Re: BUG IN APACHE HTTPD SERVER 2.0.47/48 (to who replied me)

[Guille -bisho- <bisho () onirica com>]

> In my article, I supposed that the administrator
> permit AllowOverride FileInfo, and you, supposed that
> the admin restrict that. What happens if he permit
> AllowOverride FileInfo?
>
> The problem is, when I tested and looked at the source
> code, if the 403 or other Error document placed
> somewhere outside this current directory, it is not
> parsed in the Deny From All URL (normally, Apache
> wants). If the 403 doc placed in the current
> directory, it can be parsed (unnormally, Apache may
> not want).
>
> We don't want to prevent this by going round,
> re-configuring Apache in the other way, but by
> ensuring that Apache works well in both cases, the 403
> doc placed outside or inside the restricted directory.

Imagine one of the resellers want to forbit access to all his directory,
and he want's also to put an special error document. There is no reason
why he should add an special allow to the error file.

If the apache admin wants to disallow access of a reseller directory, he
*MUST* disable overrive also. If he doesn't, the user will still be able
to execute php files with error document. Not in that directory but
perfectly in others, imagine /tmp or something similar.

Maybe a warning could be added to the Deny rule in apache documentation,
indicating that this will not prevent access to files from errordocument
directives or other scripting languages (as PHP) that do not follow
apache deny rules.

-- 
        _     Guillermo Pérez    -=] 09/02/2004 [=-
       <·)     - bisho@ ( onirica.com | eurielec.etsit.upm.es )
       ( \>
bisho!  ""\\  ::               Say NO!!! to SW PATENTS                ::
   ..........::                 EuropeSwPatentFree:                   ::
   ::            http://europeswpatentfree.hispalinux.es/             ::