Adding some additional security considerations. Thanks to Daniel Shahaf for these...

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@1343883 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/docs/manual/mod/mod_log_forensic.xml b/docs/manual/mod/mod_log_forensic.xml
index ad5831c7a960549b6d791b9673c88d46778a51bd..5a31fb5c695a5ad0337046244e7c30d49cdcedda 100644 (file)
--- a/docs/manual/mod/mod_log_forensic.xml
+++ b/docs/manual/mod/mod_log_forensic.xml
@@ -93,6 +93,10 @@ version 2.1</compatibility>
     document for details on why your security could be compromised
     if the directory where logfiles are stored is writable by
     anyone other than the user that starts the server.</p>
+    <p>The log files may contain sensitive data such as the contents of 
+    <code>Authorization:</code> headers (which can contain passwords), so
+    they should not be readable by anyone except the user that starts the
+    server.</p>
 </section>
 
 <directivesynopsis>
@@ -136,7 +140,7 @@ version 2.1</compatibility>
       <note><title>Note</title>
         <p>When entering a file path on non-Unix platforms, care should be taken
         to make sure that only forward slashes are used even though the platform
-        may allow the use of back slashes. In general it is a good idea to always 
+        may allow the use of back slashes. In general it is a good idea to always
         use forward slashes throughout the configuration files.</p>
       </note></dd>
     </dl>