Hi,
We have a dev version of a client’s website, and we sent a zipped version for them to install on their server.
They are asking the following question, wich I can’t answer so I’m calling for someone’s sagacity...
"I followed your installation process, and got this error when cleaning cache :
Warning: fopen(../assets/cache/siteCache.idx.php) [function.fopen]: failed to open stream: Permission denied in /home/sites_web/public.clientdomainname.net/html/modx/manager/processors/cache_sync.class.processor.php on line 228
Cannot open file (../assets/cache/siteCache.idx.php)
We forbid php (web server) from writing code into website directory that could be executed by server itself. This is just a very basic security precaution. Why is application trying to modify php code?"
Any idea ?
thx
Tib
-
☆ A M B ☆
- 711 Posts
MODx is trying to create cache pages of the site and uses these files / directory to do so.
assets/cache/ needs to be writeable by php.
Sure, I understand that, but why is the client thinking this is not secure ?
Well maybe. Apparently their concern is that PHP can write something and then execute it : here’s what they say " We forbid apache/php process to write files that it could execute. Therefore with this policy ../assets/cache/siteCache.idx.php should not be writable by modx scripts. In which situations should we clean the cache? And can this be done “offline”?"
Frankly speaking we don’t know what to respond. We explained that caching is necessary for the system. This client is hosting his own client’s data on the server, so they are extremely concerned with security. They believe the cache system could be used by hackers. What could we answer ?
thanks
T
-
☆ A M B ☆
- 711 Posts
It sounds like the host does not have much experience with a PHP Setup, there is nothing unsecure with allowing PHP to write to your domain folder, providing the server / FTP Login is secure and register globals is switched off a hacker could not compromise your files or create new ones on your server.
Aaron
-
☆ A M B ☆
- 24,524 Posts
If this is such a serious concern to them, then they should be running PHP in some kind of suexec mode. In this way, when a script is run the user is switched from the apache user to the owner of the script (which would be the same user as your FTP user). This way nothing has to be world-writable, only owner-writable.
MODX Staff