Firefox PHP

Web Install Script

Posted by smooch1502 
Web Install Script
May 15, 2009 03:50PM
Hi,
i would like to suggest a Web Install script
Re: Web Install Script
May 15, 2009 04:00PM
like?
how is it supposed to work?


Thomas Seifert
Phorum Development Team / Mysnip-Solutions.de
Custom Phorum and general software development
worry-free Phorum Hosting
Re: Web Install Script
May 15, 2009 05:28PM
All I can think of right now is a config generator and maybe even writing the config automatically if a writable include/db/config.php exists. For the rest, I think that the Phorum install procedure counts as an online install script.

One could make it super super automatic. But that would require opening up the directory and letting Phorum manage all the files in there. That could be used for downloading, installing, upgrading, installing modules, etc.

We prefer security though.


Maurice Makaay
Phorum Development Team
my blog linkedin profile secret sauce
Re: Web Install Script
May 16, 2009 06:05AM
sorry for little info
i was thinking for something like a web install script
so for eg:

They upload this one file
then set 777 perms on the folder its in
then when run it will auto download the zip file to their server only ones with fsockopen will work
and then extract the zip to a folder

once extracted it can be installed as normal and since the webinstall script will be faster than downloading manually it can be installed in less time

i came up with this idea as i found the unzipper script and added a download formally just copying from one server to another and a few more vars

then i could install the script in less than 1 minute

i have a sample script however the unzip part was not created by me but i did add the other things
Re: Web Install Script
May 16, 2009 06:08AM
i forgot to add that when i tested it on my server only php had perms to delete or change the permissions on the folder it was in
Re: Web Install Script
May 16, 2009 12:43PM
That's what happens.

You make the folder writable for any user on the server by doing chmod 777 (extremely insecure, really, those permissions should be set back to a sane 755 at least after installing). Then the webserver can write files in your directory. Since those files are then owned by the webserver and not by you, you can run into lots of troubles with permissions. All file management has to be done through a web page from then on, since your FTP program might not be allowed to do changes to those files. Unless the installer would make all files chmod 666 (what's in a number?) and al directories chmod 777, in which case you (and the rest of the world) would be able to write those files. On some server setups (where you are on one host will thousands of other users in a simple mass hosting setup), your "neighbours" will have full control over your site too in such case. A script could also set permissions to a more sane 755/644 mode, but that does only take away part of the rist. Often, mass hosting setups will run all websites as the webserver user, meaning that your neighbour could still write a script (or install a standard file system browser script) to control your files. This goes on beyond the extend of the neighbour though. Bad scripts (of course not your Phorum script; I'm talking about the neighbour's scripts of course) could be abused by hackers to access your files too.

I'm getting a headache, so I should stop :-)

This is a very good example to demonstrate a tipped over balance between ease of use and security. I can tell you that I doubt that this kind of installer script will be written or supported by the Phorum team. I do see use for tools that assist the admin in installing Phorum, but a 100% automatic install is too much.


Maurice Makaay
Phorum Development Team
my blog linkedin profile secret sauce
Sorry, only registered users may post in this forum.

Click here to login