>Number: 3989 >Category: suexec >Synopsis: vhosts & scriptaliases >Confidential: no >Severity: non-critical >Priority: medium >Responsible: apache >State: open >Class: change-request >Submitter-Id: apache >Arrival-Date: Wed Mar 3 05:50:02 PST 1999 >Last-Modified: >Originator: [EMAIL PROTECTED] >Organization: apache >Release: 1.3.4 >Environment: Linux >Description:
I've got several vhosts on my server, but they are not located under the main server's docroot tree, so they won't initially work with suexec. I only use ScriptAliases - This way I am able to control the use of CGI by a restricted set of users, and they name their cgi as they want. I would like suexec to work with ScriptAliased directories. [workaround - I disabled the htdocs path checking of suexec, that's still safe enough for my site] >How-To-Repeat: Have ScriptAlias directories outside htdocs. >Fix: Makes suexec more complicated: if script path not in docroot, load an alternate list of trusted ScriptAliased directories from a safe file. As most sites does not need this, provide it as a makefile option. Provide an utility to compile such a list from httpd.conf and eventually accessible .htaccess files. >Audit-Trail: >Unformatted: [In order for any reply to be added to the PR database, ] [you need to include <[EMAIL PROTECTED]> in the Cc line ] [and leave the subject line UNCHANGED. This is not done] [automatically because of the potential for mail loops. ] [If you do not include this Cc, your reply may be ig- ] [nored unless you are responding to an explicit request ] [from a developer. ] [Reply only with text; DO NOT SEND ATTACHMENTS! ]
