13 Oct
2005
13 Oct
'05
5:02 a.m.
Michal Čihař wrote:
oh, of course per user settings not ...
or just in a file (just test for write privilelgs, if not no error)
alerts only on first time to 'registered' users with this version to
given email adress - when the security alert comes the first the vendors
will mostly not have applied any patch adressing this issue
--
Sebastian Mendel
www.sebastianmendel.de
www.sf.net/projects/phpdatetime | www.sf.net/projects/phptimesheet
Hi
On Thu 13. 10. 2005 12:24, Sebastian Mendel wrote:
you are right, ...
how about add an 'Registration' in
main.php which leads to local
registration form
People don't like registrations, I'm not sure whether effort invested
into this will return in any positive value.
this form could collect, of course after
explaining and asking for
permission:
- number of servers/databases/tables handled with this installation
number of servers is configuration, however rest are dynamic values
changing quite a lot over time - currently
installed versions of PHP, PMA, MySQL
- used extension mysql, mysqli
- changed configuration (different from default)
- used theme
this is per user settings, doesn't make much sense to collect it -
registration information (email, name, company, ... )
- hash of installation path (as unique id for installation)
- hash of server connection string (as unique id for servers)
- a free textfield for additional comments
this can be stored local, or at least a hash over all, to recognize
changes and update registration
stored where? in pmadb? this is currently only place where you can save
anything, but it is not enabled on most installations - send
security alerts on specific versions
You can't handle this as vendors often backport security patches, so you
don't know whether version user has installed is really vulnerable.