[Xitami] /../../%20 thing

[Ewen McNeill]

In message <MAEPKOFMKPDCFOHCHFAFIENICLAA.grangeway@btinternet.com>, "Paul Richar
ds" writes:
>What is more interesting is how xitami behaves to that request.....
>http://127.0.0.1 -> returns homepage.
>http://127.0.0.1/../ -> returns home page.

".." like strings get eliminated before trying to figure out what the
URL means; it's a security measure.  However there seems to be some
strange interaction between encoded spaces and other things going on;
I've put it on the bug list.

>From what I've heard to date this isn't a security issue (since you
don't get access to anything you'd not otherwise have access to, and
even when you do get a directory listing that perhaps you shouldn't
have received, it is empty revealing nothing). 

But it's definitely a strange bug to investigate.

Ewen

-- 
Ewen McNeill, Technical Consultant, iMatix Corporation  www.imatix.com