[Savannah-dev] Security Notice

[Mathieu Roy]

Hi,

Just a little message to inform that you should never run Savannah
(and most of PHP softwares) on a computer where you allow non-trusted
users to run perl of php scripts via apache.

As a matter of fact, these users would be capable to read your
configuration files easily.

The solution is to use PHP Safe Mode (ini configuration). Or maybe it
could be possible to change the apache user depending on the url
requested, which would do the trick.

Regards,

-- 
Mathieu Roy

  +---------------------------------------------------------------------+
  | General Homepage:           http://yeupou.coleumes.org/             |
  | Computing Homepage:         http://alberich.coleumes.org/           |
  | Not a native english speaker:                                       |
  |     http://stock.coleumes.org/doc.php?i=/misc-files/flawed-english  |
  +---------------------------------------------------------------------+