Quote:
Even though the files are owned by joe_bloggs, when Apache runs webmail.cgi, it executes as nobody. You would have to set the file permission on the def files (and others) so that nobody has access to them, correct?Yes, Links SQL files are able to be modified by "nobody" but the issue was regarding the security of the def files and so if the users home directory has the correct permissions then a user using ssh cannot gain access to read their files.
This can't be done via the web, firstly due to .htaccess on the admin panel and secondly because the defs directory contains a .htaccess file stopping GET requests.