[Xitami] security question about Xitami & CGI's

[admin]

--=====================_77794234==.ALT
Content-Type: text/plain; charset="us-ascii"; format=flowed


Please take a look at the CGI result below.
This would indicate that anyone who has a virtual hosted web site on this 
drive can read and write to any file on the drive.
Is there any way to allow CGI's but to block read and write permissions to 
all directories except a specific one in the specified users directory list 
in order to secure the data somehow?
Any ideas highly appreciated.

=================================

Environment Variable: Value

CGI_Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, 
application/vnd.ms-powerpoint, application/vnd.ms-excel, 
application/msword, application/x-shockwave-flash, */*
CGI_AuthType:
CGI_ContentLength: 0
CGI_ContentType:
CGI_GatewayInterface: CGI/1.1
CGI_PathInfo:
CGI_PathTranslated: C:/HTTP/webpages
CGI_QueryString:
CGI_Referer: Displays the path to the page calling the CGI
CGI_RemoteAddr: *.*.*.*
CGI_RemoteHost: *.*.*.*
CGI_RemoteIdent:
CGI_RemoteUser: -
CGI_RequestMethod: GET
CGI_ScriptName: /cgi-bin/testcgi.exe
CGI_ServerName: [Intentionally left this out for security reasons but it 
shows the web site ]
CGI_ServerProtocol: HTTP/1.1
CGI_ServerPort: 80
CGI_ServerSoftware: Xitami
CGI_UserAgent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Testing drive write...
Opening file 1
Writing to file 1
Closed file 1

--=====================_77794234==.ALT
Content-Type: text/html; charset="us-ascii"

<html>
<br>
Please take a look at the CGI result below.<br>
This would indicate that anyone who has a virtual hosted web site on this
drive can read and write to any file on the drive.<br>
Is there any way to allow CGI's but to block read and write permissions
to all directories except a specific one in the specified users directory
list in order to secure the data somehow?<br>
Any ideas highly appreciated.<br><br>
=================================<br><br>
Environment Variable: Value <br><br>
CGI_Accept: <b>image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,
application/vnd.ms-powerpoint, application/vnd.ms-excel,
application/msword, application/x-shockwave-flash, */*<br>
</b>CGI_AuthType: <br>
CGI_ContentLength: <b>0<br>
</b>CGI_ContentType: <br>
CGI_GatewayInterface: <b>CGI/1.1<br>
</b>CGI_PathInfo: <br>
CGI_PathTranslated: <b>C:/HTTP/webpages<br>
</b>CGI_QueryString: <br>
CGI_Referer: Displays the path to the page calling the CGI<br>
CGI_RemoteAddr: <b>*.*.*.*<br>
</b>CGI_RemoteHost: <b>*.*.*.*<br>
</b>CGI_RemoteIdent: <br>
CGI_RemoteUser: <b>-<br>
</b>CGI_RequestMethod: <b>GET<br>
</b>CGI_ScriptName: <b>/cgi-bin/testcgi.exe<br>
</b>CGI_ServerName: [Intentionally left this out for security reasons but
it shows the web site ]<br>
CGI_ServerProtocol: <b>HTTP/1.1<br>
</b>CGI_ServerPort: <b>80<br>
</b>CGI_ServerSoftware: <b>Xitami<br>
</b>CGI_UserAgent: <b>Mozilla/4.0 (compatible; MSIE 6.0; Windows NT
5.1)</b> <br><br>
Testing drive write... <br>
Opening file 1<br>
Writing to file 1<br>
Closed file 1<br>
</html>

--=====================_77794234==.ALT--