Bugtraq: Re: More fun with WWWBoard

[ben () ALGROUP CO UK (Ben Laurie)]

Vladimir Dubrovin wrote:
> Hello Chris Ridd,
>
> 20.09.99 16:24, you wrote: More fun with WWWBoard;
>
> C> In Apache you'd configure this as follows:
>
> C> <Files passwd.txt>
> C> deny from all
> C> </Files>
>
> or put it in some directory inside your web home and configure
>
> <Limit GET>
> deny from all
> </Limit>
>
> <Limit POST>
> deny from all
> </Limit>
>
> for  this  directory.  It's more safe, because some text editors leave
> backup copy of the file, for example passwd.txt~. In this case you are
> safe even if you forget to remove this file.
In general, you should not use <Limit...> unless for some reason you
want your security to only apply to GET and POST methods.

Cheers,

Ben.

--
http://www.apache-ssl.org/ben.html

"My grandfather once told me that there are two kinds of people: those
who work and those who take the credit. He told me to try to be in the
first group; there was less competition there."
     - Indira Gandhi