Sebastian Mendel a écrit :

Hi,

what exactly is the problem with config.inc.php being world readable?

Everyone can see your user/password (when using "config" auth type).

issnt every file readable by the web server 'somehow' world readable?

Not on the servers I manage. The owner is each user, the group is "apache", and world cannot read. But on sf.net we can't do that because owner is each user, group is the project name.

and issnt it so if

/www is only user and group readable

that

/www/myweb/config.inc.php

is secure enough?

or is this just a sf.net specific problem, cause all webroots are world readable?

(btw. i am a little bit annoyed by the fact that i have now set my read only flag for config.inc.php after every change on it on my developer machine (Windows))

Hmmm ?