Brian Rosner: > I am slightly surprised that the sNews project issued a webserver > configuration hack to fix a vulnerability in its own code. Being that > not everyone that uses a PHP project project will be using Apache (this > is obvisious in your case) and that PHP prides its ability to be > cross-platform and compatibile with many webservers.
Well, indeed the patch has two parts: one for the code and other one for the webserver. The CMS actually makes use of htaccess to redirect directories onto variables, so perhaps they naturally came to the solution introducing protecting code in the webserver part. > SQL injections > and cross-site scripting should really always be handled by the server > side code and NOT the webserver. OK. Thanks for this warn. I will notify it. But, on the other hand... The rules proposed by the sNews-team, and translated to cherokee by Álvaro (many thanks to him!) are healthy for any server, aren't they? -- Manuel Pancorbo Castro http://bitakoro.blogdns.org/ _______________________________________________ Cherokee mailing list [email protected] http://cherokee-project.com/cgi-bin/mailman/listinfo/cherokee
