Brian Rosner:

> I am slightly surprised that the sNews project issued a webserver
> configuration hack to fix a vulnerability in its own code.  Being that
> not everyone that uses a PHP project project will be using Apache (this
> is obvisious in your case) and that PHP prides its ability to be
> cross-platform and compatibile with many webservers.

Well, indeed the patch has two parts: one for the code and other one
for the webserver. The CMS actually makes use of htaccess to redirect
directories onto variables, so perhaps they naturally came to the
solution introducing protecting code in the webserver part.

> SQL injections
> and cross-site scripting should really always be handled by the server
> side code and NOT the webserver.

OK. Thanks for this warn. I will notify it.

But, on the other hand... The rules proposed by the sNews-team, and
translated to cherokee by Álvaro (many thanks to him!) are healthy for
any server, aren't they?

-- 
Manuel Pancorbo Castro
http://bitakoro.blogdns.org/
_______________________________________________
Cherokee mailing list
[email protected]
http://cherokee-project.com/cgi-bin/mailman/listinfo/cherokee

Reply via email to