[pkg-lighttpd] Bug#386568: Bug#386568: lighttpd: alias works

[Pierre Habouzit]

On Mon, Apr 28, 2008 at 04:38:08PM +0000, randhol wrote:
> Package: lighttpd
> Followup-For: Bug #386568
> 
> 
> I had the same problem but when I changed (in
> /etc/lighttpd/lighttpd.conf):
> 
> $HTTP["remoteip"] == "127.0.0.1" {
>         alias.url += ( 
>                 "/doc/" => "/usr/share/doc/",
>                 "/images/" => "/usr/share/images/"
>         )
>         $HTTP["url"] =~ "^/doc/|^/images/" {
>                 dir-listing.activate = "enable"
>         }
> }
> 
> to
> 
>         alias.url += ( 
>                 "/doc/" => "/usr/share/doc/",
>                 "/images/" => "/usr/share/images/"
>         )
>         $HTTP["url"] =~ "^/doc/|^/images/" {
>                 dir-listing.activate = "enable"
>         }
> 
> then alias.url += () works.

  Yes, but it's not what Debian policy mandates, _and_ it's a security
risk as it allow an attacker to know trivially what packages you
insteadd on a given machine.

-- 
·O·  Pierre Habouzit
··O                                                madcoder at debian.org
OOO                                                http://www.madism.org
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url : http://lists.alioth.debian.org/pipermail/pkg-lighttpd-maintainers/attachments/20080429/9951f9e0/attachment.pgp