On 11/08/12 00:48:38, Dennis Lee Bieber wrote: > On Fri, 10 Aug 2012 12:35:06 -0700, Smaran Harihar > <smaran.hari...@gmail.com> declaimed the following in > gmane.comp.python.general: > >> Hi Tim, >> >> this is the output for the ls -lsF filename >> >> 8 -rwxr-xr-x 1 root root 5227 Jul 30 13:54 iplantgeo_cgi.py* >> > <shudder> > > A CGI script owned by root?
Why not? It's not setuid, so being owned by root does not give it any special privileges. > What "user" does your web server run as? > I'd recommend setting that user as the owner of the CGI script. That's definitely a bad idea. More so if it's writeable by its owner, as is the case here. It would mean that if a security hole allows intruders to write to arbitrary files, then they can overwrite this script and that would allow them to execute arbitrary code. -- HansM -- http://mail.python.org/mailman/listinfo/python-list
