PHP Security Issue & Digishop 4.0

matthewod

Hi,

I have a client that wants to install http://digishop.sumeffect.com/ as a shopping cart. In their instuctions and from their tech support they say to set all files and folders to chmod -R 777 for secure and non-secure permissions. In my limited opinion I don't think this is a good thing. It sounds like other users can read, write and execute each file and folder. This sounds like a major security issue to me. Any other thoughts?

Thanks
MD
:xbones: demon clause is dead, Jesus is alive! 🙂

MarkR

Well, making everything world-writable doesn't sound ideal, but I suppose if you're on a dedicated server it's not too bad.

Remember that "everyone" only includes people physically able to access the machine via shell or run programs, which hopefully only includes trusted people in the first place.

In general I keep some data directories and such like world-writable, but only give group-write permission to everything else.

Mark