Re: [cobalt-users] All folders visable on whole server

["Brian Curtis" <admin@xxxxxxxxxxx>]

> Besides disabling server-side scripting languages for all accounts on the
> server, does anyone know a setting in Apache that will prevent a script
like
> this from being run (or better yet, allowing it to run but limiting the
> access to the script owner's web directory)? Using a script like this you
> can browse any directory (even if it's password protected with .htaccess)
> and view any file on the server.


Forgot to add to my last message:

<Files ~ "^adminpro\.(cgi|pl)$">
    Order allow,deny
    Deny from all
</Files>

Test: http://www.ctusa.net/cgi-bin/adminpro.cgi

But that doesn't prevent a user from renaming the script to something else
(though it's highly recommended *not* to for performance reasons within to
documentation).

--
Brian Curtis