Freepages-Help-L Archives

Archiver > Freepages-Help > 2003-06 > 1057008488


From: "Adrian Furniss" <>
Subject: Re: [FreeHelp] Include file
Date: Mon, 30 Jun 2003 22:28:52 +0100
References: <11f.2367f697.2c31c0ec@aol.com> <5.2.0.9.0.20030630124315.00acce60@mail.augustmail.com>


> No -- you cannot use http:// in a Server-side include. All references are
> relative to *THIS* server and cannot reference files on another server.

Whoops. Sorry folks, brain in neutral again.
I was thinking root-relative ("/") but slipped seamlessly into absolute.
Durrrr.





>>Why on earth the SSI gurus should have designed it this way I know not!

>My suspicion is that it had something to do with security. ../ from your
>home directory takes you into the server root -- and the webmaster may not
>want to allow users to imbed files from the server's own directories.

I've always assumed it's a security thing too and agree, webmasters might
well want to outlaw such access, but still doesn't explain (to me) why both
#..file and #..virtual are necessary. After all, there must still be an
inhibition in interpreting #..virtual to prevent access above "/".

I wonder if the Apache-SSI configuration settings allow <#include
virtual=...> to be turned off while leaving <#include file=...> intact?
That's the only thing that would make any kind of sense.


This thread: