This is a placeholder for the various security issues I find in 1.0.3 and CVS versions... so far, I have:

1.) .php files do not need +x. php scripts are parsed, not executed, and they do not need to be 0777 to function properly. 0644 is sufficient, 0444 even better.

2.) Directories do not need to be 0755 as well, 0511 is perfectly sufficient for that as well. I've tested this thoroughly here and it works great.

3.) config_inc.php.sample has 'root' for the g_db_username field, and this is most-certainly going to lead users in the wrong direction. root should NEVER access mysql databases, period. Not only does it open a potential hole if the user doesn't use a different password for the connection to the Mantis db, but it dramatically slows down query speed, due to the wider permissions involved.

I'll keep beating this one up... and forward-port my fixes into 1.0.3 and contribute as necessary.