mod_include/6649: SSI include virtual will not allow relative paths above DocumentRoot - doco vague

["Jay R.Ashworth" <jr...@baylink.com>]

>Number:         6649
>Category:       mod_include
>Synopsis:       SSI include virtual will not allow relative paths above DocumentRoot - doco vague
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    apache
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          doc-bug
>Submitter-Id:   apache
>Arrival-Date:   Tue Oct 10 08:40:18 PDT 2000
>Closed-Date:
>Last-Modified:
>Originator:     jra@baylink.com
>Release:        1.2.4 (yes, I know; that's what they run there)
>Organization:
apache
>Environment:
SunOS/Solaris; server at ISP; versions unk.
>Description:
While the documentation for 'include file=' explicitly states that relative paths
containing .. are not allowed, the section on 'include virtual=' says that they
are, but fails to say that the ceiling on climbing up the tree is the DocumentRoot,
rather than the ServerRoot, which it appears, by inspection, to actually be.

This makes shared SSI fragment directories impossible to implement.

The alternative, of course, makes it possible for ISP customers sharing one 
server to include each other's stuff, which isn't good either.
>How-To-Repeat:

>Fix:
Not really; see above.  For servers where all the virtual servers are under
the same span of administrative control, a config file directive could be
created to allow include virtual to go further up the tree, but this would
be a security violation on shared commercial servers.
>Release-Note:
>Audit-Trail:
>Unformatted:
 [In order for any reply to be added to the PR database, you need]
 [to include <ap...@Apache.Org> in the Cc line and make sure the]
 [subject line starts with the report component and number, with ]
 [or without any 'Re:' prefixes (such as "general/1098:" or      ]
 ["Re: general/1098:").  If the subject doesn't match this       ]
 [pattern, your message will be misfiled and ignored.  The       ]
 ["apbugs" address is not added to the Cc line of messages from  ]
 [the database automatically because of the potential for mail   ]
 [loops.  If you do not include this Cc, your reply may be ig-   ]
 [nored unless you are responding to an explicit request from a  ]
 [developer.  Reply only with text; DO NOT SEND ATTACHMENTS!     ]