Gossamer Forum
Home : Products : Gossamer Mail : Discussion :

ExecCGI Permissions 2.X

Quote Reply
ExecCGI Permissions 2.X
I'm just fine tuning the ExecCGI permissions for gmail 2.X and would like some feedback on the best way to do it. Should I just leave the whole gmail dir executable? Should the data directory be executable if users can use uploads and potentially upload a cgi script etc? Is there any risk with it? Any comments or help appreciated.

Regan.
Quote Reply
Re: ExecCGI Permissions 2.X In reply to
Hi,

Ideally the data directory should not be web accessible. If you don't have any choice and you can use .htaccess files I would add a .htaccess file inside the data directory with:

Order Allow,Deny
Deny From All

in it and that will make it so that the server won't fetch anything in that directory. You should do the same thing for batch if possible.

Cheers,

Alex

--
Gossamer Threads Inc.
Quote Reply
Re: ExecCGI Permissions 2.X In reply to
Thanks for that!

Regan.