Mailing-List: contact new-httpd-help@apache.org; run by ezmlm
Precedence: bulk
Reply-To: new-httpd@apache.org
From: "William A. Rowe, Jr." <wrowe@lnd.com>
To: <new-httpd@apache.org>
Subject: RE: cvs commit: apache-1.3 STATUS
Date: Sat, 17 Jun 2000 02:04:57 -0500
Message-ID: <000401bfd82a$5bfb5fd0$345985d0@corecomm.net>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
In-Reply-To: <20000617070205.68320.qmail@locus.apache.org>
Importance: Normal

> wrowe       00/06/17 00:02:05
> 
>   Modified:    .        STATUS
>   Log:
>     Not much left on this list :)
>   
>   Revision  Changes    Path
>   1.829     +5 -15     apache-1.3/STATUS
>   
>   Index: STATUS
>   ===================================================================
>        * Close the security hole in stat() by testing for anything other 
>            than conventional file-not-found, permission-denied errors and
>            rejecting the request then and there.  By rights, all of these 
>            cases aught to be Not Found, not Permission Denied, or maybe 500?

I'm lost.  Is anyone on the track for this fix?  I have the concept, but
don't really want to be the OGP for any further common code changes to the
1.3.13 tree... although I will test the heck out of whatever is proposed,
of course :)

Bill