<html><head><base href="x-msg://534/"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div>What we have here - is not a serious <b>bug</b>, but a serious <b><shrug></b>.</div><div><br></div><div>Ha ha!</div><div><br></div><div>Jeff</div><div><br></div><div><div><div>On 23 Aug 2011, at 10:16, Jason Ozin wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><div bgcolor="#ffffff" style="font-style: normal; font-family: Arial; font-size: 12pt; font-weight: 400; "><div><font size="2">Michael,</font></div><div><font size="2"></font> </div><div><font size="2">Your response is disappointing. Firstly my post was not a rant but a reasoned argument for not releasing broken functionality without at least an explanation/warning clearly in the GUI. But mainly because your seem to be of the mindset that all users of BlueOnyx are active participants in this list who read every post and if they are not then it serves them right if they don't know about a known serious bug.</font></div><div><font size="2"></font> </div><div><font size="2">In addition with your comment about if it's broken then simply turn it off, you are assuming that all users of BlueOnyx have the ability to debug and troubleshoot errors (keep in mind that on the face of it this is an error that just produces a blank page). Again, surely the point of having a management tool with a GUI is to assist less technical admins?</font></div><div><font size="2"></font> </div><div><font size="2">I have the greatest respect for the work you do on this product Michael but if you are seriously happy to add functionality to BlueOnyx (even one of such security benefit) knowing that the normal user will break their sites if they use it (without adding a simple warning into the GUI) then I think you need to reconsider your real world audience/users.</font></div><div><font size="2"></font> </div><div><font size="2">In short I appreciate the quick fix but it could have been implemented at inception or at the very least a warning added to the GUI.</font></div><div><font size="2"></font> </div><div><font size="2">Regards</font></div><div><font size="2"></font> </div><div><font size="2">Jason</font></div><div><font size="2"></font> </div><blockquote style="border-left-color: rgb(0, 0, 0); border-left-width: 2px; border-left-style: solid; padding-left: 5px; padding-right: 0px; margin-left: 5px; margin-right: 0px; "><div style="font: normal normal normal 10pt/normal arial; ">----- Original Message -----</div><div style="font: normal normal normal 10pt/normal arial; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: rgb(228, 228, 228); background-position: initial initial; background-repeat: initial initial; "><b>From:</b><span class="Apple-converted-space"> </span><a title="mstauber@blueonyx.it" href="mailto:mstauber@blueonyx.it">Michael Stauber</a></div><div style="font: normal normal normal 10pt/normal arial; "><b>To:</b><span class="Apple-converted-space"> </span><a title="blueonyx@mail.blueonyx.it" href="mailto:blueonyx@mail.blueonyx.it">BlueOnyx General Mailing List</a></div><div style="font: normal normal normal 10pt/normal arial; "><b>Sent:</b><span class="Apple-converted-space"> </span>Tuesday, August 23, 2011 9:54 AM</div><div style="font: normal normal normal 10pt/normal arial; "><b>Subject:</b><span class="Apple-converted-space"> </span>[BlueOnyx:08203] Re: open_basedir bug in the SuPHP</div><div><br></div><div style="white-space: pre-wrap; text-indent: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">Hi
Jason,</div><div style="white-space: pre-wrap; text-indent: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><br></div><div style="white-space: pre-wrap; text-indent: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">>
> It's a long known imperfection of our suPHP integration:</div><div style="white-space: pre-wrap; text-indent: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">></div><div style="white-space: pre-wrap; text-indent: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">>
Which to be fair really is a description of a bug. Given that it is known</div><div style="white-space: pre-wrap; text-indent: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">>
doesn't make it less bug like.</div><div style="white-space: pre-wrap; text-indent: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><br></div><div style="white-space: pre-wrap; text-indent: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">No,
I don't think so. The *only* catch with the previous implementation was that
suPHP used the server wide PHP settings for suPHP enabled Vsites. Which was
still a hell of a lot more secure than just using the plain PHP support
<shrug>. </div><div style="white-space: pre-wrap; text-indent: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><br></div><div style="white-space: pre-wrap; text-indent: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">>
Especially when this is a GUI based management system and ticking
something</div><div style="white-space: pre-wrap; text-indent: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">>
in the GUI actually breaks the functionality of the component you have</div><div style="white-space: pre-wrap; text-indent: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">>
just enabled, without one having to manually add a file to fix the break.</div><div style="white-space: pre-wrap; text-indent: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">>
What makes/made it worse is that, unlike the warning in the popup note for</div><div style="white-space: pre-wrap; text-indent: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">>
SuPHP about changing site ownership, there is no warning about this issue.</div><div style="white-space: pre-wrap; text-indent: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">>
So someone like me who was unaware of it was up untill 4am desperately</div><div style="white-space: pre-wrap; text-indent: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">>
trying to figure out why my site would not work.</div><div style="white-space: pre-wrap; text-indent: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><br></div><div style="white-space: pre-wrap; text-indent: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">Just
a week ago the very same issue had been discussed on this list and it was
explained how to get around the open_basedir restriction. And I checked: The
topic came up four times in the last 13 months and every time the limitation
and the possible work around were openly discussed. Below are the IDs of those
discussions and their dates:</div><div style="white-space: pre-wrap; text-indent: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><br></div><div style="white-space: pre-wrap; text-indent: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">[BlueOnyx:08102]
2011-08-15</div><div style="white-space: pre-wrap; text-indent: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">[BlueOnyx:07258]
2011-05-10</div><div style="white-space: pre-wrap; text-indent: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">[BlueOnyx:06363]
2011-01-21</div><div style="white-space: pre-wrap; text-indent: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">[BlueOnyx:04974]
2010-07-07</div><div style="white-space: pre-wrap; text-indent: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><br></div><div style="white-space: pre-wrap; text-indent: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">>
Your fix seems sensible and frankly the SuPHP functionality should not </div><div style="white-space: pre-wrap; text-indent: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">>
have been offered without such a fix in the first place.</div><div style="white-space: pre-wrap; text-indent: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><br></div><div style="white-space: pre-wrap; text-indent: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">Sorry
Jason, but that's simply not true. From forensics I've done over the last 13
months since we added suPHP support I know way too many cases where suPHP
either actively limited the effects of exploits or prevented exploits
outright. Or cases where it would have stopped it if suPHP had been enabled in
first place.</div><div style="white-space: pre-wrap; text-indent: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><br></div><div style="white-space: pre-wrap; text-indent: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">Yes,
it would have been ideal if the per Vsite php.ini support had been there from
the beginning. No doubt about it. However, while the code changes that
implemented it look minimal (<a href="http://devel.blueonyx.it/trac/changeset/741/">http://devel.blueonyx.it/trac/changeset/741/</a>),
the logic behind it and the methods it uses to make it happen weren't there 13
months ago when suPHP was initially introduced. Back then we used a
differently compiled suPHP and our custom Perl function
Sauce::Util::hash_edit_function() wasn't yet capable of editing php.ini files
with such minimal effort as it can do now. So for all this to work as it now
does, a lot of different pieces had to come together one by one.</div><div style="white-space: pre-wrap; text-indent: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><br></div><div style="white-space: pre-wrap; text-indent: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">>
So you really cannot in future enable a feature that does not</div><div style="white-space: pre-wrap; text-indent: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">>
work straight from the GUI (unless there is a very clear warning or</div><div style="white-space: pre-wrap; text-indent: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">>
explanation in the GUI).</div><div style="white-space: pre-wrap; text-indent: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><br></div><div style="white-space: pre-wrap; text-indent: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">Hell,
NO! Given the choice to add more security to BlueOnyx now (while adding a
minor inconvinience during administration), or delaying things until all the
ducks are perfectly lined up, then I'll always go for the faster
implementation of more security now instead of "ooh-shiny!" at a later
time.</div><div style="white-space: pre-wrap; text-indent: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><br></div><div style="white-space: pre-wrap; text-indent: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">>
Michael, please take this in the spirit it is intended. This is great</div><div style="white-space: pre-wrap; text-indent: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">>
project and you do so much hard work on it which is appreciated by all.</div><div style="white-space: pre-wrap; text-indent: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><br></div><div style="white-space: pre-wrap; text-indent: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">Jason,
I can understand your frustration, but I also see it this way: suPHP wasn't
working for you the way you imagined it to work. You could have switched to
regular PHP instead of suPHP while you looked for the answer. But instead of
checking the list, where exactly that same issue had been discussed just last
week (or instead of asking it again) you sent a rant. Even though the updated
base-vsite with support for custom php.ini files was released within hours of
your message (even that implementation isn't 100% perfect and was released in
a rush) this still isn't good enough and serves as invitation for even more
criticism. But hey, that's OK. I take it in the spirit that it was presented
and reserve the right to disagree and to just shrug that criticism off.</div><div style="white-space: pre-wrap; text-indent: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><br></div><div style="white-space: pre-wrap; text-indent: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">--
</div><div style="white-space: pre-wrap; text-indent: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">With
best regards</div><div style="white-space: pre-wrap; text-indent: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><br></div><div style="white-space: pre-wrap; text-indent: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">Michael
Stauber</div><div style="white-space: pre-wrap; text-indent: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><br></div><div style="white-space: pre-wrap; ">
<br class="webkit-block-placeholder"></div><hr><div style="white-space: pre-wrap; "><br class="webkit-block-placeholder"></div>_______________________________________________<br>Blueonyx mailing list<br><a href="mailto:Blueonyx@mail.blueonyx.it">Blueonyx@mail.blueonyx.it</a><br><a href="http://mail.blueonyx.it/mailman/listinfo/blueonyx">http://mail.blueonyx.it/mailman/listinfo/blueonyx</a><br></blockquote>_______________________________________________<br>Blueonyx mailing list<br><a href="mailto:Blueonyx@mail.blueonyx.it">Blueonyx@mail.blueonyx.it</a><br><a href="http://mail.blueonyx.it/mailman/listinfo/blueonyx">http://mail.blueonyx.it/mailman/listinfo/blueonyx</a><br></div></span></blockquote></div><br></div></body></html>