Relative to the recent CVEs, should we replace ScriptAlias in the
default conf with Alias + SetHandler cgi-script in the corresponding
Directory section?

And .. should ScriptAlias be deprecated/discouraged in some way if the
expanded version is safer by avoiding the equivalent of setting the
handler in Location vs. Directory?

I am assuming it is not possible/feasible to make ScriptAlias just
work as if it was in the 2nd arguments Directory config.

Eric Covener

Reply via email to