Chuid contained two fatal bugs, the first allowing a user to change the uid of files outside of the designated upload directory by using '..', the second allowing a user to change root owned files as well as webserver owned files. Give the combination of these to it is imperative that people using this program upgrade to the latest version, which can be found at the following url: http://srparish.net/scripts/chuid-1.3.tar.gz Thanks to Roman Ivanov for finding and informing appropriate people about this problem. Chuid is a small program to solve a problem created by PHP's safe_mode, which makes it so that non-webserver owned PHP scripts can't accept file uploads. It solves this dilemma by allowing files in a compile time specified upload directory to be re-owned by an arbitrary user, thus allowing PHP scripts to make use of uploaded files. sRp -- Scott Parish http://srparish.net/
Attachment:
pgp00076.pgp
Description: PGP signature
