On Sep 13, 2007, at 5:34 PM, Earnie Boyd wrote:
How can this become an issue if only administrators have the privilege?
Various other people in this thread were proposing that the site could automatically download and install/activate jQuery plugins (either new plugins, or new releases of existing plugins). This would require the website having write access to its own jquery plugin folder. This is the giant security hole we've pointed out, and which you seem to understand. The confusion is between people who sanely understand that the only safe solution to this problem is for the human admin to manually upload/install new jquery plugins outside of drupal (scp, ftp, rsync, whatever -- some process with write access to the drupal sources which is *NOT* initiated via httpd and php) and the people who think that the site could somehow upgrade itself. To be extra clear, I should state: letting httpd or php write to the drupal sources *AT ALL* is a risk. Even if the only "legitimate" way that is coded into the system requires a special privilege, and access to admin/jquery/update, so long as the operating system *ever* allows httpd or php to write to those directories, there's a potential vulnerability. Any minor bug then could become a critical exploit. So, as a precaution, the operating system itself (not Drupal's code) should enforce that Drupal can never write to the files that Drupal is trying to execute (either php source or .js that's sent to the browser). That way, even when future Drupal bugs are discovered, at least the operating system can help prevent those bugs from being exploited to cause significant damage. Hope that helps clarify, -Derek (dww) p.s. If only shared hosting companies understood this. :( Sadly, most of them seem to run all of your httpd and php processes as the same user that owns all the files (presumably since that's easier and cheaper for them to manage, do accounting on, suspend your account when it uses "too many resources" etc). But, what's more profitable for the shared hosting provider is more dangerous for the customer. Ahh, the joys of capitalism.