Make installer deletable #12873

Activity

1. LukasReschke

   added

   enhancement

   settings:installation

   security

   on Dec 16, 2014
2. karlitschek commented on Dec 16, 2014

   

   karlitschek

   on Dec 16, 2014

   Contributor

   More actions

   hmm. not sure this is big problem. the real bug is the config file read/write error :-)
3. LukasReschke commented on Dec 16, 2014

   

   LukasReschke

   on Dec 16, 2014

   ContributorAuthor

   More actions

   hmm. not sure this is big problem. the real bug is the config file read/write error :-)

   Well - the problem here is that we still don't know how to prevent that from happening. That's what hardening is all about: Make it harder to exploit a potential other potential flaws.

   Just like running insecure programs not as root is also not the real bug, the real bug is the insecure application. ;-)
   (There is a reason why A LOT of other applications does it this way, ignoring the fact that nearly no other application has a rw config file…)
4. LukasReschke commented on Dec 16, 2014

   

   LukasReschke

   on Dec 16, 2014

   ContributorAuthor

   More actions

   Also another bug that would not have happened: http://owncloud.org/security/advisory/?id=oc-sa-2014-018
5. LukasReschke commented on Dec 16, 2014

   

   LukasReschke

   on Dec 16, 2014

   ContributorAuthor

   More actions

   From what I see we have the following options here:

   • No-OP:
     • Contra: Problems will still exist and this can get a very huge problem in a large environment.
   • Switch config file to database:
     • Pro: That's what every other relevant web application out there does at well. The config file should only store the database config.
     • Pro: We can create a OCC tool to edit the configuration via CLI.
     • Contra: A text editor to edit the config is not sufficient anymore. But we have a CLI tool for that.
   • Add some more hacks (what this issue would also kinda be about):
     • Pro: Config is still editable via text editor
     • Contra: Technical debt++

   Relevant #11843
6. DeepDiver1975

   modified the milestone: backlog on Mar 21, 2015
7. ownclouders

   added

   status/STALE

   on Jan 5, 2018
8. AlexAndBear

   closed this as completedon Sep 21, 2021