Re: CGI, semicolons, and so on...
john@math.nwu.edu (John Franks)
From: john@math.nwu.edu (John Franks)
Message-id: <9312301637.AA01034@hopf.math.nwu.edu>
Subject: Re: CGI, semicolons, and so on...
To: tcemail!FisherM@dxmint.cern.ch
Date: Thu, 30 Dec 1993 10:37:26 -0600 (CST)
Cc: www-talk@www0.cern.ch
In-reply-to: <2D2302D4@MSMAIL.INDY.TCE.COM> from "Fisher Mark" at Dec 30, 93 08:20:00 am
X-Mailer: ELM [version 2.4 PL23]
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Content-Length: 1134
According to Fisher Mark:
> The ability to,
> at will, change any script into a file by subtracting a ';' makes me
> nervous. My suspicion is that there will be more cases where you do not
> want to serve scripts as files than there will be cases of wanting to serve
> scripts as files ...
I think there is some confusion here. The suggestion under discussion
was to have a URL in which a path ending in ';' indicated a *request*
by the client to execute a file and one without the ';' indicated a
*request* to view it as a file. In my opinion, no sensible server
implementor would design a system where permission to execute a script
implied permission to to view it as a text file or vice versa.
Certainly no one in this discussion made that suggestion.
Any mechanism to determine who has permission to do what must necessarily
be independent of the URL since the client can write any URL it wants.
Other reasons have been pointed out why it is not a good idea to have
the existence of PATH_INFO data (i.e. a ';') imply the file is to be
executed.
John Franks Dept of Math. Northwestern University
john@math.nwu.edu