Re: [Webware-devel] security hole in WebKit

2001-12-12 Thread Tavis Rudd
I've just done a little more work on this in the experimental code. Here are the config settings I've implemented and tested so far: DirectoryFiles = ['index','Index','main','Main', 'default','Default',] ## these 2 only affect requests with no extension specified # same as before ExtensionsToH

RE: [Webware-devel] security hole in WebKit

2001-12-12 Thread Love, Jay
We've talked about having an ExtensionsToServe numerous times. Perhaps this should be a configuration option, say "LimitFileTpesServed", and then ExtensionsToServe would list what may be served. J > -Original Message- > From: Geoffrey Talvola [mailto:[EMAIL PROTECTED]] > Sent: Wednesday

Re: [Webware-devel] security hole in WebKit

2001-12-12 Thread Geoffrey Talvola
At 11:55 AM 12/12/01 -0800, Tavis Rudd wrote: >Hi, >in the cvs version of WebKit (and I assume all previous versions) >it's possible to access backup versions of the .py servlet files: >http://localhost/WK/Welcome.py~ for example. This could expose >information about the site that should be kept p

[Webware-devel] security hole in WebKit

2001-12-12 Thread Tavis Rudd
Hi, in the cvs version of WebKit (and I assume all previous versions) it's possible to access backup versions of the .py servlet files: http://localhost/WK/Welcome.py~ for example. This could expose information about the site that should be kept private. Consider http://localhost/WK/.htpasswd

[Webware-devel] cvs update

2001-12-12 Thread Geoffrey Talvola
I fixed Session.py's sessionEncode() method. It was generating malformed query strings before, now it works. Thanks to Jeff Johnson for this fix. -- - Geoff Talvola [EMAIL PROTECTED] ___ Webware-devel mailing list [EMAIL PROTECTED] https://list