Re: htaccess with apache

[Tim Greer <chatmaster () charter net>]

On Tue, 2003-11-04 at 05:49, Graham Lally wrote:
> Hi,

> You'll want to filter lots after that, although the easiest way is to 
> restrict the template name to valid characters, and remove everything 
> else. The regexp on the page is:
>
>       /^[\w\-\.]*$/
>
> So if template doesn't match that, something's wrong.

I also recommend making sure the file ends with a specific file
extension, so only certain HTML or template (or text) files can be open:

/^[\w\-\]*\.(html?|txt|tmpl)$/i  (for example--and you likely don't need
to capture those values, so use '?:' there)

> MORE IMPORTANTLY,
> /etc/passwd shouldn't be readable by the CGI server!

Sure it should be!  The default permissions (that are safe too) are 644
for this file.  Are you thinking of shadow or master.passwd???
-- 
Tim Greer <chatmaster () charter net>