Bug 140355 - warn the user about not using a webserver group

r=gerv, justdave

1 files changed, 13 insertions, 0 deletions

diff --git a/docs/xml/administration.xml b/docs/xml/administration.xml
index 63a761095..8794a0e2c 100644
--- a/docs/xml/administration.xml
+++ b/docs/xml/administration.xml
@@ -1366,6 +1366,19 @@ Group3, since he isn't in Group4.
 	      (e.g.:  <ulink url="http://bugzilla.mozilla.org/localconfig"> http://bugzilla.mozilla.org/localconfig</ulink>).  If you can read the contents of this file, your web server has not secured your bugzilla directory properly and you must fix this problem before deploying Bugzilla.  If, however, it gives you a "Forbidden" error, then it probably respects the .htaccess conventions and you are good to go.
 	    </para>
 	  </note>
+      <para>
+        When you run checksetup.pl, the script will attempt to modify various
+        permissions on files which Bugzilla uses. If you do not have a
+        webservergroup set in the localconfig file, then Bugzilla will have to
+        make certain files world readable and/or writable. <emphasis>THIS IS
+        INSECURE!</emphasis>. This means that anyone who can get access to
+        your system can do whatever they want to your Bugzilla installation.
+        <note>
+          This also means that if your webserver runs all cgi scripts as the
+          same user/group, anyone on the system who can run cgi scripts will
+          be able to take control of your Bugzilla installation.
+        </note>
+      </para>
 	  <para>
 	    On Apache, you can use .htaccess files to protect access
 	    to these directories, as outlined in <ulink url="http://bugzilla.mozilla.org/show_bug.cgi?id=57161">Bug 57161</ulink> for the localconfig file, and <ulink url="http://bugzilla.mozilla.org/show_bug.cgi?id=65572"> Bug 65572</ulink> for adequate protection in your data/ and shadow/ directories.