friendica.ucy.de
Das kannst Du anklicken, dann gibt es auch keine Vorschau.Gilt das auch für die Leserinnen und Leser?
![TupambAdmin [stable]](photo/143691089764f5fb05a8b60433382539-5.png?ts=1730402034)
root and that I consider shouldn't exist as owned by root i the folder /smarty3.
<?php
/* Smarty version 4.3.1, created on 2023-11-28 03:50:02
from '7cd2693513597460a71347ba02d3179c5e5ab822' */
/* @var Smarty_Internal_Template $_smarty_tpl */
if ($_smarty_tpl->_decodeProperties($_smarty_tpl, array (
'version' => '4.3.1',
'unifunc' => 'content_6565636a645732_50647552',
'has_nocache_code' => false,
'file_dependency' =>
array (
),
'includes' =>
array (
),
),false)) {
function content_6565636a645732_50647552 (Smarty_Internal_Template $_smarty_tpl) {
?>[url=https://tupambae.org/profile/utopiarte]utopiArte[/url] replied to you on [url=https://tupambae.org/display/0ac89072-1065-6562-6405-8bb240314547]"bugreport - can't answer, like or reshare posts"[/url]<?p>
root? It should run as www-data. Same question if you're using the daemon.
helpers page wrote:
cron job for worker
If you are using a Linux server, run "crontab -e" and add a line like the one shown, substituting for your unique paths and settings:
ubuntu[/url wrote:
install tutorial]First log into the server through SSH using your root@<domain> user. Then execute the crontab edit command:
sudo crontab -e
*/5 * * * * cd /var/www/html; su -u friendica /usr/bin/php bin/worker.php
*/5 * * * * cd /var/www/html; /usr/bin/php bin/worker.phpphp command with su -u friendica*/5 * * * * cd /var/www/html; su -u friendica /usr/bin/php bin/worker.php friendica stands for.worker.php?www-data?
friendica is the name of my local node web server user. You should be writing www-data instead.
bin/composer.phar install --no-dev step?
*/5 * * * * cd /var/www/html; su -u www-data /usr/bin/php bin/worker.phpThe last worker execution was on 2023-12-22 16:25:28 UTC. This is older than one hour. Please check your crontab settings.
Implications of access by the user www-data to all friendica folders
@Friendica Support
Hi there,
the friendica helpers page describes the installation process of friendica as follows:/help/Install: wrote:
The Linux commands to clone the repository into a directory "mywebsite" would begit clone https://github.com/friendica/friendica.git -b stable mywebsite cd mywebsitebin/composer.phar install --no-dev
Make sure the folder view/smarty3 exists and is writable by the webserver user, in this case www-datamkdir -p view/smarty3 chown www-data:www-data view/smarty3 chmod 775 view/smarty3
Get the addons by going into your website folder.
cd mywebsite
Clone the addon repository (separately):git clone https://github.com/friendica/friendica-addons.git -b stable addonaskubuntu.com: wrote:
What is the www-data user?
https://askubuntu.com/questions/873839/what-is-the-www-data-user
The web server has to be run under a specific user. That user must exist.
If it were run under root, then all the files would have to be accessible by root and the user would need to be root to access the files. With root being the owner, a compromised web server would have access to your entire system. By specifying a specific ID a compromised web server would only have full access to its files and not the entire server.
I guess this observation goes both ways, a compromised friendica instalation get's access to all the friendica folders if I choose to first create/activate the www-data user, than create the friendica installation folder structure, than git clone friendica, than create the smarty3 folder and ultimately do the git clone of the addon folder as described here:
https://tupambae.org/display/0ac89072-2065-5da2-9124-8b5839853793
The order in which the creation of www-data related folders in the above case is described makes all folders and files in the friendica directory belong to www-data.
In the friendica help description first comes the git-clone, than the the smarty3 folder part than the addon git-clone. Actually I guess that last part would make the addon folder belong to www-data too if I run one command after another. Is that intended?
I wonder if this could have some kind of security implications.
I guess www-data is somehow the friendica site and has permissions to do "what ever it wants" (-> "writable by the webserver user") with all the folders in the friendica directories if it's the owner of them.
@TupambAdmin [stable]
