httpd-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Kae Verens <...@webworks.ie>
Subject [users@httpd] files ending with '.' treated as if the '.' is not there
Date Mon, 13 Oct 2008 09:15:06 GMT
Morning all,
  first post from myself.

If you have PHP, Perl or plain old CGI installed, and set up Apache to 
recognise these files with the extensions '.php', '.pl' or '.cgi', 
Apache will recognise the files even if the filename has a '.' at the end.

For example, 'test.php.' will be run as if it is a PHP file.

This causes some developers to unwittingly create insecure programs. for 
example, if you have a program which allows a user to rename a file, but 
bans server-executable extensions such as '.php', '.cgi', etc, the 
programmer would not automatically realise that the user can get around 
that by placing a '.' at the end.

I'd like to know is that a bug in Apache?

kae

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org


Mime
View raw message