#4518 No privilege drop when creating virtual hosts

[kurczaq]

Hi

when creating a virtual host with webmin apache module, webmin will create a root-owned directory, when the document root does not exist.

To reproduce: use unpriv webmin user and create a virtual host, result:

drwxr-sr-x+ 2 root root 4096 Dec 10 01:04 www.usertest.com/

I'm afraid this can be eventually escalated further...

[kurczaq]

to be complete:

I have the "admin" user setup in the webmin users module as:

Browse files as Unix user: vhost
Users visible in user chooser: wwwrun vhost
Groups visible in group chooser: www

I ASSUMED this will effectively limit the user admin permissions in webmin! However is not the case for creating virtual hosts - does mkdir as root!

[Jamie Cameron]

Thanks for pointing this out - this will be fixed in the next Webmin release.