Mailing-List: contact docs-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: docs@httpd.apache.org
Received-SPF: neutral (athena.apache.org: local policy)
Message-ID: <48E4F452.4010902@lorraine.iufm.fr>
Date: Thu, 02 Oct 2008 18:18:26 +0200
From: Lucien GENTIS <lucien.gentis@lorraine.iufm.fr>
User-Agent: IceDove 1.5.0.14eol (X11/20080724)
MIME-Version: 1.0
To: docs@httpd.apache.org
Subject: Re: help for translation
References: <48E0E604.9050607@lorraine.iufm.fr>
 <48E2BD46.9010206@lucid.net.au>
 <1404e5910810010902y131f9ff4h233b71c445634082@mail.gmail.com>
In-Reply-To: <1404e5910810010902y131f9ff4h233b71c445634082@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 8bit

Eric Covener a �crit :
> On Tue, Sep 30, 2008 at 7:59 PM, Jason Lingohr <jason@lucid.net.au> wrote:
>   
>> On 30/09/2008 12:28 AM, Lucien GENTIS wrote:
>>     
>>> Hello to all,
>>>
>>> File trunk/manual/lod/core.xml - line 2298 about FollowSymLinks option.
>>>
>>> Could someone explain this sentence :
>>>
>>> "Omitting this option should not be considered a security restriction,
>>> since symlink testing is subject to race conditions that make it
>>> circumventable.
>>>
>>>       
>> The second part reads ok to me -- buffer overrun or memory allocation
>> exhaustion... but the "restriction" word seems odd.
>>
>> Should it perhaps be "should not be considered a security
>> (benefit|enhancement),..."
>>     
>
> Maybe "... security measure"
>
> Re: the 2nd part, AIUI the window between checking that a path
> component isn't a symlink then actually using the path component is
> what this is referring to, not some potential corruption issue in the
> server that would change the behavior.
>
>   
Thanks for all answers ; yet I understand the sentence this way :

"Omitting this option should not be considered a security enhancement, because the time while testing symlinks can be subject to race conditions and so the security measure taken omitting this option can be circumvented.

Am i right ?


---------------------------------------------------------------------
To unsubscribe, e-mail: docs-unsubscribe@httpd.apache.org
For additional commands, e-mail: docs-help@httpd.apache.org