Folder permissions

[kilburn]

Quote:This led me to think, wouldn't it be a good idea to make the backup folder owned by someone else or only give the user read permission to the folder and the files in it, since now with 1.0.3 we have the possibility to chose which backup type users should have.

Root owned backup folder + backup archives with read permission for the user is the way to go IMHO. That said, the original developer of this functionality might have some reason to set permissions as they are, so let's see what other devs think about it...

Quote:I don't even know if this would secure the users from issues like cross site scripting and the lose of files.

XSS (Cross-Site Scripting) can not result in file loses. Your website was vulnerable to executable scripts uploading