Web interface freezes when i open picture folder.

[86ivar]

Hi

My web interface freezes when i open the pictures folder in the web interface.
No other folder makes it freeze :S
I moved all picture files to another folder in case some files was corrupt (via samba) but it does not help. also tried to restart bubba. If i refresh the web page the web interface works again, uintil i open pictures folder.

Any ideas?

[johannes]

very strange, can you send a screenshot of where you open the pictures folder?

[86ivar]

I put a video out.
http://www.youtube.com/watch?v=L-1sCTvo ... e=youtu.be

[johannes]

wow, strange. Did you ever fiddle with the permission settings for the photo folder? What software version are you on?

[86ivar]

I updated right now, 2.5.0.2, no help. Also tried on two computers.

No but i recently added a passworded folder in the web interface:
Used this guide: http://forum.excito.net/viewtopic.php?f=8&t=1231
I checked the permisions in the web interface and its set to read and write for everyone.

[johannes]

and do you have any .htaccess file in the pictures folder? If not I'd have to log on to your box to continue digging, but since this is unheard of before and you did some fiddling yourself, I'll have to ask you to revert the changes you did and it will most likely work.

[86ivar]

I havent done anything to the pictures folder at all. I made a passworded file in the web folder, maybe its conflicting in some way? Can try deleting it.

Edit: tried now and did not help, also i noted that i could enter the passworded folder in the web interface.

[johannes]

wierd. Can you do ls -al /home/storage so I can see if anything is strange there?

[Nrde]

Just a related question. What are the "right" permissions for /home/storage/pictures folder (and its contents) ? I have 777 at the moment. I haven't been able to view my web photo album with photos in them in like 2 years, maybe because I have changed the port to be 8080?

[johannes]

Code: Select all

test@b3-demo:/home/storage$ ls -l
total 24
drwxrwsrwx 3 nobody users 4096 Nov 23  2011 Network Trash Folder
drwxrwsrwx 3 nobody users 4096 Nov 23  2011 Temporary Items
drwxrwsr-x 4 nobody users 4096 Nov 23  2011 extern
drwxrwsrwx 4 nobody users 4096 Jan 31  2012 music
drwxrwsrwx 5 nobody users 4096 Jul 25 12:23 pictures
drwxrwsrwx 3 nobody users 4096 Dec  8  2011 video

Code: Select all

test@b3-demo:/home/storage/pictures$ ls -l
total 8
drwxrwsrwx 2 test users 4096 Jun 25 18:21 from_iphone
lrwxrwxrwx 1 root users   30 Nov 10  2011 samples -> /usr/share/bubba-album/samples

[elsbernd]

IMHO of course and as a newbie, my opinion are worth 2 cents:
writable folders/files for world are a no-go on any operating system, including Linux.
It should be sufficient to have write access for group.
I personally changed these folder permissions to 775, and no problems up to now.
Is there any reason for this?

[johannes]

This is not my back yard so I hope I am right here, but 775 would mean that not-logged-in users would not be able to put their music on /home/storage/music etc, right? This is our reason, all users on the local network shall have full write access, the "family" use case, through Samba, AFP etc.

[elsbernd]

This is our reason, all users on the local network shall have full write access, the "family" use case, through Samba, AFP etc

(I don't use the WLAN-Interface, so I think, I'm not using the firewall feature of that interface.
Instead I use my B3 as a server and forward the https service from my internet router via the LAN interface to the B3.)

If anybody, including unknown, is allowed to write to the data folders, they could fill up easily the device and use it as a DOS attack. And anybody is allowed to remove and to rewrite all files too.

If you would like allow anybody to write to the data folders, it should be sufficient to have only the directories writable, and not the files too?

[johannes]

Sorry but I don't understand you here - do you let "anybody" into your home LAN? Isn't this the main problem then?

[elsbernd]

Sorry but I don't understand you here - do you let "anybody" into your home LAN? Isn't this the main problem then?

I forward HTTPS and ssh through the the router to the B3, because I want to have web and ssh access to my NAS.
There is no other access possible (through the router).

My fear is, that some security wholes within apache could be used to get access to the B3, especially, if files could be written worldwide.

rem: perhaps this should be new thread