summaryrefslogtreecommitdiffstats
path: root/docs/xml
diff options
context:
space:
mode:
authorbbaetz%student.usyd.edu.au <>2002-05-07 18:09:42 +0200
committerbbaetz%student.usyd.edu.au <>2002-05-07 18:09:42 +0200
commit04fd648fa95c624466fd1ba626fa4ef02c089a72 (patch)
treeb167c58d2a492f829cb4e6b672474c6f578c6d14 /docs/xml
parent8efe68824c3006c806ca4e31060e70b10286473b (diff)
downloadbugzilla-04fd648fa95c624466fd1ba626fa4ef02c089a72.tar.gz
bugzilla-04fd648fa95c624466fd1ba626fa4ef02c089a72.tar.xz
Bug 140355 - warn the user about not using a webserver group
r=gerv, justdave
Diffstat (limited to 'docs/xml')
-rw-r--r--docs/xml/administration.xml13
1 files changed, 13 insertions, 0 deletions
diff --git a/docs/xml/administration.xml b/docs/xml/administration.xml
index 63a761095..8794a0e2c 100644
--- a/docs/xml/administration.xml
+++ b/docs/xml/administration.xml
@@ -1366,6 +1366,19 @@ Group3, since he isn't in Group4.
(e.g.: <ulink url="http://bugzilla.mozilla.org/localconfig"> http://bugzilla.mozilla.org/localconfig</ulink>). If you can read the contents of this file, your web server has not secured your bugzilla directory properly and you must fix this problem before deploying Bugzilla. If, however, it gives you a "Forbidden" error, then it probably respects the .htaccess conventions and you are good to go.
</para>
</note>
+ <para>
+ When you run checksetup.pl, the script will attempt to modify various
+ permissions on files which Bugzilla uses. If you do not have a
+ webservergroup set in the localconfig file, then Bugzilla will have to
+ make certain files world readable and/or writable. <emphasis>THIS IS
+ INSECURE!</emphasis>. This means that anyone who can get access to
+ your system can do whatever they want to your Bugzilla installation.
+ <note>
+ This also means that if your webserver runs all cgi scripts as the
+ same user/group, anyone on the system who can run cgi scripts will
+ be able to take control of your Bugzilla installation.
+ </note>
+ </para>
<para>
On Apache, you can use .htaccess files to protect access
to these directories, as outlined in <ulink url="http://bugzilla.mozilla.org/show_bug.cgi?id=57161">Bug 57161</ulink> for the localconfig file, and <ulink url="http://bugzilla.mozilla.org/show_bug.cgi?id=65572"> Bug 65572</ulink> for adequate protection in your data/ and shadow/ directories.