Re: SF.net SVN: squirrelmail:[13777] branches/SM-1_4-STABLE/squirrelmail

On Tue, 02 Jun 2009 02:04:46 +0000,
jangliss@... wrote:

Somebody had posted a bug about this minor error in that the 192 block
isn't entirely a private network.  RFC1918 defines 3 blocks, which can
now be seen in this file.  The bug report
(http://www.squirrelmail.org/bugs/2798839) question the reasoning for
granting access to the private block.  Along with that comment,
somebody jumped on IRC today to comment on the way the code is laid
out, and it has been mentioned before.  

Currently we point the web root to the base of the SquirrelMail
directory, instead of the src/ directory.  Currently that's because
plugins reside in the plugins/ folder, and may require some output.
The user that jumped on IRC questioned why so many PHP scripts can be
executed without a need to.  Whilst I generally agree that the idea is
that you should be able to just drop and run SquirrelMail without
having to tinker with any paths, I sometimes wonder how difficult it'd
be making all the subdirectories outside the web root.  I also
question whether this is one of those cases of "security by
obscurity", but it does lead to improve security in that some scripts
that don't need to be executed by the user, should not be executable.
The example provided by the user on IRC was the themes folder.  Whilst
they're harmless, they can be executed as a script, and it only takes
small typos to introduce bugs.

We only provide a limited number .htaccess files in the directories,
should we consider expanding it, as well as increasing the options
included (no listings and such)?  Do we want to consider the idea of
bumping stuff outside the web root?

--
Jonathan Angliss
<jon@...>


------------------------------------------------------------------------------
OpenSolaris 2009.06 is a cutting edge operating system for enterprises
looking to deploy the next generation of Solaris that includes the latest
innovations from Sun and the OpenSource community. Download a copy and
enjoy capabilities such as Networking, Storage and Virtualization.
Go to: http://p.sf.net/sfu/opensolaris-get
-----
squirrelmail-devel mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-devel@...
List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel