From 1635d3d65eaaa42ce61cbb3c53770d5b64920b51 Mon Sep 17 00:00:00 2001
From: Astrid Malo To isolate the damage a wayward SSI file can cause, a server
administrator can enable suexec as
- described in the CGI in General section
Enabling SSI for files with .html or .htm extensions can be
dangerous. This is especially true in a shared, or high traffic,
@@ -143,7 +143,7 @@
programs from SSI pages. To do this replace Includes
with IncludesNOEXEC
in the Options
directive. Note that users may
still use <--#include virtual="..." --> to execute CGI scripts if
- these scripts are in directories desginated by a ScriptAlias
directive.
ScriptAlias
directive.
Pay particular attention to the interactions of Location
and Directory
directives; for instance, even
if <Directory />
denies access, a
- <Location />
directive might overturn it
Also be wary of playing games with the UserDir
directive; setting it to
something like "./" would have the same effect, for root, as the first
diff --git a/docs/manual/misc/security_tips.xml b/docs/manual/misc/security_tips.xml
index d3388afc885..caa46927a58 100644
--- a/docs/manual/misc/security_tips.xml
+++ b/docs/manual/misc/security_tips.xml
@@ -125,7 +125,7 @@
To isolate the damage a wayward SSI file can cause, a server administrator can enable suexec as - described in the CGI in General section
+ described in the CGI in General section.Enabling SSI for files with .html or .htm extensions can be
dangerous. This is especially true in a shared, or high traffic,
@@ -138,7 +138,7 @@
with IncludesNOEXEC
in the
<Directory />
denies access, a
- <Location />
directive might overturn it
+ <Location /> directive might overturn it.
Also be wary of playing games with the