| Author |
|
jyanes
Newbie
Joined: 13 June 2010
Location: United States
Online Status: Offline
Posts: 1
|
| Posted: 13 June 2010 at 5:10pm | IP Logged
|
|
|
Hello i am trying out Afterlogic Community Edition. I noticed that if go to the browser and type in
http://locationofserver/webmail/data/settings/adminpanel.xml
I can see the details of the file in my browser. This of course is not desired as this file contains my admin
password and username in clear text.
Did i set something up incorrectly here? I tried remove permissions etc. but when i do that i end up with
an error on the Admin Panel page saying that it could not access the adminpanel.xml file.
any help would be appreciated.
|
| Back to Top |
|
| |
Igor
AfterLogic Support
Joined: 24 June 2008
Location: United States
Online Status: Offline
Posts: 6038
|
| Posted: 15 June 2010 at 2:16am | IP Logged
|
|
|
I believe you're absolutely right, those .XML configuration files should not be available via web browser. That's exactly why we include special Apache configuration file .htaccess in the data folder, with really simple content:
This doesn't affect loading files via filesystem, but any attempts to access the file via web browser will result in error. Not sure why it doesn't work this way in your particular case, this probably has something to do with web server configuration; AllowOverride option state should be probably rechecked. That is, of course, if you're using Apache to run the product.
--
Regards,
Igor, AfterLogic Support
|
| Back to Top |
|
| |
nickux
Newbie
Joined: 08 July 2010
Online Status: Offline
Posts: 16
|
| Posted: 08 July 2010 at 4:57am | IP Logged
|
|
|
Perhaps there should be a notification at the end of installation in order for admin to check if those XML files are retrievable over web.
Just in case his Apache installation is not set to use .htaccess or if the does not even use Apache.
I found out the same by examining the project. Perhaps it might be better to mention this during installation in red somehow, or allow administrator to have the data folder outside of the web path.
|
| Back to Top |
|
| |
Igor
AfterLogic Support
Joined: 24 June 2008
Location: United States
Online Status: Offline
Posts: 6038
|
| Posted: 08 July 2010 at 5:12am | IP Logged
|
|
|
Good point, indeed. I will forward this to the product manager. Thank you!
--
Regards,
Igor, AfterLogic Support
|
| Back to Top |
|
| |
MailBee.NET Objects 
MailBee.NET Queue 
MailBee Objects 
WebMail Pro PHP 
AfterLogic Aurora 
MailSuite Pro for Linux 
Unified Messaging Solution 
Search
Register
Login
Topic: Security Concerns
Privacy policy |
Refund policy