You may want to remove extraneous contexts -- they aren't generally necessary anyway. Of course, there are a whole set of general scripting security issues -- mostly boiling down to not implicitly trusting any input you receive.
You may way to consider the user you run the AppServer as, and the permissions you want to use. If you use MakeAppWorkDir, the entire Webware directory can be set not to be writable. On Wed, 2002-12-18 at 10:17, Michael Engelhart wrote: > hi all - > > I'm about to put a Webware 0.7 site into production and have been going > through my system for possible security holes (Unix). > > Is there anything in particular I should keep in mind as far as > Webware for security? I read the Wiki on Security but it's mostly > stuff I already know about in regards to general security and sesssion > id security, etc. Are there any inherent risks in running .py files > (generated by Cheetah) in my webware application directory? > > If I remove all the extraneous application contexts (including Admin) > is the only directory that will serve files the context that I setup > for my application? > > Thanks for any suggestions to cure my paranoia :-) > > Mike > > > > ------------------------------------------------------- > This SF.NET email is sponsored by: Order your Holiday Geek Presents Now! > Green Lasers, Hip Geek T-Shirts, Remote Control Tanks, Caffeinated Soap, > MP3 Players, XBox Games, Flying Saucers, WebCams, Smart Putty. > T H I N K G E E K . C O M http://www.thinkgeek.com/sf/ > _______________________________________________ > Webware-discuss mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/webware-discuss -- Ian Bicking <[EMAIL PROTECTED]> ------------------------------------------------------- This SF.NET email is sponsored by: Order your Holiday Geek Presents Now! Green Lasers, Hip Geek T-Shirts, Remote Control Tanks, Caffeinated Soap, MP3 Players, XBox Games, Flying Saucers, WebCams, Smart Putty. T H I N K G E E K . C O M http://www.thinkgeek.com/sf/ _______________________________________________ Webware-discuss mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/webware-discuss
