Joe Orton wrote: > > These are fixable but one question is left on how a particular > combination of Includes and IncludesNoExec is interpreted: > > - if httpd.conf has "Options Includes", and an .htaccess file has > "Options +IncludesNoExec" - should exec= be permitted in an SSI? > > I can argue this either way but am tending towards "no"; I'd very much > welcome further opinions on this.
Agreed. IncludesNoExec inhibits, it would have been nice if it overrides Includes. But what is the behavior back to 1.3? Perhaps this needs simply documenting as "Options -Includes +IncludesNoExec" since whatever 1.3, 2.0 and 2.2 all do is what the world aught to expect now.
