Re: PANIC: Huge security hole with webserving on OSXS?

• Subject: Re: PANIC: Huge security hole with webserving on OSXS?
• From: Julia Frizzell <email@hidden>
• Date: Tue, 29 Apr 2003 15:17:43 -0400

Hey..

Please, tell me that I am the culprit in this situation and that this is not a problem which lies with Apache on OSXS!

Apache is setup to serve up "static" content, and a Servlet Container (Tomcat or Caucho Resin) is set up to handle requests for *.jsp's. Now, the problem is: Apache on the Mac is case sensitive / not case sensitive.. Which means:

http://www.foo.bar/foo.jsp >> Goes to the Servlet Container and the Java code is processed.

http://www.foo.bar/foo.JSP >> Does not equal http://www.foo.bar/foo.jsp to Apache so it will serve up the Java code within the page to the client, UNPROCESSED!

Geeez, c'mon here.. There must be a way for Apache to know that *.JSP and *.jsp are the same thing?????

Please, anyone??

• Prev by Date: RE: CLI Apple System Profiler
• Next by Date: RE: WebStar SSL -> Apache
• Previous by thread: PANIC: Huge security hole with webserving on OSXS?
• Next by thread: Re: PANIC: Huge security hole with webserving on OSXS?
• Index(es):
  • Date
  • Thread