Correct CMOD settings for smarty3, subfolders and their users


Hi there @Friendica Support ,
this question is related to this help request:
frio theme - Service Unavailable
tupambae.org/display/0ac89072-…

I had a look at the smarty CHMOD settings and found the following:

drwxrwxr-x 3 www-data www-data 4096 Nov 8 20:23 smarty3
If I'm not wrong that's CMOD 775 (rwx|rwx|r-x) (?)

In the installation process the commands to create the smarty folders were:
www-data@VPShosting:~/html$ mkdir -p view/smarty3
www-data@VPShosting:~/html$ chmod 775 view/smarty3
see:
squeet.me/display/962c3e10-156…
tupambae.org/display/0ac89072-…
--
I looked into the subfolders and found:

rootname@VPShosting:/var/www/html/view/smarty3# ls -l
drwxr-xr-x 222 www-data www-data 4096 Nov 25 17:20 compiled => CMOD 755 (rwx|r-x|r-x) (?)
--
The folder "compiled" has a long list of sub-folders apparently each having 2 more steps of sub-folders.

rootname@VPShosting:/var/www/html/view/smarty3/compiled# ls -l
total 880

I found two types of folders, some few created on different dates strangely belonging to the user root instead of www-data, here two examples and how those two types of subfolders look like.
I guess the folders owned by root are wrong?
--------------------
drwxr-xr-x 3 root root 4096 Nov 12 04:35 00
-
rootname@VPShosting:/var/www/html/view/smarty3/compiled/00# ls -l
drwxr-xr-x 3 root root 4096 Nov 12 04:35 d4 => CMOD 755 (rwx|r-x|r-x) (?)

rootname@VPShosting:/var/www/html/view/smarty3/compiled/00/d4# ls -l
drwxr-xr-x 2 root root 4096 Nov 12 04:35 ec => CMOD 755 (rwx|r-x|r-x) (?)

rootname@VPShosting:/var/www/html/view/smarty3/compiled/00/d4/ec# ls -l
-rw-r--r-- 1 root root 675 Nov 12 04:35 00d4eca105abd94437094f3d4409477acb55526a_2.string.php => CMOD 644 (rw-|r--|r--) (?)
--------------------
drwxr-xr-x 3 www-data www-data 4096 Nov 22 20:25 01
-
rootname@VPShosting:/var/www/html/view/smarty3/compiled/01# ls -l
drwxr-xr-x 3 www-data www-data 4096 Nov 22 20:25 97 => CMOD 755 (rwx|r-x|r-x) (?)

rootname@VPShosting:/var/www/html/view/smarty3/compiled/01/97# ls -l
drwxr-xr-x 2 www-data www-data 4096 Nov 22 20:25 f2 => CMOD 755 (rwx|r-x|r-x) (?)

rootname@VPShosting:/var/www/html/view/smarty3/compiled/01/97/f2# ls -l
-rw-r--r-- 1 www-data www-data 6140 Nov 22 20:25 0197f2d4b23957a898d38870d6c6a3775da487ff_2.file.group_side.tpl.php => CMOD 644 (rw-|r--|r--) (?)


frio theme - Service Unavailable


Hi there @Friendica Support
just changed on this profile to FRIO as VIER seems to basically not perform the basic functions.

When I try to go to the settings page I get a "Service Unavailable" page.

What should I do?

friendica 2023.05 - firefox



in reply to TupambAdminOrg [2024.03]

Just checked all the 13 of 220 folders that were created as belonging to user and group root and that I consider shouldn't exist as owned by root i the folder /smarty3.

In general terms speaking I couldn't find a common property.

They refer to posts or replies by three different users.

Most refer to one specific post.

Two create a page:
Not Found
The requested item doesn't exist or has been deleted.
Request: XYZ

All were created with the theme VIER.

in reply to TupambAdminOrg [2024.03]

New error message (of FRIO) about a folder created by the user root.

I haven't found the extensive conversation about this problem with @Hypolite Petovan yet but I'm quite sure that I changed all folders to ownership of user www-data before 28th of November of the smarty folder. Actually there was another conversation about ownership of folders and I changed all folders to be owned by root except storage and view that day on 02:45hs, the new folder owned by root at /view/smarty3/compiled/ like stated below was created on 3:50hs.

As for what I remember of all the conversations this shouldn't have happened.


Service Unavailable
unable to create directory /var/www/html/view/smarty3/compiled/7c/ea/e6
Exception thrown in /var/www/html/src/Core/Renderer.php:90
Stack trace:
#0 /var/www/html/mod/photos.php(902): Friendica\Core\Renderer::replaceMacros()
#1 /var/www/html/src/LegacyModule.php(96): photos_content()
#2 /var/www/html/src/LegacyModule.php(73): Friendica\LegacyModule->runModuleFunction()
#3 /var/www/html/src/BaseModule.php(244): Friendica\LegacyModule->content()
#4 /var/www/html/src/App.php(703): Friendica\BaseModule->run()
#5 /var/www/html/index.php(52): Friendica\App->runFrontend()
#6 {main}

Console research resultrootname@VPShosting:/var/www/html/view/smarty3/compiled# ls -l
..
drwxr-xr-x 5 www-data www-data 4096 Dec 6 00:40 7b
drwxr-xr-x 3 root root 4096 Nov 28 03:50 7c
drwxr-xr-x 3 www-data www-data 4096 Nov 28 02:45 7d
..
-----------------
rootname@VPShosting:/var/www/html/view/smarty3/compiled# cd 7c
rootname@VPShosting:/var/www/html/view/smarty3/compiled/7c# ls -l
total 4
drwxr-xr-x 3 root root 4096 Nov 28 03:50 d2
rootname@VPShosting:/var/www/html/view/smarty3/compiled/7c# cd d2
rootname@VPShosting:/var/www/html/view/smarty3/compiled/7c/d2# ls -l
total 4
drwxr-xr-x 2 root root 4096 Nov 28 03:50 69
rootname@VPShosting:/var/www/html/view/smarty3/compiled/7c/d2# cd 69
rootname@VPShosting:/var/www/html/view/smarty3/compiled/7c/d2/69# ls -l
total 4
-rw-r--r-- 1 root root 710 Nov 28 03:50 7cd2693513597460a71347ba02d3179c5e5ab822_2.string.php
nano 7cd2693513597460a71347ba02d3179c5e5ab822_2.string.php
<?php
/* Smarty version 4.3.1, created on 2023-11-28 03:50:02
  from '7cd2693513597460a71347ba02d3179c5e5ab822' */
/* @var Smarty_Internal_Template $_smarty_tpl */
if ($_smarty_tpl->_decodeProperties($_smarty_tpl, array (
  'version' => '4.3.1',
  'unifunc' => 'content_6565636a645732_50647552',
  'has_nocache_code' => false,
  'file_dependency' => 
  array (
  ),
  'includes' => 
  array (
  ),
),false)) {
function content_6565636a645732_50647552 (Smarty_Internal_Template $_smarty_tpl) {
?>[url=https://tupambae.org/profile/utopiarte]utopiArte[/url] replied to you on [url=https://tupambae.org/display/0ac89072-1065-6562-6405-8bb240314547]"bugreport - can't answer, like or reshare posts"[/url]<?p>
#3 #1 #2 #4 #5 #6 @Hypolite Petovan
in reply to utopiArte

@Hypolite Petovan

So this is a "tricky" one for me as I have no idea what or how to do this.
In the helpers page:
tupambae.org/help/Install#cron…
it only states:

helpers page wrote:

cron job for worker
If you are using a Linux server, run "crontab -e" and add a line like the one shown, substituting for your unique paths and settings:

I did my installation with the help of @hankg's tutorial:
nequalsonelifestyle.com/2022/0…

ubuntu install tutorial wrote:

First log into the server through SSH using your root@<domain> user. Then execute the crontab edit command:
sudo crontab -e


How do I set this so "It should run as www-data."
??

in reply to Hypolite Petovan

As off now it was running like this:
*/5 * * * * cd /var/www/html; /usr/bin/php bin/worker.php

Your suggestion:
php command with su -u friendica
*/5 * * * * cd /var/www/html; su -u friendica /usr/bin/php bin/worker.php

What we didn't actually clarified is what friendica stands for.
Like to say, is it a "place holder", a variable for a user or application name?
Is "friendica" defined as such in worker.php?
Or would it actually be www-data?

in reply to Hypolite Petovan

@Hypolite Petovan @utopiArte In my case, php software runs with the owners id of that software, so that every application runs with it's own id, this is much more secure than the www-data for everything scheme because in that scheme one application can write over all others or even itself, not good. This way a flaw in an application can only result in damage to that application.
in reply to Nanook

learning question:
(some maybe "notes to myself to investigate")

When is that php software setting actually done?

I'm still working on that friendica for ubuntu VPS installation tutorial and at the same time (of course) starting to wonder about adding more sites, friendica or maybe other site software to the server I'm testing around with and actually just started to wonder how to separate for example two friendica instances to not use two times www-data for example. Like to get as differentiated permission and access settings as possible.

In the case of DB user and DB's themselfs that's more than obvious, but how when or where does the (in this case) www-data setting take place?

When pulling from github into the prepared (in this case) /html folder?
Or the subsequent bin/composer.phar install --no-dev step?

What happens if I try now to create a folder tree for several domains/subdomains and move/rename the existing /html folder?
There are some references in the admin panel for paths, that's kinda easy to find and change but are there more settings in the LAMP-Installation to have an eye on?

Why is it that the cron setting is the only one that doesn't have a path like the other files to edit with nano for example?

in reply to utopiArte

Still monitoring this and wondering if some setting and changes while moving the server has to do with this.
Right now there are folder structures like the mentioned created and visible in /smarty3 and /storage.

Of the two folders that have root as owner in the /smarty3 folder, there is one subfolder that exists in the /storage folder and one that doesn't.

The one that does exist in /storage and /smarty3 has the same creation date (Nov 28 2023).

It actually points right now to this very answer above:
/display/0ac89072-1165-95dc-31ec-a8a342054692

That folder contains an completely unrelated unknown avatar.

While trying to nano the file contained in the other folder right now the following message came up:
"File root is being edited by root (with nano 6.2, PID 3334); open anyway?"

Opening anyway gave an empty nano editor with something like 1/7.
Trying to leave with [ctrl-X] and [N] wasrejected and an empty nano editor with 1/2 showed up on top.
Closed the SSH window o escape this.

utterly strange

in reply to TupambAdminOrg [2024.03]

I start getting the feeling that the admin profile has or had the ability to publish as root.

There is specifically one post right now that is public where this profile commented on. That post shows up on the profile page but when this profile tries to open it or even open a notification of an answer on that post done by the admin profile a blank page get's displayed. Occasionally with a code error, occasionally with nothing at all.

This is the link of the latest notification that display a blank page:
tupambae.org/display/0ac89072-…

in reply to utopiArte

Here is the previous conversation about this where I described when and how I changed the access settings of the installation and folders.


Implications of access by the user www-data to all friendica folders


@Friendica Support

Hi there,
the friendica helpers page describes the installation process of friendica as follows:

/help/Install: wrote:

The Linux commands to clone the repository into a directory "mywebsite" would be
git clone https://github.com/friendica/friendica.git -b stable mywebsite
cd mywebsite

bin/composer.phar install --no-dev

Make sure the folder view/smarty3 exists and is writable by the webserver user, in this case www-data

mkdir -p view/smarty3
chown www-data:www-data view/smarty3
chmod 775 view/smarty3

Get the addons by going into your website folder.

cd mywebsite

Clone the addon repository (separately):

git clone https://github.com/friendica/friendica-addons.git -b stable addon


askubuntu.com: wrote:

What is the www-data user?
askubuntu.com/questions/873839…
The web server has to be run under a specific user. That user must exist.

If it were run under root, then all the files would have to be accessible by root and the user would need to be root to access the files. With root being the owner, a compromised web server would have access to your entire system. By specifying a specific ID a compromised web server would only have full access to its files and not the entire server.

I guess this observation goes both ways, a compromised friendica instalation get's access to all the friendica folders if I choose to first create/activate the www-data user, than create the friendica installation folder structure, than git clone friendica, than create the smarty3 folder and ultimately do the git clone of the addon folder as described here:
tupambae.org/display/0ac89072-…
The order in which the creation of www-data related folders in the above case is described makes all folders and files in the friendica directory belong to www-data.
In the friendica help description first comes the git-clone, than the the smarty3 folder part than the addon git-clone. Actually I guess that last part would make the addon folder belong to www-data too if I run one command after another. Is that intended?

I wonder if this could have some kind of security implications.
I guess www-data is somehow the friendica site and has permissions to do "what ever it wants" (-> "writable by the webserver user") with all the folders in the friendica directories if it's the owner of them.


@TupambAdmin [stable]


This excellent AI site enables you to put in a prompt and the genre of music you want and it will create a song for you.
I think you can even write your own lyrics in the custom section.

suno.ai

#AndroidAppRain at apt.izzysoft.de/fdroid with 7 updated and 1 added apps:

* Audire: A music identifier

At F-Droid itself, 41 updated and 2 added apps:

* ESUP-NFC-TAG-DROID: client for ESUP-NFC-TAG servers
* Fruity Game: Casual Fruit Combination Game

Enjoy your #free #Android #apps with #FDroid and the #IzzySoftRepo :awesome:

I feel a little silly: when I read about ‘gongfu tea ceremony’ in western social media, I had absolutely no idea what it was.

So I put off making tea that way. Recently I had a lightbulb moment: I sat with my grandfather, from Chaozhou, as he made tea every day and that’s probably gongfu tea, though he just called it ‘tea’. So I didn’t actually have to read about how to do it. I just had to make tea.

Today, Yunnan Sourcing’s delicious Jin Jun Mei black tea.

@tea #tea

#tea
in reply to Adrianna Tan

If I can rewrite the description for gongfu tea:

- use mainly tea leaves from Chaozhou (dancong, yashi, fenhuang oolong) tho any black tea is probably fine
- use more tea leaves than you expect
- use less water than you expect
- wash the vessels with hot water, throw it away
- throw away the first steep of water immediately
- steep for much shorter than you’d expect
- keep making small batches of tea throughout the day
- drink a lot of tea
- put on socks if you’re cold

e

If you haven't yet seen the Thanksgiving 2023 - Project Updates video from MrAlanD1, I highly recommend watching it. There's some extremely cool stuff heading our way. Also @MWTab gets a shout out for his contributions.

If you do watch it, please remember to like the video, I don't want to spoil surprises, but likes for this one are important.

秋にしか見られない赤と黄の幻想世界。

A fantasy world of red and yellow that can only be seen in autumn.

#photography #nature #art #flower #flowers # #写真 #japan #beautiful #beauty #bloomscrolling # #autumn #fall #landscape #scenery #fantasy #autumnvibes #fantasy #autumnleaves #maple #紅葉 #red #yellow

For those of you who read ebooks on smartphones, what are you using these days? Applies to both Android and iOS. I mostly still have success with VoiceDream but it is sometimes quite broken in stupid ways. Also, I know there are a few options for Android but haven't tested all of them, and with the purchase of a tiny little media player phone, I'm curious how people are doing this. I have audiobooks covered on both platforms with Book Player and Smart Audiobook Player, (though I'm still always curious what other people use), but ebooks are harder to get right. I especially want to retain the headset control that VoiceDream has—basically, I want ebooks to act like audiobooks, play in the background, respond to headset/media buttons, etc. I know EasyReader can do this, I think Speech Central also can.

VScan: Turn your smartphone into any accessibility aid you can imagine with GPT4 vision

Here comes my next idea & project. If you can think of a system & user prompt that would turn GPT 4 vision into an accessibility aid, i.e. by telling it what to look for in images and how to tell you the output, and then if you can simply do photos against these prompts using your smartphone, then you can basically turn your smartphone into a pretty wide range of accessibility tools (color detector, text reader, expiry date extractor, navigator, etc.).
I decided to try this in practice, and the results are pretty interesting! Well, you can try yourself:
github.com/RastislavKish/VScan

Note the app has been designed such that it can be easily used both for tools creation as well as standard image recognition you may be used to do with Be my AI or my Vision project, or you don't even need to be taking pictures at all, you can use the app to simply chat with GPT 4V (the model has the same textual capabilities as GPT4).
Though note there is currently no chat history review functionality nor conversation truncation when the 4k token limit of GPT 4V is exceeded, so the app is not optimized for this use-case.

There are few rough edges by now, probably the most annoying issue I'm facing on my device is that Talkback shows the braille keyboard in a reversed position i nthe session screen due to the display orientation, I need to figure out how to make CameraX adapt for the current device orientation.

But that's mostly a minor issue, the main functionality works as expected.
Any constructive thoughts and opinions on this project are very welcome, and, if you get to create some interesting accessibility tools you would like to share, I would love to hear about them!

Happy Visioning!

Peter Vágner reshared this.

There was a thread on the @framasoft forum that #PeerTube RSS feeds aren't being accepted by spotify or itunes. It mentioned some specific tags which I'm trying to resolve.

I've been using validator.livewire.io/ which doesn't report the issues with the unfixed feed.

Is there a better validator to use?

Want to become part of #ESA's science advisory structure?

The ESA Director of Science invites scientists affiliated with institutions in the ESA Member States to express their interest in being a member of the Space Science Advisory Committee (SSAC), Astronomy Working Group (AWG), or the Solar System and Exploration Working Group (SSEWG):

▶️ cosmos.esa.int/web/expression-…

#ESA #astrodon

LibreOffice Viewer for Android is back on the Google Play Store! (And is also on F-Droid.) The app lets you view documents on the go – and also has experimental editing support. But we need your help to make editing ready for everyone! 😊blog.documentfoundation.org/bl… #foss #opensource

The Tuta Team is composed of dedicated privacy activists who are working hard to protect your online data!💪

With a wide array of backgrounds and expertise we are committed to providing you with the world's most secure end-to-end encrypted email experience!🔒

This is privacy done right.🎉

Check out our new additions and get to know the crew who is fighting to make the internet a better place! 👉 tuta.com/team

#privacy #teamwork #diversity #encryption #email #postquantumcryptography

in reply to Archos

@archos A tak, co já, žejo. Já mám Spotify snad od roku 2018, ale mám doma matku, která nemá chytrý telefon, neumí ovládat počítač a vrchol technických znalostí je zasunout do rádia flashku s mp3 a zmáčknout play. 😁

S těmi filmy, to je zase další příběh. Ne všechny filmy najdeš na streamovacích platformách, a když už, tak si je nepustíš, protože geoblocking. Já jsem taková výjimka asi. 😁

:androidWave: Nevím jestli to znáte, ale já jsem to objevil celkem nedávno.
Obtainium vám umožňuje instalovat a aktualizovat aplikace přímo ze stránek jejich vydání a přijímat upozornění, když jsou k dispozici nové verze.
github.com/ImranR98/Obtainium

A truly spectacular AITA here, relevant to writers and #writing.

If "hobosexual" is not part of your vocabulary, it should be.

reddit.com/r/AmItheAsshole/com…

[ETA: Lots of folks saying this is fake. It could be, yes. But I know many authors, especially women authors, especially romance authors, who get treated exactly this way over their "silly little books."

"Enough small biz money to pay the bills" is serious business, no matter what the business is.]

This entry was edited (2 years ago)

A fun twist on the classic Breakout game: play in two windows, one of which is also a paddle.

brickception.xyz

And it's open-source, too!

github.com/pshihn/brickception

via xoxo.zone/@waxy/11146769632171…

#games

Moje dzisiejsze odkrycie: Anna's Archive: annas-archive.org/ - strona mirrorująca sci-huba, libgena, z-liba, open library i inne serwisy z pracami naukowymi i e-bookami. Cała wiedza świata w jednym miejscu.

Tu historia strony: en.wikipedia.org/wiki/Anna's_A… - istnieją zaledwie od roku, jako reakcja na zamknięcie Z-Library. Na wypadek gdyby ich też zamknięto, dużą część baz wypchnęli na torrenty.

Resulta que las parejas de ingleses vienen a España a vivir la jubilación, no se molestan en aprender el idioma ni integrarse y cuando pasa algo realmente gordo (en el peor de los casos, la muerte de uno) se encuentran solos y aislados. #QueSorpresa

euronews.com/2023/11/24/troubl…

Automating the Automatable 🤖

During the past year, we worked on automating the process of gathering data about XMPP providers. A suite of tools has been developed since, providing the ability to query properties via XMPP and through the web. 🚀

All of these tools run daily to keep the data up to date. :xmpp: Read more about automation in our latest blog post:

providers.xmpp.net/blog/2023-1…

#xmpp #providers #chat #onboarding