Hi,

Believe me if it says they are writable they are writable. If you look in the root you will probably see a file named SecurityAdvisor_someguid.txt, it deletes all the other files after it creates them but it leaves one if the root is writable, but the test writes a file to each folder and it lists the folders where it succeeded in writing a file.

See http://www.mojoportal.com/securing-the-file-system.aspx for information how to make it not writable. 

Best,

Joe

Did you see the file in the root after running the test or not?

If you see a file securityadvisortest_someguid.txt in the root then it means the root folder is writable, therefor you should believe what it says about the other folders.

Hope it helps,

Joe

It isn't the worst thing in the world if they are writable but it would be more secure if they were not. I suspect many people in shared hosting won't have the granular control to solve it. That is why I list it as just a warning with a yellow indicator instead of red. mojoPortal is designed to control where files can be written and it "should" generally be able to enforce it but, if the file system permissions can restrict it, that is much better because then you are protected from harm with an additional layer of protection even if a hacker can manage to bypass application logic somehow.

Best,

Joe

Hey everyone, just to chime in, I ran the writable folders check too and was surprised that some of our folders were coming up writable as well. Fortunately we are using our own internal servers, so it was a simple matter of removing some of the extra permissions that weren't needed, and now all is well.

Thanks a lot for providing this tool, Joe! Now we'll just need to work on creating that custom machine key and getting those hashed passwords back in. I'm sure glad these security issues came up before we went live and had a lot of users set up!

Jamie

Cool! Thanks for the heads-up, Joe. That'll make it a much easier process to change that machine key.