$Id: Apache.txt,v 1.6 2000/12/21 08:54:22 dan Exp $



FOR APACHE USERS
----------------

Table of Contents:

 1. Security considerations
 2. Useful rewrite ideas
 3. If you're using Windows



SECURITY CONSIDERATIONS
-----------------------

There are always security considerations when dealing with anonymous
external users accessing your system and data.

MiG itself mitigates these concerns where it can (for instance, a currDir
variable containing ".." causes MiG to panic and immediately exit), but it
can't do everything in itself.

The main thing MiG does to help with the security problem is that it never,
ever, writes anything to the disk.  It only reads.  This minimizes the
amount of damage potential that exists.

An example: MiG's PHP code can't control whether or not a web user fetches
your mig.cf files, exif.inf files and so forth by simply grabbing them with
direct URLs.  Users of Apache can use the following in their configuration
to get around this limitation:

<Directory /path/to/your/mig/gallery>
  # Protect against anyone trying to view a mig.cf file or the mig.cfg
  <Files ~ "^mig.cfg?$">
    order allow,deny
    deny from all
  </Files>
  # Protect against anyone trying to view exif.inf files
  <Files ~ "^exif.inf$">
    order allow,deny
    deny from all
  </Files>
</Directory>

With these rules in place, someone can't for example go to a URL like:

  http://tangledhelix.com/gallery/albums/Miscellaneous/mig.cf

to see that file.  It would be met with an access denial from the server.

(If you want to look at password protection ideas, see docs/Passwords.txt)



USEFUL REWRITE IDEAS
--------------------

You can use Apache's mod_rewrite module to make MiG URLs more simplified
and easier to remember.  Here's what I do on my own site:

  1. Define simple shortcut names using the jumpMap (see docs/Jump.txt)

  2. Add a rule or two like this to your httpd.conf:

       RewriteRule ^/go/([^/]+)		/gallery/index.php?jump=$1	[R]
       RewriteRule ^/photo/([^/]+)	/gallery/index.php?jump=$1	[R]

     That way you can use URLs like this:

       http://tangledhelix.com/photo/katie
       http://tangledhelix.com/go/katie

     And it will automatically go to the right place.  You can also do
     your own custom shortcuts of course, like these:

       RewriteRule ^/katie		/gallery/index.php?jump=katie	[R]
       RewriteRule ^/house		/gallery/index.php?jump=house	[R]
       RewriteRule ^/europe		/gallery/index.php?jump=europe	[R]

     So you can have even simpler URLs if you want for certain galleries,
     like http://tangledhelix.com/katie/

     Naturally you will need to put "RewriteEngine on" in the config prior
     to these rules, and have mod_rewrite built into your installation of
     Apache, for this to work.



IF YOU'RE USING WINDOWS
-----------------------

As far as I can tell, MiG doesn't seem to work /at all/ under Apache for
Windows.  At least not on my laptop.

