OK, lazybadger, feel free to correct me if I'm wrong
Shame you pass up on that and just be *like* a grumpy old man mumbling about, accusing me of lying, ignorance and/or being incompetent without giving any kind of evidence of you being anything to the contrary.
The way it was explained to me by Skalpa in laymans terms as much as possible to make me understand it a bit, was this:
Many shared hosting providers do not run each account under a separate apache instance, but use the default 'apache' user and group created on initial install, and use a vhost for each website on that server. Apache runs under this special credentials for all those websites.
So where you need to give your application "write access" you need to give this "apache" user write access (generally it means: making the folder world-writable). If the owner had write access, it wouldn't mean anything to the "apache" user, and PHP wouldn't be able to write anything.
Now, what happens is that all the websites that run on the same shared server, run under this "apache" user... So where you give write access to apache, you're giving write access to EVERY malicious user sharing the same server.
Now, is this a XOOPS problem or not? I say no, because:
1) Smarty REQUIRES the possibility to write some files, so it can't be changed.
2) Even if we could change this, it would not change much: these server configurations are EXTREMELY unsafe.
The solution to this is to have each site run under a different apache user, using suexec. The problem is that all the "safe" solutions are less scalable, and are not that popular, especially with shared hosting servers.
So there you have it, the complete motivation for that single line you quoted. I hope it will help people deal with this problem and communicate it with their hosting providers. I know I will
I'll be contacting Surpass Hosting about this problem and see if we can come to a good solution for all our XOOPS users hosted there...
Herko
