doc/Security of user switching support.html in passenger-5.0.0.beta2 vs doc/Security of user switching support.html in passenger-5.0.0.beta3

- old
+ new

@@ -1169,11 +1169,11 @@ </div> </div> <div class="paragraph"><p>If the answer is yes, then we cannot use this method.</p></div> <div class="paragraph"><p>The advantage of this method is that setting up Apache to run as root is incredibly easy, and requires no new framework to be written. However, testing -this method in automated unit tests will require running the unit test suit as +this method in automated unit tests will require running the unit test suite as root.</p></div> </div> <div class="sect2"> <span class="anchor_helper" id="_using_apache_8217_s_suexec"></span><h3 data-anchor="_using_apache_8217_s_suexec">2.2. Using Apache’s suEXEC</h3> <div class="paragraph"><p>Apache’s <a href="http://httpd.apache.org/docs/2.0/suexec.html">suEXEC</a> allows one to @@ -1306,10 +1306,10 @@ make a long story short: it will switch to the owner of the file <em>config/environment.rb</em>. User whitelisting/blacklisting is currently not implemented. We rely on the system administrator to set the correct owner on that file.</p></div> <div class="paragraph"><p>We have also not implemented suEXEC’s security model. suEXEC’s model is quite -paranoid, and although paranoia is good to a certain extend, it can be in the +paranoid, and although paranoia is good to a certain extent, it can be in the way of usability while proving little extra security. We are not entirely convinced that implementing suEXEC’s full security model will provide significant benefits, but if you have good reasons to think otherwise, please feel free to discuss it with us.</p></div> </div>