vena/Greyhole — comment on commit 0ca7a97a0ef508711e295171ab4e836b464f99fe
File: includes/common.php line 77
By gboudreau:

Since Greyhole is executed as root, I think it should at least make sure the file it's about to execute isn't writable by anyone but root, with something like:
```

$ok_to_execute = FALSE;
if (is_executable($file)) {
$perms = fileperms($file);

// Not user-writable, or owned by root
$ok_to_execute = !($perms & 0x0080) || fileowner($file) === 0;

// Not group-writable, or group owner is root
$ok_to_execute &= !($perms & 0x0010) || filegroup($file) === 0;

// Not world-writable
$ok_to_execute &= !($perms & 0x0002);
}
$contents = $ok_to_execute ? shell_exec(escapeshellcmd($file)) : file_get_contents($file);
```