[drupal-support] Multi-site's gaping security hole

[Steve Dondley]

On a multi-site set up, it's a trivial matter for someone to create a
node with some PHP code that takes a peak at another site's
settings.php file.  Example:

<?php

$file = file ( 'sites/example.com/settings.php' );

foreach ($file as $key => $line) {
 print $line;
 print "<br />";
}

?>

What's the best practice for eliminating this problem?


--
Dondley Communications
http://www.dondleycommunications.com

Communicate or Die: American Labor Unions and the Internet
http://www.communicateordie.com