Re: [drupal-support] Multi-site's gaping security hole

On Tue, 25 Oct 2005, Steve Dondley wrote:

On a multi-site set up, it's a trivial matter for someone to create a node with some PHP code that takes a peak at another site's settings.php file. Example:

<?php

$file = file ( 'sites/example.com/settings.php' );

foreach ($file as $key => $line) { print $line; print "<br />"; }

?>

What's the best practice for eliminating this problem?

What I do is to run each user's php process as fast-cgi and only link their sites subdirectory form the main installation. Cheers, Gerhard