You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@httpd.apache.org by David Robinson <dr...@ast.cam.ac.uk> on 1995/04/07 18:07:00 UTC

B60 uploaded: leading slash bug

I've uploaded B60-leading-slash.txt, which fixes this bug:

Requesting a resource without a leading slash will:
* not work (not a problem as it could only come from an invalid URL)
* cause a possible security breach; if docroot is /htdocs then
  GET -secret/passwd HTTP/1.0

  will cause httpd to access /htdocs-secret/passwd

David.