RE: [cobalt-users] Cobalt wishlist

["Dan" <dan@xxxxxxxxxxxxx>]

> Okay, now you really have my curiosity up.  Where's the condition
> that lets you write to files?  The biggest thing I can see is
> a possible CGI exploit in that since all users CGIs run as httpd,
> and all FP enabled webs are owned by httpd -- that a malicious
> user could put together a small cgi using the POST method to let
> any upload a file that posts to a directory tree outside your
> own directory.
>
I think it has to do with the ability to add a .htaccess file because of the
AllowOverride All. (?)
--
Dan Kriwitsky