Re: [us...@httpd] Securing handler from direct access via URL.

2010-09-09 Thread Jefferson Ogata
On 2010-09-09 20:33, Daryl Tester wrote: This works as it should, but a side effect is that Action is exposing http:///cgi-bin/php5 to the outside world (which barfs when accessed directly). Access permissions on the cgi-bin directory appear to get propagated to the resources I'm trying to

Re: [us...@httpd] Securing handler from direct access via URL.

2010-09-09 Thread Jefferson Ogata
On 2010-09-09 21:37, Daryl Tester wrote: Yes, again, I know it's dangerous, hence the concern of my original post. Was my subject line ambiguous? Yes, inasmuch as you didn't clarify that you perceive the configuration as an actual vector for attack, rather than an aesthetically displeasing

Re: [us...@httpd] suexec for another user

2010-08-11 Thread Jefferson Ogata
On 2010-08-11 13:23, David Ricar wrote: Am I missing an obvious solution that is possible without the patch or is my view too paranoid? Mount all your content read-only. - The official User-To-User support forum of the Apache

Re: [us...@httpd] Re: recommended setup apache/php

2010-07-27 Thread Jefferson Ogata
On 2010-07-27 10:15, Nilesh Govindarajan wrote: If I understood your question properly, you're asking that /htdocs/a.php is one fastcgi app and /htdocs/b.php is another. If you want it this way, then you will have to add the shebang (#!) line to all of your scripts before ?php starts, which is

[us...@httpd] mod_filter and CGIs

2010-07-22 Thread Jefferson Ogata
Greetings. I am trying to apply INCLUDES processing selectively to CGIs depending on output content type, to no avail. Wondering if anyone else has run into this. Server is fully patched RHEL 5 x86_64 with Red Hat-provided httpd-2.2.3-43.el5. Server DefaultType is text/plain. My cgi-bin

Re: [us...@httpd] mod_filter and CGIs

2010-07-22 Thread Jefferson Ogata
On 2010-07-23 00:31, Nick Kew wrote: On Thu, 22 Jul 2010 23:45:16 + Jefferson Ogata apa...@antibozo.net wrote: I am trying to apply INCLUDES processing selectively to CGIs depending on output content type, to no avail. Wondering if anyone else has run into this. At a guess, you have