[Xitami] Problem with cgi-bin
Paul Reid
xitami@lists.xitami.org
Fri, 19 Oct 2001 15:48:43 -0400
> didn't install a cgi-bin. Is that supposed to happen?
Yes.
That threw me too.
The customary default CGI programs are now considered potential security
risks. "testcgi" has hints of your O/S, paths, script local path, temp
folder, and other clues that "might" aid a hacker. While an environment
report has always been a standard web server tool, current advice from
most security experts is you should not have stuff like that exposed
except for testing.
Since that's about all that came in Xitami's cgi-bin distribution
folder, for 2.49 they choose to just omit the whole folder.
Obviously you can create a cgi-bin for your own scripts. (You could even
be clever and use a different name, so hackers who know Xitami won't
quickly find it.)
If you need the old testcgi script, someone here can probably send it to
you or you can extract an older release of Xitami into a scrap
directory.
-PRR