- up to 2.2.14, fixes CVE-2009-3095 and CVE-2009-3094

[packages/apache.git] / apache-httpd.conf

diff --git a/apache-httpd.conf b/apache-httpd.conf
index efd2f95518464ed68b2eeb23f16a50507698f0e2..37b794206d09b9b0b24964669d1675637495ec6e 100644 (file)
--- a/apache-httpd.conf
+++ b/apache-httpd.conf
@@ -63,8 +63,30 @@ ServerTokens Full
 ServerSignature On
 HostnameLookups Off
 
+TraceEnable Off
+
 # Include other modules and packages config.
 Include conf.d/*.conf
 
 # Include webapps config
 Include webapps.d/*.conf
+
+<IfModule alias_module>
+       # ScriptAlias: This controls which directories contain server scripts.
+       # ScriptAliases are essentially the same as Aliases, except that
+       # documents in the target directory are treated as applications and
+       # run by the server when requested rather than as documents sent to the
+       # client.  The same rules about trailing "/" apply to ScriptAlias
+       # directives as to Alias.
+       #
+       ScriptAlias /cgi-bin/ "/home/services/httpd/cgi-bin/"
+
+       <Directory "/home/services/httpd/cgi-bin">
+               AllowOverride None
+               Options None
+               <IfModule mod_authz_host.c>
+                       Order allow,deny
+                       Allow from all
+               </IfModule>
+       </Directory>
+</IfModule>