* debian/conf/suphp.conf: by default, deactivate suPHP for applications in
/usr/share (owned by uid 0) (closes: #472352, closes: #420007)
* debian/control: bump standard-version
+suphp (0.6.2-3) unstable; urgency=low
+
+ * debian/conf/suphp.conf: by default, deactivate suPHP for applications in
+ /usr/share (owned by uid 0) (closes: #472352, closes: #420007)
+ * debian/control: bump standard-version
+
+ -- Emmanuel Lacour <elacour@home-dn.net> Wed, 04 Jun 2008 10:04:08 +0200
+
suphp (0.6.2-2.1) unstable; urgency=high
* Non-maintainer upload by the security team
<IfModule mod_suphp.c>
AddType application/x-httpd-php .php .php3 .php4 .php5 .phtml
suPHP_AddHandler application/x-httpd-php
- suPHP_Engine on
+
+ <Directory />
+ suPHP_Engine on
+ </Directory>
+
+ # By default, disable suPHP for debian packaged web applications as files
+ # are owned by root and cannot be executed by suPHP because of min_uid.
+ <Directory /usr/share>
+ suPHP_Engine off
+ </Directory>
+
# # Use a specific php config file (a dir which contains a php.ini file)
# suPHP_ConfigPath /etc/php4/cgi/suphp/
# # Tells mod_suphp NOT to handle requests with the type <mime-type>.
Priority: optional
Maintainer: Emmanuel Lacour <elacour@home-dn.net>
Build-Depends: debhelper (>> 4.1.16), apache2-prefork-dev (>= 2.2.0), apache2-mpm-prefork (>= 2.2.0) | apache2-mpm-worker (>= 2.2.0), libapr1-dev, docbook-to-man, pkg-config, dpatch
-Standards-Version: 3.7.2
+Standards-Version: 3.7.3
Package: suphp-common
Architecture: any