Re: [EMAIL PROTECTED] mod_xsendfile and security issues

2006-08-24 Thread Nick Kew
On Thursday 24 August 2006 12:12, Jose Adriano Baltieri wrote: > However, Apache DOES NOT remove or "swallows" the x-sendfile header. It > will go along to client side, revealing to client side my internal file > system paths. Does Header Unset x-sendfile have any effect? > I think this is a sev

[EMAIL PROTECTED] mod_xsendfile and security issues

2006-08-24 Thread Jose Adriano Baltieri
I'm using mod_xsendfile (http://celebnamer.celebworld.ws/stuff/mod_xsendfile) with Apache 2.0.58 on Windows. My scripts are issuing the x-sendfile http header and, Apache is interpreting it correctly, sending the designated file path to the client. So far, so good. However, Apache DOES NOT