>Number: 609 >Category: mod_cgi >Synopsis: User Authentification in CGI environment >Confidential: no >Severity: critical >Priority: medium >Responsible: apache (Apache HTTP Project) >State: open >Class: sw-bug >Submitter-Id: apache >Arrival-Date: Thu May 22 21:10:02 1997 >Originator: [EMAIL PROTECTED] >Organization: apache >Release: 1.2b10 >Environment: Linux ELF 2.0.30 (i586) - RedHat 4.1 gcc 2.7.2 libc 5.3.12 >Description: I have an HTML document in a directory (/lab/toto.html) who call a cgi in /cgi-bin/lab/my-cgi. To access to the toto.html file, I have a .htaccess and .htpasswd file. You enter your name & passwd, but I have too a .htaccess in cgi, and this second .htaccess acceed to passwd in the same .htpasswd than toto.html. The problem is this : After the call of cgi (in POST method), I haven't the REMOTE_USER define, but if I launch the CGI alone, without the toto.html file, the REMOTE_USER var is correctly set. I don't understand why... >How-To-Repeat: Ok, I give you the URL of this error. Check for http://lab.neuronnexion.fr/sec-lab/w3user The login is dav and the passwd is dav. >Fix: No, but I'm going to see source code.. >Audit-Trail: >Unformatted:
