>Number:         18529
>Category:       pkg
>Synopsis:       Squirrelmail data directory must be owned by web server
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    pkg-manager
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Oct 04 07:44:00 PDT 2002
>Closed-Date:
>Last-Modified:
>Originator:     Hauke Fath <hf@tangro.de>
>Release:        NetBSD 1.6_STABLE
>Organization:
Tangro GmbH -- does not speak for me and vice versa.
>Environment:
	
	
System: NetBSD jump 1.6_STABLE NetBSD 1.6_STABLE (JUMP) #0: Thu Oct 3 01:53:38 CEST 2002 hf@jump:/usr/src/sys/arch/i386/compile/JUMP i386
Architecture: i386
Machine: i386
>Description:
	Squirrelmail stores user specific data in
	/var/spool/squirrelmail/data which is unconditionally
	chowned/chgrped to 'nobody'.

	Since this data is written by whatever user the webserver runs
	as, the directory has to be owned by e.g. {APACHE_USER} /
	{APACHE_GROUP}.


>How-To-Repeat:
	Install Squirrelmail and wonder why preferences are rejected
	with an error message.

>Fix:

# $NetBSD: Makefile,v 1.25 2002/09/16 10:07:39 martti Exp $

[...]	

OWN_DIRS=               ${DATADIR}
OWN_DIRS+=              ${SMDIR} ${SMDIR}/config
OWN_DIRS_PERMS=         ${ATTACHMENTS_DIR} ${ROOT_USER} nobody 730
OWN_DIRS_PERMS+=        ${USER_PREFS_DIR} nobody nobody 755

Substitute 'nobody' with the appropriate make variable.
>Release-Note:
>Audit-Trail:
>Unformatted: