bugphpGroupWare - Bugs: bug #808, phpWebHosting - owner is replaced...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #808: phpWebHosting - owner is replaced when file is copied

Submitted by:  None
Submitted on:  Fri 05 Jul 2002 12:42:29 PM UTC  
 
Item Group: 0.9.14 releaseCategory: filemanager
Severity: 3 - NormalPriority: 5 - Normal
Status: InvalidPrivacy: Public
Assigned to: Jason W <Zone>Open/Closed: Closed
Component Version: NoneOperating System: GNU/Linux - RedHat/Fedora
Reproducibility: Every TimePlanned Release: None
Fixed Release: 

Tue 09 Jul 2002 03:57:22 AM UTC, comment #1:

The behavior you describe as a bug is in fact the correct behavior. It is the same in Unix. Take this example:

user@host:~$ ls -l /bin/bash
-rwxr-xr-x 1 root root 511400 Apr 8 12:07 /bin/bash
user@host:~$ cp /bin/bash ~/bash
user@host:~$ ls -l ./bash
-rwxr-xr-x 1 user user 511400 Jul 8 20:45 ./bash

You wouldn't expect the file to be owned by root still, as that would be a security problem. In a groupware setting, take this example:

Admins use /home/Admins/howto/ as a read-only repository for documentation. They have a file /home/Admins/howto/change_your_password. Now Mr. Baduser, who wishes to trick everyone into typing their password into his page on a another site, copies change_your_password to /home/Default, edits it to point to his site, and starts point users to it, asking them to change their password. With your patch, the file would appear to be official as it would be owned by 'Admins' still. The correct way to handle it is to change the owner to the less privileged 'baduser', or the group 'Default', since 'baduser' has access to that group.

I think the confusion might come from the fact that when you initially moved the file from /home/Admins, it was still owned by Admins. This is because you were moving it FROM /home/Admins, so you were acting in the role of Admin. The solution is to have a interface to change file ownership and permissions, which we should have anyway for other reasons. Also we might prompt them when moving the file, asking 'Who should this file be owned by?', with the appropriate default chosen for them.

Jason W <Zone>In charge of this item.
Fri 05 Jul 2002 12:42:29 PM UTC, original submission:

In phpWebHosting, when a file is copied from a folder owned by X, the file's owner is replaced by X.

Sample steps to reproduce this bug:
1.you need full read/write access to groups Admins and Default
2.go to Admins' home folder
3.create or upload a file; it's owner is "Admins"
4.move this file to Default's home folder
5.goto Default's home folder
6.create a sub-folder named Temp
7.copy the file to Temp folder
8.goto Temp folder
9.the owner of the copy in Temp is replaced by "Default"

Anonymous

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

Follow 4 latest changes.

Date Changed By Updated Field Previous Value => Replaced By
Tue 09 Jul 2002 03:57:22 AM UTCZoneStatusNone=>(Error - Not Found)
  Open/ClosedOpen=>(Error - Not Found)
  Closed on-=>-
Fri 05 Jul 2002 03:38:14 PM UTCcebAssigned toNone=>NA

Back to the top


Powered by Savane 3.1-cleanup1