Re:25 Years of PHP [video]
by antod on Sunday September 08, 2019 @08:52PM
(#20914348)
From hazy memory there were two ways of configuring apache/mod_php.
1) The web server ran with a common account (eg www-data), and only had read access to users files.
2) The web server could be configured to run each site in the context of the file owners.
The advantages of 1) were that your website didn't have write access to your files. The advantages of 2) were that other peoples websites didn't have read access to your files, but your own site could overwrite them.
I only felt "safe"(ish) on a dedicated server, using option 1).
Re:25 Years of PHP [video]
by ptx on Monday September 09, 2019 @03:45AM
(#20916021)
This means that everyone can read each other's configuration files, though, and thus connect to each other's databases, doesn't it? (Edit: Ah, that's why you had a dedicated server.)
1) The web server ran with a common account (eg www-data), and only had read access to users files.
2) The web server could be configured to run each site in the context of the file owners.
The advantages of 1) were that your website didn't have write access to your files. The advantages of 2) were that other peoples websites didn't have read access to your files, but your own site could overwrite them.
I only felt "safe"(ish) on a dedicated server, using option 1).