Re: Bug#475737: remove otrs2 from lenny?
Hi Thomas,
On Sat, Nov 22, 2008 at 9:48 AM, Thomas Viehmann <tv@beamnet.de> wrote:
> given that there seems to be limited interest in fixing the #475737 (3
> weeks since reopen without further comments), how about removing otrs2
> from lenny?
I had sent the following reply to the list (but not to the bug) weeks
ago but I did not get an answer so far:
I agree that it is a FHS violation that will be fixed in unstable and
that we have lived with the problem in sarge and etch but I do not
agree that it is a security problem. That is why I ask for an
exception for lenny. Let me quote from the bug report:
"... every web application has read access to /etc/otrs/database.pm
which means it can create havoc in the database, install stored
procedures and so on. Every other webapp with a database has the same
problem - not only otrs. It is the duty of the local admin to make
sure that the installation is safe. I do not understand what is so
special about otrs..."
"It is not hard to modify foreign databases when it comes to webapps
that are executed by the same httpd user and BTW stored procedures are
executed in the context of the postgres user."
I am sorry that the FHS issue cannot be fixed easily but the bug
report came very late before the freeze.
Torsten
Reply to: