Installing ZB BLOCK with Osclass

[cyrano]

I know chmod 

Just want to know why.

I've had someone look over the code. The review isn't very good. This was one point that would keep me from installing it. Any directory set 0777 is very dangerous.

Could it be that the "vault" directory is some kind of honeypot idea?

[Aficionado]

I know chmod 

Just want to know why.

I've had someone look over the code. The review isn't very good. This was one point that would keep me from installing it. Any directory set 0777 is very dangerous.

Could it be that the "vault" directory is some kind of honeypot idea?

Ok, then do not install it. Vault has all the data and the logs. ZBBLOCK doesn't work with anykind of honeypot.

ZBBLOCK is related with many highly respected security forums and software. The guy who "looked at the code" doesn't know what he is talking about.

[Aficionado]

I know chmod  Any directory set 0777 is very dangerous.

Just checked mine, and ZBBLOCK runs with 755 and 644. For 8+ months now. Apparently i changed it back to my defaults.

[cyrano]

The guy who "looked at the code" doesn't know what he is talking about.

He's been a sec pro only for about 20 years or so...

Tell me, what use is this:

Code: [Select]

// place .htaccess and lock dir
if (!file_exists($directory."vault/.htaccess")){
mkdir($directory."vault", 0777);
chmod($directory."vault", 0777);
copy($directory."install.htaccess",$directory."vault/.htaccess");
}

[Aficionado]

The guy who "looked at the code" doesn't know what he is talking about.

He's been a sec pro only for about 20 years or so...

Tell me, what use is this:

Code: [Select]

// place .htaccess and lock dir
if (!file_exists($directory."vault/.htaccess")){
mkdir($directory."vault", 0777);
chmod($directory."vault", 0777);
copy($directory."install.htaccess",$directory."vault/.htaccess");
}

Dude, do not waste my time if you have no idea what you are talking about.

You don't like ZBBLOCK, then don't use it.

Good Luck.

[dev101]

I also think that 0777 is not right. Manually changed it to 0700 and works fine for me. The reason why it defaults to 777 is probably due compatibility reasons and not properly set various servers, so the authors simply wish to avoid initial screams like "it's not working!".

Ragards

[dev101]

Tell me, what use is this:

It means that vault is locked for everyone, 777 doesn't really matter. It works only on apache, though.

Regards

[cyrano]

I also think that 0777 is not right. Manually changed it to 0700 and works fine for me. The reason why it defaults to 777 is probably due compatibility reasons and not properly set various servers, so the authors simply wish to avoid initial screams like "it's not working!".

Ragards

I've tried to install it. Despite the setup finishing with a great big Done! no vault was created, nothing was installed. So I couldn't check any further.

Today I installed in a directory that has 0777 as permissions. The vault gets created and remains at 0777 after install.

I also checked the docs. No mention of permissions, or a need to change those as far as I could see.

I checked the setup script. Nothing to reset permissions after creation.

Do your own tests. Draw your own conclusions...

[dev101]

Your server is not properly configured, this has nothing to do with ZBB or any other script for that matter. You need to contact your hosting to resolve it, if you can't or don't know how.

Regards

[Aficionado]

I also think that 0777 is not right. Manually changed it to 0700 and works fine for me. The reason why it defaults to 777 is probably due compatibility reasons and not properly set various servers, so the authors simply wish to avoid initial screams like "it's not working!".

Ragards

I've tried to install it. Despite the setup finishing with a great big Done! no vault was created, nothing was installed. So I couldn't check any further.

Today I installed in a directory that has 0777 as permissions. The vault gets created and remains at 0777 after install.

I also checked the docs. No mention of permissions, or a need to change those as far as I could see.

I checked the setup script. Nothing to reset permissions after creation.

Do your own tests. Draw your own conclusions...

We have already. ZBBLOCK is installed BY DEFAULT by some Hosting Companies to protect their customers. I guess THEY KNOW better than all of us.

There is no reason to continue this ZBBLOCK bashing of yours. As i said, skip it, and go on with your Osclass website.

[Aficionado]

I also think that 0777 is not right. Manually changed it to 0700 and works fine for me. The reason why it defaults to 777 is probably due compatibility reasons and not properly set various servers, so the authors simply wish to avoid initial screams like "it's not working!".

Ragards

I posted the Author's reply a few post above:

http://www.spambotsecurity.com/forum/viewtopic.php?f=27&t=846

The Folder permissions are 755 and 644 for files for Osclass and Wordpress. That should also have the ZBBLOCK folders.

BUT it depends on the Hosting Companies and how php is configured (And if the same user that owns the files also executes through php, then go with 755 and 644 respectively). For me, under CloudLinux and LiteSpeed server everything works great, just great with 755 and 644.

[dev101]

Thanks, as I said above, at least for users on Apache and Apache-compatible servers that read htaccess files, it doesn't really matter if it is 777, nobody can access it. Just test it, if you do not believe it. The issue that cyrano has can be solved by manually reverting perms to right values after installation, but it should contact hosting anyway to resolve this, or change the hosting altogether.

Regards

[cyrano]

It's Apache 2, running the latest php...

It's a secure server, not a hosting account and it also has about 40 or so other php apps running well. All files belong to www-data. And that's Apache. It'll probably work if I set it's webroot to 777.

But there is still no error catching of any kind in the installer. It reports success when it's failed...

And things fail clearly. Only three of the seven install methods' pics load.

I'm sorry but the argument that he can't set permissions correctly because he's using Windows, doesn't cut it. He's not obliged to use Windows. Besides, some links in the meager doc section still point to a dyn dns account...

This should be in the readme, manual AND install web page. Or at least in one of them.

[dev101]

Issues like this should be posted in zb forums, where authors can read it. I am afraid here it will not be read by those who should.

Your server's setup is not compatible for some reason and since, as you say, there is no clue about possible errors, you have to trace it manually, which takes time and knowledge. Given that you have many apps that run well does not guarantee that every script will.

Regards

[cyrano]

I know. Might call me simple, but I don't invest much time in apps that don't provide any clues when they fail.

And I don't mind manually chmodding a cache folder, or something. But 90% of installers out there don't need that anymore.

I'm constantly on the lookout for good software we can offer to our users, without creating a support nightmare. OSclass is probably next on the list. Currently we offer Joomla, SPIP, Koken, Magento and Epesi. And sometimes Drupal, but only with custom developed solutions we can't do any other way.

I would also gladly have put some effort in this anti-spam script. It's not for the enduser anyway. But without any decent documentation, an installer that seems to date back to the previous millennium and errors on our test server, I really don't see the point.

We have no real problems with spam. Even on the now public OSclass testsite I've only had to deal with a small group of Russian and Bulgarian spammers and they have already given up. I don't even use gaptcha's. And I'm afraid this script will probably take more time than it frees up.

People who have a high spam count on shared hosting might see it otherwise, though. They haven't got 35 solutions to choose from...