G2 Security Issue after upgrade
|
dgwyn
Joined: 2005-01-28
Posts: 6 |
Posted: Sun, 2005-02-20 23:29
|
|
I upgraded with a nightly build and now can't get into my gallery at all. I've tried wiping out everything and still get this error message. I'm at 8.14 and there are no errors reported when I install the upgrade. Security Violation The action you attempted is not permitted. ---- |
|
Posts: 8601
hm, that's a misleading subject.
anyway, try clearing cookies in your browser.
also try lib/tools/test/index.php FlushCache test.
either of those work?
Posts: 36
i have the same problem. is there a solution?
Posts: 164
I have this same "Security Violation" problem after installing the 4-4 build. I did a fresh install with the nightly snapshot and created a new DB table to start everything over.
I also ran the lib/tools/test/index.php test that mindless suggested. It asked me for my password then I get :
Error (ERROR_BAD_PARAMETER)
* in modules/core/classes/helpers/GalleryEntityHelper_simple.class at line 50 (gallerystatus::error)
* in modules/core/classes/GalleryCoreApi.class at line 2092 (galleryentityhelper_simple::loadentitiesbyid)
* in init.inc at line 149 (gallerycoreapi::loadentitiesbyid)
* in lib/tools/test/index.php at line 31
* in lib/tools/test/index.php at line 11
Same error I get when I tried to access the site.
I read all the security violation posts I could find. The only one that had any decent info talked about having the wrong layout trying to load or something like that.....??????
Any help would be appreciated!
Posts: 8601
KAC, what do you get for:
select g_parameterName, g_parameterValue from g2_PluginParameterMap where g_pluginId='core' and g_parameterName like 'id%';
Posts: 164
mindless,
I'm sorry but by the time I saw your post here, I had already fixed my problem so I didn't get a chance to test what you suggested.
I would like to explain what I found and how I fixed it because it does lead me to another question.
Well, I have the G2 gallery in a subfolder such as:
/domain/public_html/g2gallery/
with the pictures actually stored outside the "public_html" folder at
/domain/g2files
Well when I upgraded to the 4-4 snapshot, I deleted everything in /domain/public_html/g2gallery/. I also deleted the database table and created a new one so I could start from scratch.
I discovered that when I originaly installed Gallery, it created some folders inside /domain/g2files/ called "locks", "smarty", "album" etc.
The problem was that I could not delete or overwrite them because they were not originally installed/created as MY user name, they were installed/created by username "Apache". Therefore, I did not have rights to overwrite them when I added the new 4-4 build.
I found this out after speaking to my host provider who WAS able to delete those folders. Before my host deleted those folders for me, I was able to see in the file manager of my directadmin page that those folders were indeed owned by user "Apache".
After the host deleted all the folders owned by user Apache", I created a new "g2files" folder, re-ran the install of G2 and all was well.
My question is, why does gallery install/create those folders as user "Apache" instead of my user name?
The host refered to the problem as "a software bug issue on your end".
I noticed that after installing the new build, all the subfolders of "g2files" are owned again by user "Apache" so this could pose a problem for me in the future.
Am I perhaps doing something wrong or is this indeed a G2 problem? What do you think?
Posts: 32509
We do this intentionally, i.e. there's no way this could be done without using the apache user. (everything could be stored in the database, but there are various reasons why this is not a viable solution.)
Gallery lets you add images from the web browser, and various other sources. When you add an image, it must be stored on the webserver. All files on a computer have an owner. I'm not speaking of the owner in the Gallery application, I'm speaking of the owner on the filesystem level.
The webserver (apache) runs under the webserver user, which is in this case "Apache". And if you add an image in G2, it is added by a script (Gallery2) that runs in the context of the webserver. That's why all files generated by Gallery2 are owned by the user that executes the webserver (or php for php-cgi). And this user is "Apache".
So, this is not a bug. The only way all files in g2data could be owned by your user would be, if the hosting partner would use php-cgi + (php)SuExec instead of mod_php.
Posts: 164
Thanks for the info valiant. I just wanted to make sure it wasn't something stupid I was doing. I feel bad bugging my host for help deleting files all the time. All the tests I've been doing with the Mambo/G2 integration has me bugging them a couple of times a week cuz Mambo does the same thing....creates files as user Apache.
I'll mention the php-cgi + (php)SuExec instead of mod_php thing you suggested.
BTW, I noticed the 4-4 build install and admin pages run MUCH better now than the old early February build I had. Nice job!
Posts: 32509
When you mention the php-cgi thing when talking to your host, they will tell you why they're not using it (mostly because of performance). I wouldn't ask them to offer php-cgi hosting. Either they do, or they don't...
Most probably you could delete/empty your g2data folder yourself.
Either with a filebrowsing tool in your domain control panel if something like that exists. Or by using a php script that deletes the files.
Posts: 8601
KAC, see the G2 FAQ for how to delete files created by php.
Posts: 164
sAAAAweeEEEET!!
I found cleanup.php
:D
Thanks for pointing me there.