Phplist - Revision history

Marcin: /* Embedding */

2025-08-30T20:01:51Z

Embedding

← Older revision		Revision as of 20:01, 30 August 2025
Line 4:		Line 4:

	=Embedding=		=Embedding=
	<html><center><iframe src="https://phplist.opensourceecology.org/lists/?p=subscribe&id=3" width="50%" height="450"></iframe></html>		<html><center><iframe src="https://phplist.opensourceecology.org/lists/?p=subscribe&id=3" width="50%" height="450">
			</iframe></center></html>

	=Approving Members=		=Approving Members=

Marcin: /* Embedding */

2025-08-30T20:01:13Z

Embedding

← Older revision		Revision as of 20:01, 30 August 2025
Line 4:		Line 4:

	=Embedding=		=Embedding=
	<html><center><iframe src="https://phplist.opensourceecology.org/lists/?p=subscribe&id=3" width="50%" height="450"></html>		<html><center><iframe src="https://phplist.opensourceecology.org/lists/?p=subscribe&id=3" width="50%" height="450"></iframe></html>

	=Approving Members=		=Approving Members=

Marcin: /* Introduction */

2025-08-30T20:00:44Z

Introduction

← Older revision		Revision as of 20:00, 30 August 2025
Line 2:		Line 2:

	Phplist is open source email list software. When OSE adopted it in 2018 for the OSE Newsletter, it was determined to be the most feature-rich FLOSS alternative to the gold-standard paid alternative, MailChimp.		Phplist is open source email list software. When OSE adopted it in 2018 for the OSE Newsletter, it was determined to be the most feature-rich FLOSS alternative to the gold-standard paid alternative, MailChimp.

			=Embedding=
			<html><center><iframe src="https://phplist.opensourceecology.org/lists/?p=subscribe&id=3" width="50%" height="450"></html>

	=Approving Members=		=Approving Members=

Marcin: /* Links */

2025-07-25T02:33:44Z

Links

← Older revision		Revision as of 02:33, 25 July 2025
Line 485:		Line 485:

	=Links=		=Links=
			*[[OSE Mailing List Selection Criteria]]
	*[[phpList Log]]		*[[phpList Log]]
	*[[OSEmail]]		*[[OSEmail]]

Maltfield at 23:13, 12 February 2025

2025-02-12T23:13:28Z

← Older revision		Revision as of 23:13, 12 February 2025
Line 487:		Line 487:
	*[[phpList Log]]		*[[phpList Log]]
	*[[OSEmail]]		*[[OSEmail]]
			* [[CHG-2025-XX-XX_migrate_phplist_to_hetzner3]]

	[[Category: Software]]		[[Category: Software]]
	[[Category: Communications]]		[[Category: Communications]]

Maltfield: update permissions ofr Debian (instead of CentOS) since hetzner3 migration

2024-09-29T02:18:25Z

update permissions ofr Debian (instead of CentOS) since hetzner3 migration

← Older revision		Revision as of 02:18, 29 September 2024
Line 75:		Line 75:

	# Files containing passwords (ie: config.php) should be located outside the docroot with not-apache:apache-admins 0040		# Files containing passwords (ie: config.php) should be located outside the docroot with not-apache:apache-admins 0040
	# Files in the public_html/uploadimages dir should be ~~apache~~:~~apache~~ 0660		# Files in the public_html/uploadimages dir should be www-data:www-data 0660
	# All other files in the vhost dir should be not-apache:~~apache~~ 0040		# All other files in the vhost dir should be not-apache:www-data 0040
	# All other directories in the vhost dir should be not-apache:~~apache~~ 0050		# All other directories in the vhost dir should be not-apache:www-data 0050

	This is achievable with the following idempotent commands:		This is achievable with the following idempotent commands:

	<pre>		<pre>
	~~vhostDir~~="/var/www/html/phplist~~.opensourceecology.org~~"		phplist_sites="$(find /var/www/html -maxdepth 1 -type d -iname phplist)"

	chown -R not-apache:~~apache~~ "${~~vhostDir~~}"		for vhost_dir in $phplist_sites; do
	find "${~~vhostDir~~}" -type d -exec chmod 0050 {} \;
	find "${~~vhostDir~~}" -type f -exec chmod 0040 {} \;		for dir in ${vhost_dir}; do chown -R not-apache:www-data "${dir}"; done
			for dir in ${vhost_dir}; do find "${dir}" -type d -exec chmod 0050 {} \;; done
			for dir in ${vhost_dir}; do find "${dir}" -type f -exec chmod 0040 {} \;; done

			for dir in ${vhost_dir}; do [ -d "${dir}/public_html/uploadimages" ] \|\| mkdir "${dir}/public_html/uploadimages"; done
			for dir in ${vhost_dir}; do chown -R not-apache:www-data "${dir}/public_html/uploadimages"; done
			for dir in ${vhost_dir}; do find "${dir}/public_html/uploadimages" -type f -exec chmod 0660 {} \;; done
			for dir in ${vhost_dir}; do find "${dir}/public_html/uploadimages" -type d -exec chmod 0770 {} \;; done

	~~chown not-apache:apache-admins "${vhostDir}/config.php"~~		done
	~~chmod 0040 "${vhostDir}/config.php"~~

	~~[ -d "${vhostDir}/public_html/uploadimages" ] \|\| mkdir "${vhostDir}/public_html/uploadimages"~~
	~~chown -R apache:apache "${vhostDir}/public_html/uploadimages"~~
	~~find "${vhostDir}/public_html/uploadimages" -exec chmod 0660 {} \;~~
	~~chmod 0770 "${vhostDir}/public_html/uploadimages"~~
	</pre>		</pre>

Line 100:		Line 101:

	# the 'not-apache' user is a new user that doesn't run any software (ie: a daemon such as a web server) and whose shell is "/sbin/nologin" and home is "/dev/null".		# the 'not-apache' user is a new user that doesn't run any software (ie: a daemon such as a web server) and whose shell is "/sbin/nologin" and home is "/dev/null".
	# the ~~apache~~ user is in the apache-admins group		# the www-data user is in the apache-admins group
	# the ~~apache~~ user is in the ~~apache~~ group		# the www-data user is in the www-data group
	# any human users that need read-only access to the phplist vhost files for debugging purposes and/or write access to the 'public_html/uploadimages/' directory (ie: to upload large files that are too large to be handled by the web servers chain), then that user should be added to the '~~apache~~' group		# any human users that need read-only access to the phplist vhost files for debugging purposes and/or write access to the 'public_html/uploadimages/' directory (ie: to upload large files that are too large to be handled by the web servers chain), then that user should be added to the 'www-data' group
	# any human users that need read-only access to the phplist vhost files, including config files containing passwords (ie: config.php), should be added to the 'apache-admins' group		# any human users that need read-only access to the phplist vhost files, including config files containing passwords (ie: config.php), should be added to the 'apache-admins' group
	# for anyone to make changes to any files in the docroot (other than 'public_html/uploadimages/'), they must be the root user. I think this is fair if they don't have the skills necessary to become root, they probably shouldn't modify the phplist core files anyway.		# for anyone to make changes to any files in the docroot (other than 'public_html/uploadimages/'), they must be the root user. I think this is fair if they don't have the skills necessary to become root, they probably shouldn't modify the phplist core files anyway.
Line 112:		Line 113:
	# All of the files & directories that don't need write permissions should not have write permissions. That's every file in a phplist docroot except the folder "public_html/uploadimages/" and its subfiles/dirs.		# All of the files & directories that don't need write permissions should not have write permissions. That's every file in a phplist docroot except the folder "public_html/uploadimages/" and its subfiles/dirs.
	# World permissions (not-user && not-group) for all files & directories inside the docroot (and including the docroot dir itself!) should be set to 0 for all files & all directories.		# World permissions (not-user && not-group) for all files & directories inside the docroot (and including the docroot dir itself!) should be set to 0 for all files & all directories.
	# Excluding 'public_html/uploadimages/', these files should also not be owned by the user that runs a webserver (in cent, that's the '~~apache~~' user). For even if the file is set to '0400', but it's owned by the '~~apache~~' user, the '~~apache~~' user can ignore the permissions & write to it anyway. We don't want the ~~apache~~ user (which runs the apache process) to be able to modify files. If it could, then a compromised webserver could modify a php file and effectively do a remote code execution.		# Excluding 'public_html/uploadimages/', these files should also not be owned by the user that runs a webserver (in cent, that's the 'www-data' user). For even if the file is set to '0400', but it's owned by the 'www-data' user, the 'www-data' user can ignore the permissions & write to it anyway. We don't want the www-data user (which runs the apache process) to be able to modify files. If it could, then a compromised webserver could modify a php file and effectively do a remote code execution.
	# Excluding 'public_html/uploadimages/', all directories in the docroot (including the docroot dir itself!) should be owned by a group that contains the user that runs our webserver (in cent, that's the ~~apache~~ user). The permissions for this group must be not include write access for files or directories. For even if a file is set to '0040', but the containing directory is '0060', any user in the group that owns the directory can delete the existing file and replace it with a new file, effectively ignoring the read-only permission set for the file.		# Excluding 'public_html/uploadimages/', all directories in the docroot (including the docroot dir itself!) should be owned by a group that contains the user that runs our webserver (in cent, that's the www-data user). The permissions for this group must be not include write access for files or directories. For even if a file is set to '0040', but the containing directory is '0060', any user in the group that owns the directory can delete the existing file and replace it with a new file, effectively ignoring the read-only permission set for the file.

	=Configuration=		=Configuration=

Marcin: /* Approving Members */

2022-06-21T20:24:19Z

Approving Members

← Older revision		Revision as of 20:24, 21 June 2022
Line 5:		Line 5:
	=Approving Members=		=Approving Members=
	*Many members seem not to confirm their account.		*Many members seem not to confirm their account.
			*Go to user, click on their name.
			*Under 'Is this subscriber confirmed (1/0)' - type 1. But only if the next line says that they are not blacklisted (they apparently unsubscribed)

	=Posting=		=Posting=

Marcin: /* Introduction */

2022-06-21T01:12:31Z

Introduction

← Older revision		Revision as of 01:12, 21 June 2022
Line 2:		Line 2:

	Phplist is open source email list software. When OSE adopted it in 2018 for the OSE Newsletter, it was determined to be the most feature-rich FLOSS alternative to the gold-standard paid alternative, MailChimp.		Phplist is open source email list software. When OSE adopted it in 2018 for the OSE Newsletter, it was determined to be the most feature-rich FLOSS alternative to the gold-standard paid alternative, MailChimp.

			=Approving Members=
			*Many members seem not to confirm their account.

	=Posting=		=Posting=

Marcin: /* Links */

2022-06-21T00:50:50Z

Links

← Older revision		Revision as of 00:50, 21 June 2022
Line 480:		Line 480:
	=Links=		=Links=
	*[[phpList Log]]		*[[phpList Log]]
			*[[OSEmail]]

	[[Category: Software]]		[[Category: Software]]
	[[Category: Communications]]		[[Category: Communications]]

Marcin: /* References */

2021-04-17T04:18:23Z

References

← Older revision		Revision as of 04:18, 17 April 2021
Line 478:		Line 478:
	{{Reflist}}		{{Reflist}}

			=Links=
			*[[phpList Log]]
	[[Category: Software]]		[[Category: Software]]
	[[Category: Communications]]		[[Category: Communications]]