HTTP Server Security Issue

["Stone, Brad V (TC)" <bvstone@xxxxxxxxxxxxxx>]

Recently I was playing around with a CGI program that I developed to run on
our old V3R2 machine.  Now we are on V4R3.  In the past, I'm sure that when
you were calling an RPG CGI program it had to be in uppercase in the URL.  

Now it seams it doesn't matter.  Using
/cgi-bin/CGIPGM1
or
/cgi-bin/cgipgm1

Will do the same thing and call the CGI program just fine.  Which leads to
an interesting point:

If you have a protection directive set up in your HTTP Config on
CGIPGM1.PGM, if the user types the URL in in lower case, the protection is
ignored.

Taking this a step further, any combination of upper and lower case will be
ignore except the EXACT protection directive you have given.  So, if your
directive looks like this:

Protect /QSYS.LIB/AS400CGI.LIB/CGIPGM.PGM CGIPGMP

where CGIPGMP is a protection directive set up, if the user types in 
CGIPGM on the url, the protection will work.  If, on the other hand, they
type in 
cgipgm
CgiPgm
cgiPgm
etc.. etc...

The protection is ignored.

This has got to be a bug or else I'm missing something else here.  I'd like
to hear from anyone using a protection directive on an CGI program and see
if they have the same results.

Bradley V. Stone
Taylor Corporation - OASIS Programmer/Analyst   
bvstone@taylorcorp.com


+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---