Re: bozo .htpasswd exposure
JP <[email protected]> Tue, 20 Nov 2018 09:36:28 -0500
| Newsgroups | gmane.os.netbsd.devel.security |
|---|---|
| Message-ID | <CAHN8BqrirUZx-=bH4twmt1xYACeQkKJS73MCBms1LbuzXkm3eg@mail.gmail.com> |
I see it. I don't know why my .htpasswd is exposed then. I'll keep digging.. On Tue, Nov 20, 2018 at 9:34 AM Martin Husemann <[email protected]> wrote: > On Tue, Nov 20, 2018 at 03:31:44PM +0100, Martin Husemann wrote: > > On Tue, Nov 20, 2018 at 09:19:55AM -0500, JP wrote: > > > I don't see any code preventing the exposure of the file > > > > AUTH_FILE is missing from bozo_check_special_files() ? > > No, that one calls bozo_auth_check_special_files() and there is the check > that you are looking for. > > Martin >