New answers tagged

2

Yes, you can do this, but it may not be the best design since, on some systems, such as HP-UX, the permissions of the socket file are ignored. While the permissions of the parent directory will still be applied, these may be harder to administer than the permissions on the socket file itself. Unix domain sockets provide another means for verifying the ...


3

Linux honors file permission on domain sockets, but there are Unix implementations that ignore permissions on the socket file (e.g. BSD, HP-UX). A portable program that depends on filesystem permission for security should create the socket in a directory with the desired permission rather than setting the permission on the socket file. There is also a ...


5

This is not directly insecure, as long as these files and directories have the same owner than the parent directory, that there is no hard-link allowing to bypass the parent directory permissions and that there is no exception put on the parent directory permissions (like some ACL for instance). However, I would still classify this as not prudent and not ...


1

Is it still possible ,with some trick perhaps to ignore docs, to perform a path traversal attack ? Yes, it's pretty simple, just use ../ and it will be normalized before the file is opened (on *nix systems anyway, I don't know for sure on Windows). Something like this would work. $path = '../test.txt'; $full_path = "./valid_dir/docs/" . trim($path); ...



Top 50 recent answers are included