[Xitami] PHP/Alias Issues

[Paul Reid]

> the way this thing works is there are some config folders I don't
> want people monkeying around with located under IlohaMail,

1) Use Apache. Apache's "alias" is -much- more powerful than
Xitami's. Iloha took advantage of Apache's power, but that leaves
non-Apache users in a bind. FWIW, you can run Xitami and Apache on
the same machine, with different port or IP numbers. I have a
PPro-200 hosting about four different web-servers as well as email
and streaming audio.

2) Wait for the "configurable folders" "bug" on IlohaMail's buglist
to be resolved. There is no reason the app can't keep the public
pages in the public folders and the secret files in non-public
space. But he didn't. He should and it is on his buglist. (And his
code is very well commented. It might be trivial to add folder-opts
and give it to the Iloha community.)

3) Leave the config files out in the open. Surely you don't give
strangers write-permission. Reading is a modest security risk. Yes,
it keeps passwords but not as plaintext: $passkey="6FMKHnEBylfEYg"
email_address:cKJlzWRAcmNpQnJ1cGdlcnMuZWR2 I have not studied what
happens when you use POP Cache-- that might leave messages out in
the open.

4) use the DataBase option. If I understand that, all user-secrets
are then held out in a SQL database with the usual protections.

 -PRR