The following reply was made to PR mod_include/3184; it has been noted by GNATS.

From: Alex Tutubalin <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Cc: [EMAIL PROTECTED]
Subject: Re: mod_include/3184: <!--#exec cmd="/path/cmd" is not a subject of 
any restrictions (<Directory> etc)
Date: Mon, 12 Oct 1998 23:20:53 +0400

 >If you don't want people to be able to execute things
 >from SSIs, use "Options IncludesNoEXEC".  They can still
 >use include virtual to execute CGIs from ScriptAliased
 >directories since htat isn't really calling a CGI, but
 >just calling an arbitrary document that already is treated
 >as a CGI
 
 Unfortunately, this method brokes MultiViews for included files.
 I've some /cgi-bin/test.ru (and ru is default language for my servers).
 With Options +Includes +MultiViews for .shtml file and Options +MultiViews
 for (scriptaliased) /cgi-bin/ both include virtual and exec cgi 
 for "/cgi-bin/test" are calls /cgi-bin/test.ru as expected.
 
 With Options IncludesNOEXEC language negotiation mechanics is broken -
 I need to point to exact "/cgi-bin/test.ru" script in html code.
 
 Of course, it is not a mod_include problem. I'll try to distinguish
 the exact source and will write another bug submission if it is not my
 fault.
 
 Alex Tutubalin