Is SimplePHPBlog a secure blogging engine?

Posted by authentictech on Pro Webmasters See other posts from Pro Webmasters or by authentictech
Published on 2011-02-25T21:39:11Z Indexed on 2011/02/25 23:33 UTC
Read the original article Hit count: 434

Filed under:

security

|

blog

|

simple-php-blog

Has anyone used the blog engine SimplePHPBlog? It is a simple blog engine that uses only text files (no database).

My problem with it is that the content directory where the texts files are stored appears to require being world writeable/readable (i.e. permission 777) for it to work. This means anyone can access the text files with a browser! These text files include the blog/comment poster's IP and email address!

This is not secure or good practice, right?

© Pro Webmasters or respective owner

Related posts about security

sudo apt-get update errors

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
Here is what I get on my terminal when running sudo apt-get update errors. I dont know if the issue is from my sources.list or my proxy setup(have not made any changes to proxies). Thank you for any help in advanced. Ign http://security.ubuntu.com oneiric-security Release.gpg Ign http://security… >>> More
The Security-Developer Gap: Why IT Security Can't Fix Your Security Problems Alone

as seen on Devx - Search for 'Devx'
Two well-known white hats explain how hackers take advantage of security holes left by enterprise application developers. >>> More
The Security-Developer Gap: Why IT Security Can't Fix Your Security Problems Alone

as seen on Internet.com - Search for 'Internet.com'
Two well-known white hats explain how hackers take advantage of security holes left by enterprise application developers. >>> More
StackOverFlowError while creating Mac object on AS400/Java

as seen on Stack Overflow - Search for 'Stack Overflow'
Hello all, I am a newbie to AS400-Java programming. I am trying to create my first program to test the implementation of Message Authentication Code (MAC). I am trying to use the HMACSHA1 hash function. My (Java 1.4) program runs fine on a dev box (V5R4).But fails terribly on the QA box (V5R3). My… >>> More
Google App Engine - Spring Security Issue (java.security.AccessControlException)

as seen on Stack Overflow - Search for 'Stack Overflow'
I'm currently getting the AccessControlException below when I deploy to app engine (I don't see it when I run in my local environment). I'm using GAE 1.3.1, Spring 3.0.1, and Spring Security 3.0.2. Any ideas how to get around this issue? It appears to be an issue with Spring Security trying to get… >>> More

Related posts about blog

RSS Feeds currently on Simple-Talk

as seen on Simple Talk - Search for 'Simple Talk'
There are a number of news-feeds for the Simple-Talk site, but for some reason they are well hidden. Whilst we set about reorganizing them, I thought it would be a good idea to list some of the more important ones. The most important one for almost all purposes is the Homepage RSS feed which represents… >>> More
Maintaining shared service in ASP.NET MVC Application

as seen on ASP.net Weblogs - Search for 'ASP.net Weblogs'
Depending on the application sometimes we have to maintain some shared service throughout our application. Let’s say you are developing a multi-blog supported blog engine where both the controller and view must know the currently visiting blog, it’s setting , user information and url generation service… >>> More
Blog Posts - Smart Tips on How to Optimize Your Blog Posts For Google

as seen on Ezine Articles - Search for 'Ezine Articles'
There are so many informative blogs in the online arena today. Sadly, not all of them are getting the kind of attention they deserve. One of the reasons is because their content is not properly optimized. SEO blog writing doesn't need to be a complicated task. Here's an easy... >>> More
Why is django giving me an attribute error when I call _set.all() for its children models?

as seen on Stack Overflow - Search for 'Stack Overflow'
I have two models defined from django.db import models class Blog(models.Model): title = models.CharField(max_length=144) @property def posts(self): self.Post_set.all() class Post(models.Model): title = models.CharField(max_length=144) text = models.TextField() … >>> More
Blog - BlogPost - BlogPostComment vs Blog - Post - Comment

as seen on Stack Overflow - Search for 'Stack Overflow'
Don't really know how to formulate the title, but it should be pretty obvious from the example. More specifically, what rules do you use for naming "dependent" classes. For example, Blog is a pretty descriptive name itself, but how do I deal with posts? BlogPost or Post? Clearly, first name clearly… >>> More