0

Assuming a Linux/Unix system. Not asking about any particular server software, just wondering in general. I want to use this to include javascript libraries or things like that in multiple sites or subdomains.

2 Answers 2

1

Apache, at least, won't follow a symlink that points outside of the document root. This is for security reasons, as your question implies :).

I'd suggest pointing your symlink to a shared location that isn't necessarily "up" the directory tree. A sibling directory, for instance. If you can modify the server configuration you can add a new entry for that location, otherwise it will need to be somewhere under the document root.

0

I'm not convinced this question really exists here, as its a hypothetical (as you are not asking about particular server software). The hypothetical answer is yes. There could be a bug/feature of the web server which allows the user to traverse past the symlink and down other parts of the directory tree in an undesirable manor.

I do put to you that the problem is likely to be minor if the server has some kind of cgi/php/active pages as unless the server has some kind of jailing going on it is possible for someone who compromises a website to do this anyway.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .