Netscape Enterprise Server has introduced JHTML, the Netscape equivalent of Microsoft's Active Server Pages. On poorly configured sites it is possible to retrieve the unparsed source of these JHTML files. This problem affect 3.5.1 and possibly other versions such as 3.6 on all platforms such as Windows NT and Solaris. Details Netscape Enterprise Server has a built-in search engine which is operational by default. This search engine uses Pattern (.pat) files to regulate and format the results. These pattern files can be found in the /search-ui/text directory. The search engine can be configured by editing these pattern files to return the whole document in the search results - however, this must be turned on by the Admin by making modifications to a "collection's" dblist.ini to point the NS-tocrec-pat to the HTML-tocrec-demo1.pat pattern file as per the Netscape documentation. It is possible, however, to build a special search request that will return the whole the document in the search results without this feature having to be turned on. In this way we can retrieve the source of JHTML files and other scripts. http://no-such-server/search?NS-search-page=results&NS-query=A&NS-collection =B&NS-tocrec-pat=/text/HTML-tocrec-demo1.pat where A is the query e.g. the word "that" and B is the collection e.g. "Web+Publish" or "web_htm". Being fair to Netscape, in their documentation is states that HTML-tocrec-demo1.pat only displays HTML files - though this implies that if the file is not HTML, which JHTML is not just quite, it won't be displayed. This obviously is wrong. Another way is to get the source is to issue the request: http://no-such-server/search?NS-search-page=document&NS-rel-doc-name=/path/t o/indexed/file.jhtml&NS-query=URI!=''&NS-collection=A where A is the collection without having to go through the rigmarole of playing around with HTML-tocrec-demo1.pat in the URL. The solution to this problem is to store all JHTML files (or other scripts) in a directory that is not indexed and be wary of the default Web Publishing collection. If you don't need the search capability of NSE then disable it. Cheers, David Litchfield Arca Systems Inc, an Exodus Communications company http://www.arca.com http://www.infowar.co.uk/mnemonix
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 14:54:28 PDT