DO NOT REPLY [Bug 14206] New: - DirectoryIndex circumvents -FollowSymLinks option

[bu...@apache.org]

DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG 
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://nagoya.apache.org/bugzilla/show_bug.cgi?id=14206>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND 
INSERTED IN THE BUG DATABASE.

http://nagoya.apache.org/bugzilla/show_bug.cgi?id=14206

DirectoryIndex circumvents -FollowSymLinks option

           Summary: DirectoryIndex circumvents -FollowSymLinks option
           Product: Apache httpd-2.0
           Version: 2.0.43
          Platform: PC
        OS/Version: Linux
            Status: NEW
          Severity: Normal
          Priority: Other
         Component: mod_dir
        AssignedTo: bugs@httpd.apache.org
        ReportedBy: dlandin@evcom.net


Given the following httpd.conf, where /home/www/index.html is a symbolic link to
/home/www/foo.html, a request for http://localhost/index.html predictably fails
with a "403 forbidden" error and generates a "Symbolic link not allowed:
/home/www/index.html" entry in the server error log.  However, a request for
http://localhost/ returns /home/www/foo.html.

# /etc/httpd/conf/httpd.conf

Group                   www
Listen                  80
LogLevel                info
PidFile                 /var/run/httpd.pid
ServerRoot              /etc/httpd
User                    www

LoadModule              dir_module              mods/mod_dir.so

DirectoryIndex          index.html

<Directory />
        AllowOverride   None
        Options         None
</Directory>

ServerName              localhost
DocumentRoot            /home/www

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org