httpd-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Jan-Pieter van den Heuvel" <>
Subject [users@httpd] Security
Date Sat, 22 Feb 2003 16:58:50 GMT
Hi everybody,

I'm running a webserver for multiple websites. Users can upload the
content to the server via FTP. When a user uses the MySQL database, it
must specify its username and password in a file. How do I prevent one
user to read the password of another user?

It can't be done by FTP: they only have access to their own files. But a
user can write a PHP-script (or CGI) that reads the contents of a file
from the website of another user! That means a user can read someone
else's password! Is there a way to prevent this?


Jan-Pieter van den Heuvel

BTW I'm using RedHat Linux 7.3 with apache 1.3.23.

The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:> for more info.
To unsubscribe, e-mail:
   "   from the digest:
For additional commands, e-mail:

View raw message