TWSD-1095 - Security Alert: Command injection via cookie data
Review Request #1234 — Created Dec. 16, 2025 and submitted
| Information | |
|---|---|
| shuinvy | |
| AG | |
| rel_ag_9_4_5 | |
| TWSD-1095 | |
| Reviewers | |
| austin, evalin, jasonchou, lucille, milliechou | |
Fix file permission issue
The ticket link is:
https://arraynetworks.atlassian.net/browse/TWSD-1095We should add cookie log by PHP.
However,
There is no permission for PHP to create file under the directory/var/log/.
So I modified the shell script to create file/var/log/aproxy_cookie.logif there is not exists.
Besides,
I changed the owner tonobodyfor the user of lighttpd isnobody.
Then changed the permission to664as (rw-rw-r--)
After that, PHP can edite the file successfully.
