View Single Post
  #17 (permalink)  
Old 03-27-2009, 11:57 PM
snowboarder04 snowboarder04 is offline
Junior Member
 
Posts: 8
Default Security issue

Thanks for the script - I haven't tried using it yet, but it looks like it fits almost exactly what I need.

I'd just like to point out that there's a somewhat large security hole in the naming of zimbraAdmin.config. In a default installation of apache (whereby php script isn't executed on files without the appropriate file extension), and most other webservers (IIS excluded - I'm fairly sure it doesn't hand out plaintext .config files), this file can be accessed directly and in plaintext by simply navigating to the file URL in a browser.

Due to the extremely sensitive nature of the data that's held in the .config file, I think it would be a good idea to hold this data in a file with the .php extension, e.g. zimbraAdminconfig.php. This would ensure that every server will execute the script server-side and thus not make the contained data viewable via a simple GET request.

Thanks again
Reply With Quote