Return-Path: 
 <cvs-return-25767-apmail-httpd-cvs-archive=httpd.apache.org@httpd.apache.org>
Delivered-To: apmail-httpd-cvs-archive@www.apache.org
Received: (qmail 17457 invoked from network); 20 Aug 2006 19:48:29 -0000
Received: from hermes.apache.org (HELO mail.apache.org) (209.237.227.199)
  by minotaur.apache.org with SMTP; 20 Aug 2006 19:48:29 -0000
Received: (qmail 76114 invoked by uid 500); 20 Aug 2006 19:48:28 -0000
Delivered-To: apmail-httpd-cvs-archive@httpd.apache.org
Received: (qmail 75915 invoked by uid 500); 20 Aug 2006 19:48:28 -0000
Mailing-List: contact cvs-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
list-help: <mailto:cvs-help@httpd.apache.org>
list-unsubscribe: <mailto:cvs-unsubscribe@httpd.apache.org>
List-Post: <mailto:cvs@httpd.apache.org>
List-Id: <cvs.httpd.apache.org>
Delivered-To: mailing list cvs@httpd.apache.org
Received: (qmail 75904 invoked by uid 99); 20 Aug 2006 19:48:28 -0000
Received: from asf.osuosl.org (HELO asf.osuosl.org) (140.211.166.49)
    by apache.org (qpsmtpd/0.29) with ESMTP; Sun, 20 Aug 2006 12:48:28 -0700
X-ASF-Spam-Status: No, hits=-9.4 required=10.0
	tests=ALL_TRUSTED,NO_REAL_NAME
X-Spam-Check-By: apache.org
Received-SPF: pass (asf.osuosl.org: local policy)
Received: from [140.211.166.113] (HELO eris.apache.org) (140.211.166.113)
    by apache.org (qpsmtpd/0.29) with ESMTP; Sun, 20 Aug 2006 12:47:57 -0700
Received: by eris.apache.org (Postfix, from userid 65534)
	id 940B81A981D; Sun, 20 Aug 2006 12:46:56 -0700 (PDT)
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Subject: svn commit: r433022 - in /httpd/httpd/branches/2.2.x/docs/manual/mod:
 mod_alias.html.en mod_alias.xml
Date: Sun, 20 Aug 2006 19:46:56 -0000
To: cvs@httpd.apache.org
From: slive@apache.org
X-Mailer: svnmailer-1.0.8
Message-Id: <20060820194656.940B81A981D@eris.apache.org>
X-Virus-Checked: Checked by ClamAV on apache.org
X-Spam-Rating: minotaur.apache.org 1.6.2 0/1000/N

Author: slive
Date: Sun Aug 20 12:46:55 2006
New Revision: 433022

URL: http://svn.apache.org/viewvc?rev=433022&view=rev
Log:
Backport:
My last effort was a little too succinct and not quite precise
enough.  Try being more explicit.

This does leave the danger that people will clip the <Location>
example as the proper way to do things, when they should be
reading on to the <Directory> example.  The <Location> example
is only correct when used in conjunction with Alias.


Modified:
    httpd/httpd/branches/2.2.x/docs/manual/mod/mod_alias.html.en
    httpd/httpd/branches/2.2.x/docs/manual/mod/mod_alias.xml

Modified: httpd/httpd/branches/2.2.x/docs/manual/mod/mod_alias.html.en
URL: http://svn.apache.org/viewvc/httpd/httpd/branches/2.2.x/docs/manual/mod/mod_alias.html.en?rev=433022&r1=433021&r2=433022&view=diff
==============================================================================
--- httpd/httpd/branches/2.2.x/docs/manual/mod/mod_alias.html.en (original)
+++ httpd/httpd/branches/2.2.x/docs/manual/mod/mod_alias.html.en Sun Aug 20 12:46:55 2006
@@ -366,15 +366,15 @@
     is essentially equivalent to:</p>
     <div class="example"><p><code>
       Alias /cgi-bin/ /web/cgi-bin/<br />
-      &lt;Directory /web/cgi-bin &gt;<br />
+      &lt;Location /cgi-bin &gt;<br />
       <span class="indent">
       SetHandler cgi-script<br />
       Options +ExecCGI<br />
       </span>
-      &lt;/Directory&gt;
+      &lt;/Location&gt;
     </code></p></div>
 
-    <div class="note">It is safer to avoid placing CGI scripts under the
+    <div class="warning">It is safer to avoid placing CGI scripts under the
     <code class="directive"><a href="../mod/core.html#documentroot">DocumentRoot</a></code> in order to
     avoid accidentally revealing their source code if the
     configuration is ever changed.  The
@@ -382,8 +382,20 @@
     URL and designating CGI scripts at the same time.  If you do
     choose to place your CGI scripts in a directory already
     accessible from the web, do not use
-    <code class="directive">ScriptAlias</code>.  Instead, use <code class="directive"><a href="../mod/core.html#directory">&lt;Directory&gt;</a></code>, <code class="directive"><a href="../mod/core.html#sethandler">SetHandler</a></code>, and <code class="directive"><a href="../mod/core.html#options">Options</a></code> as shown in the second example
-    above.</div>
+    <code class="directive">ScriptAlias</code>.  Instead, use <code class="directive"><a href="../mod/core.html#directory">&lt;Directory&gt;</a></code>, <code class="directive"><a href="../mod/core.html#sethandler">SetHandler</a></code>, and <code class="directive"><a href="../mod/core.html#options">Options</a></code> as in:
+    <div class="example"><p><code>
+      &lt;Directory /usr/local/apache2/htdocs/cgi-bin &gt;<br />
+      <span class="indent">
+      SetHandler cgi-script<br />
+      Options ExecCGI<br />
+      </span>
+      &lt;/Directory&gt;
+    </code></p></div>
+    This is necessary since multiple <var>URL-paths</var> can map
+    to the same filesystem location, potentially bypassing the
+    <code class="directive">ScriptAlias</code> and revealing the source code
+    of the CGI scripts if they are not restricted by a 
+    <code class="directive"><a href="../mod/core.html#directory">Directory</a></code> section.</div>
 
 
 <h3>See also</h3>

Modified: httpd/httpd/branches/2.2.x/docs/manual/mod/mod_alias.xml
URL: http://svn.apache.org/viewvc/httpd/httpd/branches/2.2.x/docs/manual/mod/mod_alias.xml?rev=433022&r1=433021&r2=433022&view=diff
==============================================================================
--- httpd/httpd/branches/2.2.x/docs/manual/mod/mod_alias.xml (original)
+++ httpd/httpd/branches/2.2.x/docs/manual/mod/mod_alias.xml Sun Aug 20 12:46:55 2006
@@ -361,15 +361,15 @@
     is essentially equivalent to:</p>
     <example>
       Alias /cgi-bin/ /web/cgi-bin/<br />
-      &lt;Directory /web/cgi-bin &gt;<br />
+      &lt;Location /cgi-bin &gt;<br />
       <indent>
       SetHandler cgi-script<br />
       Options +ExecCGI<br />
       </indent>
-      &lt;/Directory&gt;
+      &lt;/Location&gt;
     </example>
 
-    <note>It is safer to avoid placing CGI scripts under the
+    <note type="warning">It is safer to avoid placing CGI scripts under the
     <directive module="core">DocumentRoot</directive> in order to
     avoid accidentally revealing their source code if the
     configuration is ever changed.  The
@@ -380,8 +380,20 @@
     <directive>ScriptAlias</directive>.  Instead, use <directive
     module="core" type="section">Directory</directive>, <directive
     module="core">SetHandler</directive>, and <directive
-    module="core">Options</directive> as shown in the second example
-    above.</note>
+    module="core">Options</directive> as in:
+    <example>
+      &lt;Directory /usr/local/apache2/htdocs/cgi-bin &gt;<br />
+      <indent>
+      SetHandler cgi-script<br />
+      Options ExecCGI<br />
+      </indent>
+      &lt;/Directory&gt;
+    </example>
+    This is necessary since multiple <var>URL-paths</var> can map
+    to the same filesystem location, potentially bypassing the
+    <directive>ScriptAlias</directive> and revealing the source code
+    of the CGI scripts if they are not restricted by a 
+    <directive module="core">Directory</directive> section.</note>
 
 </usage>
 <seealso><a href="../howto/cgi.html">CGI Tutorial</a></seealso>