Re: Using system call + wrapper?

On Mon, 26 Feb 2001, Richie wrote:

> It was suggested to me to use a wrapper that invokes a system call such as
> system('sudo upload.php -p password') that will run the program in sudo
> but I really don't know where to start with this??

You should never, ever, ever run CGI-/PHP-applications as root. And
running things as root is what sudo normally does. Is that what you're
contemplating?

If so, alter the owner of the directory instead so that your ordinary
CGI-/PHP-scripts may write to it. But be _very_ careful how you write your
code. Can anybody upload things? What happens when the filesystem gets
full? Also be very careful that you do not trust any data the user
supplies, especially not with the "system" call.


/Viktor...

--|     Viktor Fougstedt, system administrator at dtek.chalmers.se     |--
--|                http://www.dtek.chalmers.se/~viktor/                |--
--| ...soon we'll be sliding down the razor blade of life. /Tom Lehrer |--