diff --git a/roles/copr/backend/templates/lighttpd/lighttpd.conf b/roles/copr/backend/templates/lighttpd/lighttpd.conf index fa03a1eb57..243b087e5c 100644 --- a/roles/copr/backend/templates/lighttpd/lighttpd.conf +++ b/roles/copr/backend/templates/lighttpd/lighttpd.conf @@ -311,14 +311,14 @@ server.max-keep-alive-idle = 2 # Warning: This is sooo ugly. # # We only ever want to enable PHP CGI for the index generator file -# 'dir-generator.phpj, nothing else - so people can not execute their own -# scripts. IOW, non-conditional 'cgi.assign' can not be used! +# 'dir-generator.php', nothing else - so we are sure our users can not execute +# their own scripts. Therefore non-conditional 'cgi.assign' config can not be +# used. # -# To make 'index-file.names' work correctly, we have to set 'cg.assign' -# conditionally only on paths that both (a) end by slash (= directories) and -# (b) do not contain 'dir-generator' string. This guards against -# '/some/dir-generator.php/' hacks. - +# But to make the 'index-file.names' work correctly, we still have to set +# 'cgi.assign' conditionally - the trick is to do this only on paths that both +# (a) end with slash (= directories) and (b) do not contain 'dir-generator' +# string (guard against '/some/dir-generator.php/' or alike hacks). index-file.names = ( "/dir-generator.php" )