http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14564 --- Comment #2 from Mirko Tietgen <mirko@abunchofthings.net> --- Created attachment 41092 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=41092&action=edit Bug 14564 -- Export configuration: Unfortunately, no backups are available Configuration files are not shown in the export data tool due to file ownership/ permissions. Test plan: To reproduce: - check file permissions on the server in /var/spool/koha/sitename/ config files have root:root and 600 - try to use the export tool to download configuration files: they are not available Then - apply patch - use koha-dump - check file permissions for config files, should be root:$site-koha and 640 now - try to use the export tool to download configuration files: they should be available for download now -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14564 --- Comment #4 from Robin Sheat <robin@catalyst.net.nz> --- (In reply to Mirko Tietgen from comment #3)

Not sure if this was intended for security reasons, but then we cannot offer to download the config files via staff client then.

Maybe this could also go to commandline tools, but the broken functionality is in tools.

I don't remember the reasoning behind this. I think it was that when we built it, it wasn't possible to download configuration. I'm also not sure how I feel about downloading the config in general, it can have things like SSL keys and what not that probably should be protected more than usual. Bit I'm open to opinions. -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14564 --- Comment #6 from Robin Sheat <robin@catalyst.net.nz> --- (In reply to Mirko Tietgen from comment #5)

I think there is rarely use for a hosting client to download the configuration, you can't just use it on a different server.

On the other hand, it requires <backup_conf_via_tools>1</backup_conf_via_tools> in the config and is not available by default, so I'd say it is protected more than usual. There may be use cases for it.

Yeah, I think you're right. My thinking is that we shouldn't open up the permissions by default though as they do contain things that we'd not like people to see. On the other hand, if they get to a point where they can download that file, we probably have bigger problems anyway. But it still could contain SSL keys that they wouldn't otherwise have permissions to get. -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14564 --- Comment #8 from Robin Sheat <robin@catalyst.net.nz> --- I think that pretty much jibes with my opinion. No point removing it, people may have cause to use it, but documenting that it's going to be more than just flicking an option if you want to use it. -- You are receiving this mail because: You are watching all bug changes.

http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14564 --- Comment #10 from Robin Sheat <robin@catalyst.net.nz> --- (In reply to Mirko Tietgen from comment #9)

Where should the additional information go? koha-conf.xml? It looks like the whole thing (export of db and conf) is not documented in the manual.

If we're really keen we could create a man page: koha-conf.xml(5) that describes what can go in there. -- You are receiving this mail because: You are watching all bug changes.