Report, edit, etc...Posted by IsolatedPurity on 2005-07-20 at 03:02:48
QUOTE(Yoshi da Sniper @ Jul 19 2005, 12:16 PM)
FTP is a no no. It poses MANY security risks, which is why it is out of the question.
[right][snapback]265607[/snapback][/right]
[right][snapback]265607[/snapback][/right]
Care to list them?
Report, edit, etc...Posted by Yoshi da Sniper on 2005-07-20 at 09:10:14
QUOTE(isolatedpurity @ Jul 20 2005, 03:02 AM)
Care to list them?
[right][snapback]266132[/snapback][/right]
[right][snapback]266132[/snapback][/right]
If you allow users to have full access to an ftp directory - its done. PHP is far more destructive then you think. You can run shell commands and find out passwords with it.
Even when you log in as annoymous, theres always a way. You NEVER let anyone have access to ftp who shouldn't. Its far too risky.
Report, edit, etc...Posted by IsolatedPurity on 2005-07-20 at 13:30:08
I don't even know how to do that.
Besides... don't allow uploads... and allow deletes. Security risk downgraded from minimal to none.
I bet you could also configure cpanel to not allow any direct http requests to certain folders.
Besides... don't allow uploads... and allow deletes. Security risk downgraded from minimal to none.
I bet you could also configure cpanel to not allow any direct http requests to certain folders.
Report, edit, etc...Posted by Yoshi da Sniper on 2005-07-20 at 13:36:40
Don't trust it. There are ways to bring your premissions up and so on.
No, I don't know how. But its one of the key things about maintaining websites, is don't give server access where it isn't required. There are vunerabilities coming out everyday with stuff like this.
You say "no ones going to spend the countless days trying to do it", but I have a saying, "theres always a 16 year old kid in sweeden who will".
No, I don't know how. But its one of the key things about maintaining websites, is don't give server access where it isn't required. There are vunerabilities coming out everyday with stuff like this.
You say "no ones going to spend the countless days trying to do it", but I have a saying, "theres always a 16 year old kid in sweeden who will".
Report, edit, etc...Posted by Pineapple on 2005-07-20 at 15:39:21
I see your point, Yoshi. Now I see that there is a very high security risk out there with FTP access. One day there may some one coming across the site, That know's how to get higher permission in the FTP, And just delete evreything, That evreyone loved, And evreyone worked on.
Report, edit, etc...Posted by MillenniumArmy on 2005-07-21 at 02:12:20
I was just looking at the melee regular maps section and just could NOT believe what i was seeing....
Estrella.... gaia.... U-boat, Gamea Gowon... All in the REGULAR map section when other not-pro maps are in the pro section....
Many of those recently submitted maps were all pro maps. Estrella and Gaia were even used in the WCG.
Estrella.... gaia.... U-boat, Gamea Gowon... All in the REGULAR map section when other not-pro maps are in the pro section....
Many of those recently submitted maps were all pro maps. Estrella and Gaia were even used in the WCG.
Report, edit, etc...Posted by DT_Battlekruser on 2005-07-21 at 02:57:22
I don't disinguish between Regular and Pro anymore. They categories should be collapsed, I just approve melee maps for whatever category they're submitted under.
Report, edit, etc...Posted by chuiu on 2005-07-21 at 03:05:17
QUOTE(isolatedpurity @ Jul 20 2005, 12:30 PM)
I don't even know how to do that.
Besides... don't allow uploads... and allow deletes. Security risk downgraded from minimal to none.
I bet you could also configure cpanel to not allow any direct http requests to certain folders.
[right][snapback]266325[/snapback][/right]
Besides... don't allow uploads... and allow deletes. Security risk downgraded from minimal to none.
I bet you could also configure cpanel to not allow any direct http requests to certain folders.
[right][snapback]266325[/snapback][/right]
I already tried reasoning with him. I used to have FTP access to it.
Report, edit, etc...Posted by IsolatedPurity on 2005-07-21 at 10:24:13
I think we can trust the current dldb team to not post l/p to their ftp to the world.
Besides... you were thinking of letting season on the admin team to help code and I, and most likely you too, have no idea who he is
.
Besides... you were thinking of letting season on the admin team to help code and I, and most likely you too, have no idea who he is
.Report, edit, etc...Posted by DT_Battlekruser on 2005-07-21 at 18:00:50
What the? Season? Admin? lol.. Course I had barely heard of IP before he became admin and he turned out great..