Re: DO NOT REPLY [Bug 4361] - SsiServlet potentially leaks files

2001-10-25 Thread Paul Speed
I couldn't find alot of info on testing. I also couldn't find any tests that included multiple files... so I may be looking in the wrong place. I eventually found and played with the tester stuff. Attached are the files I added to the tester to exploit the include problem. SSIInclude09.shtml

RE: DO NOT REPLY [Bug 4361] - SsiServlet potentially leaks files

2001-10-25 Thread Bip Thelin
-Original Message- From: Paul Speed [mailto:[EMAIL PROTECTED]] Actually, while I'm on that subject, the diffs are extensive since I've pretty much touched every SSI related file in a very significant way... in addition to removing a few of them. What is the preferred way to

RE: DO NOT REPLY [Bug 4361] - SsiServlet potentially leaks files

2001-10-25 Thread Bip Thelin
-Original Message- From: Paul Speed [mailto:[EMAIL PROTECTED]] [...] I now have this working on my system here. It currently passes all of the tester tests in addition to about 7 more tests that I added myself here locally. I also added the initial support for the set

Re: DO NOT REPLY [Bug 4361] - SsiServlet potentially leaks files

2001-10-24 Thread Paul Speed
Bip Thelin wrote: -Original Message- From: Paul Speed [mailto:[EMAIL PROTECTED]] For the curious reader, after looking into this code at some length it seems clear why the set command was not added. All SSI requests share the same environment, which not only makes a set

RE: DO NOT REPLY [Bug 4361] - SsiServlet potentially leaks files

2001-10-24 Thread Bip Thelin
-Original Message- From: Paul Speed [mailto:[EMAIL PROTECTED]] [...] Actually, includes should share the environment of the parent... in fact, if they set server variables the parent will see them. Ok, that might be true(just looked at Apache's behavior and they seem to do just

Re: DO NOT REPLY [Bug 4361] - SsiServlet potentially leaks files

2001-10-23 Thread Paul Speed
On a vaguely related note... For the curious reader, after looking into this code at some length it seems clear why the set command was not added. All SSI requests share the same environment, which not only makes a set command impossible but also means that multiple SSI requests (or even

RE: DO NOT REPLY [Bug 4361] - SsiServlet potentially leaks files

2001-10-23 Thread Bip Thelin
-Original Message- From: Paul Speed [mailto:[EMAIL PROTECTED]] For the curious reader, after looking into this code at some length it seems clear why the set command was not added. All SSI requests share the same environment, which not only makes a set command impossible but