Re: A patch to keep cache directory out of webroot

Jason Judge wrote:
> "Jonn Beames" <[email protected]> wrote in message
> news:[email protected]...
> 
>>...
>>if the goal is to make it possible to operate with no writable
>>directories under the webroot, then it seems to me the only pertinent
>>question is whether the user's environment supports this, and their use
>>of xaraya modules support this - if they want to upload files but don't
>>want to use the uploads module, and they want to use a calendar module
>>that require web accessible, writable files, then they can't operate
>>without writable directories under the webroot so there is no value in
>>moving it.
> 
> 
> It's not so much about whether a directory is writable. The security issues
> concern whether a [writable] directory is accessible from a web client or
> not.
> 
> -- JJ
> 
> 
Actually, that doesn't concern my point.  I've already offered 
allow/deny/mod_rewrite rules as an alternative way to prevent writable 
directories from being accessible from a web client, but what we are 
talking about here is moving the writable directories out from under the 
webroot when there is no other convenient way to restrict web client access.

This all stems from the patch submitted that attempts to make the 
var/cache directory location configurable so that it can be moved 
outside of the webroot so that its writable subdirectories are not web 
client accessible.

The patch comments specifically referenced IIS, which I have only 
limited exposure to over the last few years.  I am not unfamiliar with 
the security requirements or expectations of this web server.

To be honest, I'm not certain what the specific threats are with web 
client access of writable directories (other than some writable stuff 
you want to only be read from controlled web server processes that take 
into account other security mechanisms).

If someone can document specific threats to be protected against, it 
would be a great help to me.

  - Jonn