[Xitami] win2k directory security

[Paul Reid]

> Xitami can serve a page for a directory that is NOT shared under Windows.

Xitami does not use Windows' concept of sharing.

Basically: Windows, being DOS with a pretty face, has weak
permissions. Unless you go to some trouble, any program on the
machine can access any file on the machine. 

Most Webservers, including Xitami, follow the rule of only
serving files in or below a specific directory. On my school's
unix box, the directory must be named "public_html", which gives
users a little warning that anything in there is "public", unlike
the rest of their directories which they may set "private".
Xitami lets you set the one specific directory that will be
served; typically c:/Xitami/webpages. It _IS_ up to you to be
sure that directory only has files you want "everybody" to see.

One exception: in addition to ./webpages, Xitami will serve files
in ./cgi-bin. By default it will only serve them by executing
them (better know what is in there!); but it can also serve
non-executable files (GIF images to support CGI apps, for
instance). 

In WinNT, with its OS/2 core, you actually have strong
permissions. You can create a "user" that has highly limited
access to files, and launch Xitami as that user. If you let other
people put CGI scripts on your server, you maybe should run
Xitami from a limited-access account. 

I "trust" Xitami to serve ONLY from the directories I told it to
serve from. Note that some other webservers (spelled "MS") have
been fooled by URLs with excess dots (implying parent directories
above where the web root should be). Also until recently Xitami
under DOS could be confused by "files" that were really devices
(even DOS sometimes can't tell the difference). That was unlikely
to spill secrets, but could lock-up the server as it waited
(forever) for data to come out of the printer (that is fixed). 

 -PRR