{=
  include("docs.util");
  start_docs_page(docs.technical_manual.page_titles.security);
=}

<p>Since $PRODUCT_NAME runs as a CGI program or as a web browser, it publishes its interface to any web browser which can reach its server.  This is a powerful feature, but also introduces security issues.  $PRODUCT_NAME has a number of features which address these issues:</p>

<ol>
  <li> <p>Non-administrative users can access $PRODUCT_NAME through the profilelist (same as administrative users).  When a non-administrator is logged in, the profile list only allows users to view reports of profiles; users cannot create, edit, or delete profiles, and they cannot build, update, or modify the database of any profile.  The profile list is available at:</p>
  <pre>  http://www.myhost.com:8988/</pre>
<p>in web server mode, or</p>
  <pre>  http://www.myhost.com/cgi-bin/$PRODUCT_EXECUTABLE_DOCS</pre>
<p>in CGI mode.</p>

  <li> <p>If you wish to take it a step further, and not even present the profiles list to users, you can refer users to the reports for a particular profile:</p>
<pre>http://www.myhost.com/cgi-bin/$(PRODUCT_EXECUTABLE_DOCS).cgi?dp=reports&p=<i>profile</i>&lun=<i>user</i>&lpw=<i>password</i>
</pre>

<p>replacing <i>profile</i> with the name of the profile, <i>user</i> with the username, and <i>password</i> with the password (this should all be one one line).  Accessing this URL will show the reports for specified profile, after logging in as the specified user using the specified password.</p>

  <li> Only authorized administrators (users who know the username and password of a $PRODUCT_NAME administrator, chosen at install time) may create new profiles, and only authorized administrators may modify profiles. Without administrator access, a user cannot create a new profile, modify an existing profile in any way, or perform any other the other tasks available on the administrative interface.<p>

</ol>

<p>$PRODUCT_NAME also provides detailed control over the file and $lang_stats.directory permissions of the files and $lang_stats.directories it creates; see {=docs_chapter_link('permissions')=}.</p>

{= end_docs_page() =}