Forum Moderators: phranque

Message Too Old, No Replies

Prevent script execution in cgi-bin with mod_rewrite?

How can I prevent .js files from being executed in the cgi-bin folder

         

Phaethar

2:26 pm on Apr 29, 2005 (gmt 0)



Hey all,

I'm looking for a bit of help here. I'm a newb at Apache for the most part, but I'm trying to set up a backup webserver to a production box. The production box is Windows running IIS, the backup box is Fedora 3 running Apache 2.0.52. So, I've moved all the required files over and set up the structure to match the current system. For the most part, things are working great, with 1 exception. On the current production box, we have some javascript files in the cgi-bin folder. This doesn't cause a problem on that box, but Apache automatically tries to run all files in that folder as a script. I'm trying to find a way to tell Apache to not run .js files in this folder, but I'm not having any luck. The Apache site mentions that it's possible, and hints that mod_rewrite might be the way to do it, but they don't actually provide any examples or instructions. Would something like this be possible? I can't really change the script to move the java files anyplace else, as the production and backup boxes both read off of the same app server that contains all the scripts.

Thanks in advance for any help.

sitz

11:26 pm on Apr 29, 2005 (gmt 0)

10+ Year Member



You've got a couple of options (three, if you count humor). =)

1) remove the ScriptAlias [httpd.apache.org]directive which applies to your cgi-bin directory, and replace it with a <Directory> container which has:
[code]
Options +ExecCGI [httpd.apache.org]

2) Move your .js files to another directory and use mod_rewrite to map incoming requests to the new location; that *should* keep the ScriptAlias from getting involved, although you *may* have to use the 'PT' flag on your RewriteRule to make things work. Test early, test often! =) There are Gobs(tm) of examples in the list archives on how to set up a basic RewriteRule (which is all you'd need).

3) Find the person who stuck .js files in the cgi-bin directory, and kick them. =)

Really, .js files have no business being in the cgi-bin directory anyway; CGIs, by definition, are supposed to run on the *server*, whereas javascript files (also by definition) run on the *client*.