[Xitami] Security Issue - Disabling Script Processing

[Ewen McNeill]

In message <DGEHJCCICENINLMJDFGPIELICEAA.Rob@BlueMarbleMeds.com>, "Rob @ BMM" wr
ites:
>What this issue pertains to, is that Xitami allows this kind of script
>processing to occur.  I need a method to prevent it from occurring within
>Xitami.  Xitami should NOT allow paths outside of the local web folder
>environment which these kinds of hacks take advantage of.

Actually ISTR the issue is that the URL is invalid in a way that
triggers a bug in IIS and a security issue; and that invalid URL causes
Xitami's URL parsing to say "oh, you want the home page of the domain,
oaky, here it is".  So the 200 reply is Xitami sending out the home
page.  

Short of a bug-fixed version of Xitami (I've no idea when/if there will
be another update; I just look after the computers these days), about
the best idea I have for avoiding a 200 reply is to password protect
the URL's top path -- and I'm not even sure if that will work due to
the parsing issues mentioned above.

Ewen

-- 
Ewen McNeill, System Administrator, iMatix Corporation  www.imatix.com