Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
Received-SPF: neutral (athena.apache.org: local policy)
Message-ID: <48F3119A.4090702@webworks.ie>
Date: Mon, 13 Oct 2008 10:15:06 +0100
From: Kae Verens <kae@webworks.ie>
User-Agent: Thunderbird 2.0.0.16 (X11/20080723)
MIME-Version: 1.0
To: users@httpd.apache.org
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Subject: [users@httpd] files ending with '.' treated as if the '.' is not
 there

Morning all,
  first post from myself.

If you have PHP, Perl or plain old CGI installed, and set up Apache to 
recognise these files with the extensions '.php', '.pl' or '.cgi', 
Apache will recognise the files even if the filename has a '.' at the end.

For example, 'test.php.' will be run as if it is a PHP file.

This causes some developers to unwittingly create insecure programs. for 
example, if you have a program which allows a user to rename a file, but 
bans server-executable extensions such as '.php', '.cgi', etc, the 
programmer would not automatically realise that the user can get around 
that by placing a '.' at the end.

I'd like to know is that a bug in Apache?

kae

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org