source: sandbox/filemanager/doc/INSTALL @ 1506

Revision 1506, 2.6 KB checked in by amuller, 14 years ago (diff)

Ticket #597 - Adicionando código do filemanager compatível com expresso

Line 
1INSTALL
2-------
3Command examples are suggestions only.  Use your head.
4
5COMMAND SUMMARY
6---------------
7cp -a /some/path/to/egroupware/files /path/to/files
8cd /path/to/files
9chown -R nobody .
10-OR-
11chmod -R 777 .
12
13http://yourhost.com/setup/ > Setup/Config > Edit Current Configuration
14"Enter the full path for users and group files" => /path/to/files
15
16FULL EXPLANATION
17----------------
18[REQUIRED] Copy egroupware/files to where you want to store the files.
19           THIS SHOULD BE SOMEWHERE NOT INSIDE THE WEBROOT AND NOT ACCESSIBLE TO THE WEB.
20           Having the files within the webroot is a huge security risk as well as a privacy concern.
21           The exception to this would be if you WANT the users' and groups' files to be accessible
22           from the web, such as when setting up public or semi-public web page/document hosting.  In
23           this case, the files directory can be left where it is.
24           (Make sure you copy the directory, don't just make a new one.  The necessary directories
25                are files/ and files/home/)
26[REQUIRED] In http://yourhost.com/setup, login to Setup/Config, then Edit Current Configuration.  Enter the FULL path for the files directory you created earlier in the second box from the top.
27[REQUIRED] Change permissions for files directory and all it's subdirectories to be writable by Apache
28           This is the files directory you created earlier and specified in setup (Edit Current Configuration).  Note that 'nobody' below could also be 'apache' on your system.  Check the 'User' setting in your httpd.conf.
29                cd /path/to/files
30                chown -R nobody .
31                -OR-
32                chmod -R 777 .
33
34SECURITY CONCERNS
35-----------------
36There are many security concerns related with allowing users to store files on the server.  The most common problem is that users can upload any type of file, including CGI and PHP scripts.  This in effect grants them local access to the machine, and can be used to read database passwords and other sensitive files.  The ability to upload files of any type is not forbidden by phpwebhosting because it is sometimes desired, and also the types of vulnerable files differ from server to server.  To combat this, you can add a simple entry to Apache's httpd.conf to prevent certain types of files from being executed.  Included below is an example that results in .cgi, .pl, .php, .php3, and .phps files being treated as normal text files.  It also explicitly turns all Options off, which includes turning Indexes (listing of files) off.
37
38<Directory /path/to/files>
39Options None
40AllowOverride None
41DirectoryIndex index.html
42RemoveHandler cgi-script .cgi .pl
43RemoveType application/x-httpd-php .php .php3
44RemoveType application/x-httpd-php-source .phps
45</Directory>
Note: See TracBrowser for help on using the repository browser.