Relative to the recent CVEs, should we replace ScriptAlias in the default conf with Alias + SetHandler cgi-script in the corresponding Directory section?
And .. should ScriptAlias be deprecated/discouraged in some way if the expanded version is safer by avoiding the equivalent of setting the handler in Location vs. Directory? I am assuming it is not possible/feasible to make ScriptAlias just work as if it was in the 2nd arguments Directory config. -- Eric Covener cove...@gmail.com
