I guess this is a misconfiguration bug but I want to ask anyway;
First, my public www directory is
/var/www/domain.com/public_html. When I root login to SSH and create a sym link on the
public_html directory (
ln -s // root) and in that directory create an htaccess file with the following contents
Options all DirectoryIndex Sux.html AddType text/plain .php AddHandler server-parsed .php AddType text/plain .html AddHandler txt .html Require None Satisfy Any
and then open the site in a browser, I can even list
/var, actually all directories and all files.
Now, how can Apache list all these directories, even domain.com which belongs to user and group (lets say domainusr) and apache is nobody? Isn't that a security bug?