Add hint toaliastraversal documentation

Document on what to do if an alias points to a file and should thus not end with a /
pull/99/head
Pascal Bach 2019-07-06 21:29:49 +02:00 committed by GitHub
parent 3b2713b537
commit 2a6d05ad55
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 1 additions and 0 deletions

View File

@ -23,3 +23,4 @@ In other words, the incorrect configuration of `alias` could allow an attacker t
It's pretty simple:
- you must find all the `alias` directives;
- make sure that the parent prefixed location ends with directory separator.
- or if you want to map a signle file make sure the location starts with a `=`, e.g `=/i.gif` instead of `/i.gif`.