On 5/6/04 5:47 PM, Richard Gaskin wrote:
J. Landman Gay wrote:
I understand your concerns, and they are entirely valid. The difference is that the Rev engine is internally secure and won't allow much abuse. I am having trouble thinking of a way that anyone could remotely hack into it (though I'd very much like to know if anyone does find one.)
One could do dumb things like put in a "do" statement that executes incomming CGI params. But that would be dumb.
Moreover, if the Linux admin does his job right the worst that could happens is that you'll hose your own account setup but everything else on the machine would be fine.
Right. The tutorial warns against using "do" and "send" this way. But it seems to me that this kind of script could run and get you into trouble no matter where the engine or the scripts were located, or what their permissions were (provided they had the minimum permissions to run at all.)
I can't think of any way to abuse or hack the engine remotely. But I really do want to know if putting the Rev engine in the cgi folder causes a "hole" in Apache. I can't think how it would, but I'm no Linux guru either.
-- Jacqueline Landman Gay | [EMAIL PROTECTED] HyperActive Software | http://www.hyperactivesw.com _______________________________________________ use-revolution mailing list [EMAIL PROTECTED] http://lists.runrev.com/mailman/listinfo/use-revolution
