cgi/perl can still be run even it's not allow?

[jackc]

[security]cgi/perl can still be run even it's not allow?

Hello all,

It seems users still able to run cgi/perl scripts even they don't have cgi access, they can create a folder and put a .htaccess with
Options +ExecCGI
AddHandler cgi-script .cgi .pl

and run cgi/perl scripts from there, is this normal?

 

[jackc]

looks like apply jailed cgi patch to all users is needed otherwise one user can easily read other users files.

 

[Webcart]

Hello all,

It seems users still able to run cgi/perl scripts even they don't have cgi access, they can create a folder and put a .htaccess with
Options +ExecCGI
AddHandler cgi-script .cgi .pl

and run cgi/perl scripts from there, is this normal?

It depends on how much control you allow via .htaccess.
Check AllowOverride directive for more info.

 

[jackc]

If I don't allow Options use AllowOverride, I think all features in Options will not be able to use, that include some useful ones.