Author: duncan Date: Sat Sep 30 09:08:06 2006 New Revision: 8279 Modified: branches/rel-1-5/freevo/src/helpers/webserver.py
Log: [ 1567943 ] Webserver: security issue, system wide root access Fix applied. Using the logic in recordserver to run as a non-root user Modified: branches/rel-1-5/freevo/src/helpers/webserver.py ============================================================================== --- branches/rel-1-5/freevo/src/helpers/webserver.py (original) +++ branches/rel-1-5/freevo/src/helpers/webserver.py Sat Sep 30 09:08:06 2006 @@ -43,9 +43,20 @@ import sys, os - import config +# change uid +if __name__ == '__main__': + try: + if hasattr(config, 'WWW_SERVER_UID'): + if config.WWW_SERVER_UID and os.getuid() == 0: + os.setgid(config.WWW_SERVER_GID) + os.setuid(config.WWW_SERVER_UID) + os.environ['USER'] = pwd.getpwuid(os.getuid())[0] + os.environ['HOME'] = pwd.getpwuid(os.getuid())[5] + except Exception, e: + print e + from twisted.internet import app from twisted.web import static, server, vhost, script from twisted.python import log ------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys -- and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV _______________________________________________ Freevo-cvslog mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/freevo-cvslog
