[wp-trac] [WordPress Trac] #10205: getmyuid() called instead of posix_getuid() in get_filesystem_method() (wp-admin/includes/file.php)

[WordPress Trac]

#10205: getmyuid() called instead of posix_getuid() in get_filesystem_method() (wp-
admin/includes/file.php)
------------------------------------+-----------------------------
 Reporter:  pgl                     |       Owner:  dd32
     Type:  enhancement             |      Status:  reopened
 Priority:  normal                  |   Milestone:  Future Release
Component:  Filesystem              |     Version:  2.8
 Severity:  normal                  |  Resolution:
 Keywords:  has-patch dev-feedback  |
------------------------------------+-----------------------------

Comment (by Dennison Williams):

 Depending on wp-admin/{plugins,themes,update}.php to be the same uid as
 the web servers process is security theater, as the user can already get
 files on the server if they have wordpress admin privs, this just prevents
 user functionality.  If the user can get php code in the server they can
 backdoor the site via existing themes owned by the webserver, but because
 of this "feature" they could also backdoor those 3 files (assuming that it
 is owned by the webserver _and_ writeable by the webserver).  Not to
 mention this "feature" is in conflict with the FS security documentation
 (http://codex.wordpress.org/Hardening_WordPress#File_Permissions).

 +1 for using the posix_getuid() method

--
Ticket URL: <http://core.trac.wordpress.org/ticket/10205#comment:23>
WordPress Trac <http://core.trac.wordpress.org/>
WordPress blogging software