summaryrefslogtreecommitdiffstats
path: root/docs
diff options
context:
space:
mode:
authorbbaetz%student.usyd.edu.au <>2008-04-04 13:47:02 +0200
committerbbaetz%student.usyd.edu.au <>2008-04-04 13:47:02 +0200
commit5b38103bce29e0d777182fbc12f9e702cedc9b85 (patch)
tree710876e34faafd78873b51fe7fc47a8825812072 /docs
parentd436d903838aedd8397be32b7a58999e20b5cc84 (diff)
downloadbugzilla-5b38103bce29e0d777182fbc12f9e702cedc9b85.tar.gz
bugzilla-5b38103bce29e0d777182fbc12f9e702cedc9b85.tar.xz
Bug 140355 - warn the user about not using a webserver group
r=gerv, justdave
Diffstat (limited to 'docs')
-rw-r--r--docs/en/xml/administration.xml13
1 files changed, 13 insertions, 0 deletions
diff --git a/docs/en/xml/administration.xml b/docs/en/xml/administration.xml
index 63a761095..8794a0e2c 100644
--- a/docs/en/xml/administration.xml
+++ b/docs/en/xml/administration.xml
@@ -1366,6 +1366,19 @@ Group3, since he isn't in Group4.
(e.g.: <ulink url="http://bugzilla.mozilla.org/localconfig"> http://bugzilla.mozilla.org/localconfig</ulink>). If you can read the contents of this file, your web server has not secured your bugzilla directory properly and you must fix this problem before deploying Bugzilla. If, however, it gives you a "Forbidden" error, then it probably respects the .htaccess conventions and you are good to go.
</para>
</note>
+ <para>
+ When you run checksetup.pl, the script will attempt to modify various
+ permissions on files which Bugzilla uses. If you do not have a
+ webservergroup set in the localconfig file, then Bugzilla will have to
+ make certain files world readable and/or writable. <emphasis>THIS IS
+ INSECURE!</emphasis>. This means that anyone who can get access to
+ your system can do whatever they want to your Bugzilla installation.
+ <note>
+ This also means that if your webserver runs all cgi scripts as the
+ same user/group, anyone on the system who can run cgi scripts will
+ be able to take control of your Bugzilla installation.
+ </note>
+ </para>
<para>
On Apache, you can use .htaccess files to protect access
to these directories, as outlined in <ulink url="http://bugzilla.mozilla.org/show_bug.cgi?id=57161">Bug 57161</ulink> for the localconfig file, and <ulink url="http://bugzilla.mozilla.org/show_bug.cgi?id=65572"> Bug 65572</ulink> for adequate protection in your data/ and shadow/ directories.