matomo-org / matomo-org/plugin-SecurityInfo
Check for upload_tmp_dir maybe broken
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 24
- Forks
- 17
- Avg merge
- 13h 14m
- Merged PRs (30d)
- 5
Description
DocumentRoot /var/www/piwik
upload_tmp_dir /var/www/piwik_tmp (0700)
phpsecinfo.com says "Pass
upload_tmp_dir is enabled, which is the recommended setting. Make sure your upload_tmp_dir path is not world-readable
Current Value: /var/www/piwik_tmp/
Recommended Value: A non-world readable/writable directory
More information »".
SecurityInfo says "unable to retrieve file permissions on upload_tmp_dir".
So the SecurityInfo does not check the return-codes/-infos from phpsecinfo.com properly or the implementation differs from phpsecinfo.com. This is confusing and should be corrected and more documented for minimum debugging purpose. Thanks.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the SecurityInfo handling of the upload_tmp_dir check and compare its result and permission reporting with the referenced phpsecinfo.com behavior. Confirm the expected handling for an unreadable permission result, then update the check and its documentation so the reported status and debugging guidance are consistent.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100