Persistent security warnings

[shrey]

All the users of the app see this persistent, security warning:

 Warning, your config file (htdocs/conf/conf.php) can be overwritten by the web server. This is a serious security hole. Modify permissions on file to be in read only mode for operating system user used by Web server. If you use Windows and FAT format for your disk, you must know that this file system does not allow to add permissions on file, so can't be completely safe. This security warning will remain active as long as the vulnerability is present.

This seems unnecessary and a bit of a nuisance to not be able to remove it.

What to do about this?

[shrey]

Also, this other warning:

 Warning, once setup is finished, you must disable the installation/migration tools by adding a file install.lock into directory /app/data/dolibarr. Omitting the creation of this file is a grave security risk. This security warning will remain active as long as the vulnerability is present.

I had removed this, by following the displayed instructions, but it seems, the install.lock got deleted automatically by Cloudron after some time/a restart.

[nebulon]

Strange I don't seem to be able to find the view in dolibarr where this would be shown. Tried a fresh installation. Can you give more instructions on how to reproduce this?

[yurikous]

I search on forum and don't find answer.
How to change permissions on files and folder.
I got this message on Dolibarr : " Warning: your configuration file (htdocs/conf/conf.php) is writable by the Web server. This represents a serious security vulnerability. Change the permissions so that it is read-only for the account under which the Web server is running, and not readable for others."

On forum I see that I have to give permission 640 but who and how ?
I try this command on dolibarr terminal in contabo without success : chmod 644 conf.php

Thanks

[girish]

@yurikous Thanks for reporting. This is a bug in the package. We are creating a new package with the fix.

[yurikous]

Okay Nice. We are waiting so... Question, if I need to change permission of a folder or file, who I can make ?

[girish]

@yurikous The file is in /run/dolibarr/conf . You can change the ownership of the file there via the Web Terminal.

[girish]

This should be fixed in the latest package.