.html files uploaded by snippetmaster are not publicly viewable?

[radloffe]

Hello ,  I have just installed snippetmaster and enabled the PRO license key on a Windows Small Business Server 2003 running IIS 6.x (PHP 5.1.2).  I have managed to get the file permissions to the point where snippetmaster itself is secured from public access, but it allows existing webpages to be edited and saved, and those changes are then viewable by the public.  HOWEVER... when I upload a new .html file into the public web root directory, the file uploads successfully, but is not automatically assigned to the user IUSR,  so it is viewable to internal users who have logged in, but not public anonymous/internet users. 

I have a hunch this is this becuase I have SSL-secured and password-protected the snippetmaster folders and subdirectories under domain user access only, which means that when snippetmaster is running it is not running under the anonymous user privilages of IUSR.  Is there a way I can secure the snippetmaster folders from public view and still give snippetmaster itself the ability to create new publicly-viewable files? The main thing I'm trying to accomplish is to prevent a hacker from guessing and entering a URL to display the password file.  OR... is the ioncube encoding sufficiently strong to prevent that from being an issue (am I over-securing)?

Thanks ,
Radloffe

[admin]

Hello,

Your description of the problem sounds correct.  If the "user" that is running PHP is not assigning public read permissions to uploaded files, then you'll need to adjust either the user or php so that uploaded files are given public read permissions.

To address your concerns regarding security:

[1] The user password file is the "users.php" file which is a file inside your database folder.  If you look at your database folder, you'll see how it works.

[2] The passwords are encrypted.

[3] I think your best solution is to create your database folder so that it is "outside" the web root. This means it is not accessible with a browser, and someone would need to actually hack your server, fine and get to the file (in an known location), and then decrypt the passwords.  (In which case, getting to the users.php file is likely the least of your worries.)

[4] If you want to implement additional security around the snippetmaster program files, you can use something like .htaccess authentication or the IIS equivalent, which is built-in authentication system to access any files in specified folders.  (Put an .htaccess authentication requirement into the database folder.)

I have not received any reports of security related issues with snippetmaster, and security is always something I think about when programming and designing the system.