W3 Total Cache Nginx – Root Escalation
blog.tarq.io
W3 Total Cache Nginx – Root Escalation
1–10 of 22 posts
Re: W3 Total Cache Nginx – Root Escalation
#2Hi everyone, it has come to my knowledge how difficult it is to come across someone so legit for this job, I basically think we don’t need to face any more lies and deceit from our spouse, long time I was fooled but right now as far as i’m concerned about this job John[ HACKSERVICES41@GMAIL.COM] he’s real, he saved me from the lies of my cheating fiancee, he deals with any ctype of hacks such as gmail, Facebook, whatsapp, changing grades, database, software testing, instagram, skype, upgrading scores, websites, password sniffing, SQL, DB, and lots more. Mail him you got any issue he would definitely get it done, with the quickest time frame.
Re: W3 Total Cache Nginx – Root Escalation
#3Why would you ever include user owned configs in nginx?
Re: W3 Total Cache Nginx – Root Escalation
#4Why would you ever include user owned configs in nginx?
Trust me, I was just surprised as you are when I saw tutorials suggesting this.
Re: W3 Total Cache Nginx – Root Escalation
#5Huh, why does nginx even change permissions?
Re: W3 Total Cache Nginx – Root Escalation
#6Huh, why does nginx even change permissions?
In theory, to make the temp/cache directories more secure I imagine
Re: W3 Total Cache Nginx – Root Escalation
#7Huh, why does nginx even change permissions?
In theory, to make the temp/cache directories more secure I imagine
This would make sense if it created those directories, but IMHO it should fail to start if the path exists and isn't owned by www process. The function that does chown() is even called ngx_create_paths().
Re: W3 Total Cache Nginx – Root Escalation
#8Earlier quoted context omitted.
In theory, to make the temp/cache directories more secure I imagine
This would make sense if it created those directories, but IMHO it should fail to start if the path exists and isn't owned by www process. The function that does chown() is even called ngx_create_paths().
Completely agree. Time for a PR?
Re: W3 Total Cache Nginx – Root Escalation
#9Why would you ever include user owned configs in nginx?
Trust me, I was just surprised as you are when I saw tutorials suggesting this.
Because nginx AFAIK does not have something like Apache's .htaccess.
Yes, htaccess is ugly but at least a server operator can restrict the users from pwning the machine and only allow rewrite-configs.
Re: W3 Total Cache Nginx – Root Escalation
#10Earlier quoted context omitted.
Trust me, I was just surprised as you are when I saw tutorials suggesting this.
Because nginx AFAIK does not have something like Apache's .htaccess. Yes, htaccess is ugly but at least a server operator can restrict the users from pwning the machine and only allow rewrite-configs.
That is exactly the reason. and is the main difference between Apache mode and Nginx mode in W3TC. The plugin needs to be able to create URL rewriting rules on the fly, and nginx gives them no sane way to do it.
Htaccess sucks for various reasons, but most of the suck can be worked around.