Safe mode?

[ace67]

My server's chief engineer sent an email to ask whether Reviewpost can operate with safe_mod_gid on. Here's an excerpt from a very long email he sent us due to the recent PHP configuration changes they made:

file_uploads is fine, but if uploads are on, then either safe_mode or safe_mode_gid should be turned on, and care should be taken in design, so
that bad guys can't upload and then execute their own code.

safe_mode ensures that the site can only execute code owned by the site
owner. safe_mode_gid ensures that the site can only execute code owned by the site owner's group. MOST applications can run with one of these settings, it just takes a couple of minutes to correct ownership.

For every popular CMS, blog, calendar or other open-source website
tool, there are fifty kids scouring the code for holes and writing worms to
infect them and take them over. Apparently some kids just have too much
time on their hands. I'm not against the tools, I'm just urging extreme
caution in deploying them. The number of intrusions and compromises I've
seen on our customer servers due to this type of fast and loose configuration speaks for itself.

He had other issues with the allow_url_fopen but will compromise if one of the safe mode settings is set to on. Can this be done and create no problems running RP?

[Chuck S]

Well the issue with safe mode is this.

Safe Mode does not allow our program to create the uploads or data directories needed when a user uploads an image or you create a category and the numeric directories for that category are created, You can give this info to him and he can test this. If setting the safe_mode_gid works then you might get away with that being on. I do know without fail that with safe mode on the directories are not created hense the file upload can not occur. Server admins can tweak there server settings with safe mode as well to allow what needs to happen in the program let happen so if he does this for you then your fine if not you need to find another host. 99% of hosts do not turn safe mode on cause they know they will lose there clients cause uploading is such a huge thing noadays.

[ace67]

I will pass your comments along to him.

For your own information, we are on a dedicated server so other what other ISP clients might or might not do is moot. To give you an idea why, take a look at the RP index page of ours. Right now it's at 2.7 million views just for your program in just under one year since we first started using it. That's an average of 7,400 views every day of the year. And that's just a minute part of our site. We have hundreds of web pages and thousands of photos online as well.

We also do not allow the people who post reviews to upload anything - products, images, nothing. They can't even upload their reviews as we moderate all of them first. We - the RP admins - are the only ones who upload anything. And no HTML is allowed.

[Chuck S]

If your running a dedicated server my friend you can turn safe mode off yourself