secure.pod - security implications of BSE
your document tree needs to be writable by the user that the CGI scripts run as to allow regeneration from the web. If there are any security issues in the code (none are known) it may be possible to write other data to these directories.
Possible solution: always regenerate from the command-line using gen.pl.
it's possible to disable the signing of the emails containing orders sent to the shop owner. This makes it impossible to tell the difference between an order from the site and a forgery.
Possible solution: check the site for each order.
Tony Cook <tony@develop-help.com>
$Revision$