On Wed, Feb 4, 2009 at 5:23 PM, Chris Johnson <span dir="ltr"><<a href="mailto:cxjohnson@gmail.com">cxjohnson@gmail.com</a>></span> wrote:<br><div class="gmail_quote"><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
>From a security point of view, any time the web server process has<br>
write access to any directory or file, it makes me nervous. For this<br>
SQLite scheme to work, obviously the web server process will have to<br>
be able to create and update the file in which the SQLite database<br>
resides. This seems like it provides another possible vector for<br>
exploits. Tell me how we will protect against such attacks.</blockquote><div><br>That's an excellent point. It has been chx' concern from the beginning.<br><br>If you read <a href="http://drupal.org/node/367660">http://drupal.org/node/367660</a>, you will see that a whitelist of paths retrieved from the registry has been made just for that.<br>
</div></div><br>Damien Tournoud<br>