On Thu, Jun 26, 2003 at 11:54:50AM -0700, Jeff Newmiller wrote: > On Thu, 26 Jun 2003, Richard Crawford wrote: > > > Adrian Kalaveshi said: > > > > > Can't you just use a relative path? i.e: > > > > > > <form method="post" action="../cgi-bin/group.cgi"> > > > > Not in this case, no. The script refuses to execute unless it's called by > > an absolute path. This is a problem, I know, but I have yet to figure out > > how to fix Apache to solve it.
It's impossible that the problem is with Apache, unless it is munging your output. It is equally impossible for your script to refuse to execute on a relative path, because it is impossible for a browser to send a relative path to the server using HTTP: HTTP only supports absolute paths, which means that relative paths must be resolved by the *browser*. My bet is that you're not specifying the relative path correctly. > I would be wary of permitting ".." in a url for security reasons. ??? It's called relative URLs. Any decent web server (read: not IIS, historically) should be smart enough to realize if they are being used to access an out-of-bounds location in an absolute URL. In a relative URL, it is the *browser* that transforms it into an absolute URL, so if it's not valid given the currently browsed location, the browser will simply be unable to construct the absolute URL. No security problems here. -Micah _______________________________________________ vox-tech mailing list [EMAIL PROTECTED] http://lists.lugod.org/mailman/listinfo/vox-tech
