Forums / General / Security Concerns with a multi-site, multi-database, single eZp Install

Security Concerns with a multi-site, multi-database, single eZp Install

Author Message

Eric Weik

Monday 16 February 2004 2:00:32 pm

Hi everyone,

I've been researching eZp as a CMS and CMF for a group of loosely-related sites. These sites would run on a single server, but would each have their own virtualhost, userlist, admins, etc. The general consensus from the forums and eZp documentation seems to be that in this situation, it is best to set up a single eZp installation with separate databases (and siteaccesses) for each site. However, I'm wondering if anyone who is actually doing this can highlight the places that information is leaked between sites, or tips for locking down each of the sites to keep them completely separate on the admin side.

In particular, for my evaluation, I did a manual install, and then used the setup to build all of the example sites (blog, corporate, shop, etc.) URL site access rules (mydemosite.com/blog/, mydemosite.com/blog_admin/, etc.). If I go to any of the admin sites, and select Set Up->Advanced->Templates. Under "Default template resource", I can see all of the installed site templates in the dropdown (i.e. if I'm using the /blog_admin/, I still see shop, shop_admin, gallery, etc. in the dropdown).

Are there are places where this occurs? How do others get around this?

And slightly off-topic, but this page always ways "Default template resource design/standard/templates" for me, no matter which design I have set it to. The page works correctly, it just doesn't seem to output the right path in the page.

Any input would be appreciated.

Thanks,
Eric

Bård Farstad

Tuesday 17 February 2004 2:14:01 am

What you need to do is to create two siteacceses for each of your sites. These needs to be configured with their separate database and separate storage dir ( for files, images etc ). Use filesettings to create a separate storage dir for your site ( set in both user and admin siteaccess for your site(s) ).

[FileSettings]
StorageDir=ezno/storage
CacheDir=ezno/cache

Then you should have no problem with data beeing shared between the sites. The reason that you see the different siteaccesses in your dropdowns is because it's defined in content.ini:

[VersionView]
AvailableSiteDesignList[]
AvailableSiteDesignList[]=admin

When you have configured this there should be no sharing of data between the sites. This is also recommended if you e.g. use a PHP Accelerator which will have less code to cache in memory ( since you only have one eZ publish installation ).

--bård

Documentation: http://ez.no/doc

Olav Lillebø

Friday 23 April 2004 3:55:35 am

I do not understand Bård's reference to content.ini here. If we look into the design/standard/templates/setup/templateview.tpl it seem that the dropdown-options is fetched from SiteAccessSettings in site.ini.append etc. Ref. code-sample.

<select name="CurrentSiteAccess">
{section name=SiteAccess loop=ezini('SiteAccessSettings','AvailableSiteAccessList')}
    {section show=eq($current_siteaccess,$:item)}
        <option value="{$SiteAccess:item}" selected="selected">{$:item}</option>
    {section-else}
        <option value="{$SiteAccess:item}">{$:item}</option>
    {/section}
{/section}    
</select>

If we remove one of the AvailableSiteAccessList-entries, then the dropdown will be shorter, but the site will also be unavailable.
If we have multiple sites on one ez-installation, the resultof this seem to be that one sites admin-user will be able to change/override templates for other sites.

Input would be great

Olav..

eZ debug

Timing: Jan 18 2025 15:07:53
Script start
Timing: Jan 18 2025 15:07:53
Module start 'content'
Timing: Jan 18 2025 15:07:54
Module end 'content'
Timing: Jan 18 2025 15:07:54
Script end

Main resources:

Total runtime0.7779 sec
Peak memory usage4,096.0000 KB
Database Queries196

Timing points:

CheckpointStart (sec)Duration (sec)Memory at start (KB)Memory used (KB)
Script start 0.00000.0055 587.9766180.8047
Module start 'content' 0.00550.6555 768.7813591.2656
Module end 'content' 0.66110.1168 1,360.0469336.7188
Script end 0.7778  1,696.7656 

Time accumulators:

 Accumulator Duration (sec) Duration (%) Count Average (sec)
Ini load
Load cache0.00430.5526210.0002
Check MTime0.00150.1988210.0001
Mysql Total
Database connection0.00080.100810.0008
Mysqli_queries0.707890.99151960.0036
Looping result0.00180.23321940.0000
Template Total0.750796.520.3753
Template load0.00260.339420.0013
Template processing0.748096.154620.3740
Template load and register function0.00010.012610.0001
states
state_id_array0.00070.092810.0007
state_identifier_array0.00090.117020.0005
Override
Cache load0.00220.2843270.0001
Sytem overhead
Fetch class attribute can translate value0.00110.140640.0003
Fetch class attribute name0.00100.129550.0002
XML
Image XML parsing0.00150.192040.0004
class_abstraction
Instantiating content class attribute0.00000.001050.0000
General
dbfile0.00360.4643340.0001
String conversion0.00000.000930.0000
Note: percentages do not add up to 100% because some accumulators overlap

CSS/JS files loaded with "ezjscPacker" during request:

CacheTypePacklevelSourceFiles
CSS0extension/community/design/community/stylesheets/ext/jquery.autocomplete.css
extension/community_design/design/suncana/stylesheets/scrollbars.css
extension/community_design/design/suncana/stylesheets/tabs.css
extension/community_design/design/suncana/stylesheets/roadmap.css
extension/community_design/design/suncana/stylesheets/content.css
extension/community_design/design/suncana/stylesheets/star-rating.css
extension/community_design/design/suncana/stylesheets/syntax_and_custom_tags.css
extension/community_design/design/suncana/stylesheets/buttons.css
extension/community_design/design/suncana/stylesheets/tweetbox.css
extension/community_design/design/suncana/stylesheets/jquery.fancybox-1.3.4.css
extension/bcsmoothgallery/design/standard/stylesheets/magnific-popup.css
extension/sevenx/design/simple/stylesheets/star_rating.css
extension/sevenx/design/simple/stylesheets/libs/fontawesome/css/all.min.css
extension/sevenx/design/simple/stylesheets/main.v02.css
extension/sevenx/design/simple/stylesheets/main.v02.res.css
JS0extension/ezjscore/design/standard/lib/yui/3.17.2/build/yui/yui-min.js
extension/ezjscore/design/standard/javascript/jquery-3.7.0.min.js
extension/community_design/design/suncana/javascript/jquery.ui.core.min.js
extension/community_design/design/suncana/javascript/jquery.ui.widget.min.js
extension/community_design/design/suncana/javascript/jquery.easing.1.3.js
extension/community_design/design/suncana/javascript/jquery.ui.tabs.js
extension/community_design/design/suncana/javascript/jquery.hoverIntent.min.js
extension/community_design/design/suncana/javascript/jquery.popmenu.js
extension/community_design/design/suncana/javascript/jScrollPane.js
extension/community_design/design/suncana/javascript/jquery.mousewheel.js
extension/community_design/design/suncana/javascript/jquery.cycle.all.js
extension/sevenx/design/simple/javascript/jquery.scrollTo.js
extension/community_design/design/suncana/javascript/jquery.cookie.js
extension/community_design/design/suncana/javascript/ezstarrating_jquery.js
extension/community_design/design/suncana/javascript/jquery.initboxes.js
extension/community_design/design/suncana/javascript/app.js
extension/community_design/design/suncana/javascript/twitterwidget.js
extension/community_design/design/suncana/javascript/community.js
extension/community_design/design/suncana/javascript/roadmap.js
extension/community_design/design/suncana/javascript/ez.js
extension/community_design/design/suncana/javascript/ezshareevents.js
extension/sevenx/design/simple/javascript/main.js

Templates used to render the page:

UsageRequested templateTemplateTemplate loadedEditOverride
1node/view/full.tplfull/forum_topic.tplextension/sevenx/design/simple/override/templates/full/forum_topic.tplEdit templateOverride template
2content/datatype/view/ezimage.tpl<No override>extension/sevenx/design/simple/templates/content/datatype/view/ezimage.tplEdit templateOverride template
3content/datatype/view/ezxmltext.tpl<No override>extension/community_design/design/suncana/templates/content/datatype/view/ezxmltext.tplEdit templateOverride template
7content/datatype/view/ezxmltags/paragraph.tpl<No override>extension/ezwebin/design/ezwebin/templates/content/datatype/view/ezxmltags/paragraph.tplEdit templateOverride template
2content/datatype/view/ezxmltags/line.tpl<No override>design/standard/templates/content/datatype/view/ezxmltags/line.tplEdit templateOverride template
3content/datatype/view/ezxmltags/literal.tpl<No override>extension/community/design/standard/templates/content/datatype/view/ezxmltags/literal.tplEdit templateOverride template
1pagelayout.tpl<No override>extension/sevenx/design/simple/templates/pagelayout.tplEdit templateOverride template
 Number of times templates used: 19
 Number of unique templates used: 7

Time used to render debug report: 0.0001 secs