Introduction By Karina Inc http://karina-inc.net76.net

Open source doesn't just mean access to the source code. The distribution terms of open-source software must comply with the following criteria:
1. Free Redistribution

The license shall not restrict any party from selling or giving away the software as a component of an aggregate software distribution containing programs from several different sources. The license shall not require a royalty or other fee for such sale.
2. Source Code

The program must include source code, and must allow distribution in source code as well as compiled form. Where some form of a product is not distributed with source code, there must be a well-publicized means of obtaining the source code for no more than a reasonable reproduction cost preferably, downloading via the Internet without charge. The source code must be the preferred form in which a programmer would modify the program. Deliberately obfuscated source code is not allowed. Intermediate forms such as the output of a preprocessor or translator are not allowed.
3. Derived Works

The license must allow modifications and derived works, and must allow them to be distributed under the same terms as the license of the original software.
4. Integrity of The Author's Source Code

The license may restrict source-code from being distributed in modified form only if the license allows the distribution of "patch files" with the source code for the purpose of modifying the program at build time. The license must explicitly permit distribution of software built from modified source code. The license may require derived works to carry a different name or version number from the original software.
5. No Discrimination Against Persons or Groups

The license must not discriminate against any person or group of persons.
6. No Discrimination Against Fields of Endeavor

The license must not restrict anyone from making use of the program in a specific field of endeavor. For example, it may not restrict the program from being used in a business, or from being used for genetic research.
7. Distribution of License

The rights attached to the program must apply to all to whom the program is redistributed without the need for execution of an additional license by those parties.
8. License Must Not Be Specific to a Product

The rights attached to the program must not depend on the program's being part of a particular software distribution. If the program is extracted from that distribution and used or distributed within the terms of the program's license, all parties to whom the program is redistributed should have the same rights as those that are granted in conjunction with the original software distribution.
9. License Must Not Restrict Other Software

The license must not place restrictions on other software that is distributed along with the licensed software. For example, the license must not insist that all other programs distributed on the same medium must be open-source software.
10. License Must Be Technology-Neutral

No provision of the license may be predicated on any individual technology or style of interface.

Comments

Anonymous’s picture

Anonymous (not verified) commented
Category: bug » feature
Status: Active » Postponed (maintainer needs more info)

I don't see this as a Drupal issue. Can you give a better indication of the issue within file.inc?

drewish’s picture

drewish commented

it'd be a core issue because file_check_directory is what's posting the message. the contrib module could call drupal_get_messages() to clear them though.

mrtoner’s picture

mrtoner commented

Actually, file_check_directory() in D6 (perhaps previous) posts that message. In D7 that message has been removed. However, there are 7 other instances of the use of %directory that could expose a site's hosting account username.

Yes, a contrib module could clear the message, but that's asking the authors to workaround an issue in core that seems to be a risk to the site owner.

Anonymous’s picture

Anonymous (not verified) commented

I still don't see this as a Drupal issue. The name of the directory is created by the user or perhaps a module. It sounds to me like the security issue belongs to the hosting company if they are the ones creating the directory or the module if it is the one creating the directory or the user if he names the directory.

mrtoner’s picture

mrtoner commented

It's a core issue because core creates a message that not only gives the name of the directory, but the entire path of the directory. The module isn't creating the message; it's asking core to create a directory and core responds by telling the user -- every user -- what the entire path to that directory is.

It's similar to a user or a module creating a user account: you don't expect core to expose the password the user or module provided.

There is absolutely no need for the entire path to be exposed, except perhaps to user 1. I have to wonder why the message was removed from file_check_directory() in D7 in the first place.

ñull’s picture

ñull commented

Drupal is a content management system, not a tool to show system paths. If you want that tool, then you can write a module for that. I agree that it is only functional for adminstrators to know the username of the hosting account. There is not reason why a normal should see this. These messages could be logged instead of shown. If for whatever reasons the normal user should see what is the username of the hosting account, then they can ask the administrator or the administrator can post it in a restricted area. Add my vote to fix this bug.

sun.core’s picture

sun.core commented
Category: feature » task
Priority: Normal » Critical
Status: Postponed (maintainer needs more info) » Active
Issue tags: +Needs usability review, +Usability

oh, yes! Image module + a lot of other modules can't even hide those sysop-type-of messages.

drewish’s picture

drewish commented
Priority: Critical » Normal

I'm really not seeing how knowing the directory that the site is in in critical.

drewish’s picture

drewish commented
Status: Active » Reviewed & tested by the community

whoops, meant to bump the status as well.

drewish’s picture

drewish commented
Status: Reviewed & tested by the community » Active

i posted that to the wrong issue. sorry for all the noise.

codecowboy’s picture

codecowboy commented

Obfuscation isn't a proper security methodology. That said there is no reason to expose an absolute path. We should probably only display relative paths. Is this still an issue after the stream wrapper patch?

mattyoung’s picture

mattyoung commented

.

Bojhan’s picture

Bojhan commented
Issue tags: -Needs usability review

Nothing to review

K-Inc’s picture

K-Inc commented
Issue summary: View changes

How does ehcp deal with the issue of ownership for CMS systems like Joomla.

Will it be necessary to install suphp and is ehcp compatible with suphp.

Status: Active » Closed (outdated)

Automatically closed because Drupal 7 security and bugfix support has ended as of 5 January 2025. If the issue verifiably applies to later versions, please reopen with details and update the version.