|
Notes |
|
|
(0000111)
|
|
dloper
|
|
2010-05-12 12:10
|
|
|
|
|
(0000120)
|
|
dloper
|
2010-05-17 10:49
(edited on: 2010-07-05 15:02) |
|
|
|
|
(0000191)
|
|
user2
|
|
2010-07-05 15:21
|
|
While creating the specification for WebDAV, a fundamental security issue was discovered. While WebDAV can work in a completely trusted environment, it is not feasible to implement it in a secure manner. It will also not work with file auditing and compliance.
Here is the issue. WebDAV writes files as the web server user (apache). For comparison, other Flexshare services (Samba, FTP), write files as the authenticated user. Consider two shares with WebDAV support: share1 and share2. The share1 is for staff at a local school, while share2 is for students. There are two files that were uploaded using WebDAV:
/var/flexshare/shares/share1/file1.txt
/var/flexshare/shares/share2/testscript.php
The testscript.php file was written by a student and contains the command to delete all files in the staff flexshare.
rm /var/flexhsare/shares/share1/*
Even though the student does not have Flexshare access to the staff share1, the files in the share are writeable by apache. In other words, the script will work and delete the staff files if it can be executed. Though you can prevent script execution and block shell access, the fundamental security issue remains,
For those who still want to implement WebDAV, the Flexshare system will honor manual configuration done from the command line. See feature 0000115 for details. |
|
|
|
|
|
|
|
(0010541)
|
|
NickH
|
|
2019-03-11 06:00
|
|
|
ClearOS is not intending to implement WebDAV because of the issues mentioned in this request. |
|