knows or
guesses file locations, and the parent process runs as
root so it can read really everything.
This might apply to other modules as well, but I'm
using just this one for this kind of purposes so I
can't help specifically.
Logged In: YES
user_id=129364
Yes, this is a problem in several modules - in future, I
will limit all modules to only allow read access to
directories determined by the global ACL.
Logged In: NO
is this still open?
As I looked on the date of the comment I would guess that it
is maybe already closed. But it is still marked as open.