httpd-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Marc Slemko <ma...@znep.com>
Subject Re: Directory names with dots (fwd)
Date Mon, 24 Aug 1998 21:35:33 GMT
Whoop de-doo-dah.

Sigh oink ouch.

---------- Forwarded message ----------
Date: Mon, 24 Aug 1998 09:58:41 -0700
From: Andrew Fladmark <andrew@ORBITAL-WEB.NET>
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM
Subject: Re: Directory names with dots

I tested this out this morning, and found the following.  The directory
need not actually contain .com for the problem to occur.  I tried the
following combinations:

http://www.ourserver.com/www.jones.com/hello.asp
http://www.ourserver.com/www.jones.net/hello.asp
http://www.ourserver.com/www.micha/hello.asp
http://www.ourserver.com/blah.blah/hello.asp

So as near as I can tell, the directory need only to contain a period.

If the directory is on a FAT drive, it will display the source to everyone,
if it is on an NTFS drive, and the permissions are set to everyone on the
directory, the source will display.  Only if there are restricted
permissions will it ask for a password.

Andrew Fladmark
Orbital Web Design
andrew@orbital-web.net
http://www.orbital-web.net

At 10:49 AM 8/24/98 +0200, you wrote:
>When a directory containing .asp files contains the string .com, the ASP
>code is not executed but simply shown to the user. Example:
>
>http://www.test.com/www.directory.com/sample.asp  or
>http://www.test.com/www.com/sample.asp  or


Mime
View raw message