Security is always important, but who takes care of session and tmp directories creation?
The default "ibay profile" (which is an hidden/undocumented feature used by migration) is a bit overloaded.
Is it the time to design a new one just for PHP webapps?
May it be useful to expose that concept on the "Shared Folder" page and ask the admin to specify the "purpose" of the Shared Folder at creation time?
File sharing and PHP web applications are two very different scenarios. Both require different filesystem permissions, and different Apache configurations. Probably web apps don't need the ACL mess-up at all, but Samba shares do.
I think we should design new Shared folder profiles to serve different use cases. The one-fit-all configuration for shared folders is too hard to develop/maintain.
Moreover, as I said on the other thread, a new server manager page to configure virtual hosts could simplify the actual interface.