You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@httpd.apache.org by Randy Terbush <ra...@zyzzyva.com> on 1996/08/25 16:17:37 UTC

Re: FollowSymLinks rationale?

> Why is it that FollowSymLinks is switchable?
> 
> Cheers,
> 
> Ben.


Should be "off" by default.

Allows the server to traverse links.

Allows badguy to create links from ~/public_html/root -> /


I can't imagine setting this without "IfOwnerMatch". If my memory
serves, at one time SymLinksIfOwnerMatch did not imply FollowSymLinks
which should probably be considered a bug.  Looking at set_options()
this appears to still be true.