Having directory browsing enabled allows users to see files that you've placed on a public web server, if you haven't taken even the trouble to "touch index.html" in a directory. This can't accurately be described as a security hole of any variety, much less "gargantuan". It also makes things a lot easier for those who actually want visitors to be able to see their files (which is usually why they're on a web server in the first place).
There are two solutions I know of that can be done without making any custom changes to the system, as mentioned upstream:
1. Create an index file.
2. Disable dynamic content. This doesn't have anything to do with "value added" anything (value doesn't depend on CGI or PHP), but if you must run CGI/PHP/whatever in the ibay, this obviously won't work.
There are other ways of doing it, but they're all going to take more work.
One such option is to disable indexes site-wide, but that will, as you've found, break the mp3 jukebox. No big loss there, really--netjuke is _much_ cooler, and doesn't depend on having indexing enabled (search here for instructions on installing it). You could do this by editing httpd.conf, but you'll lose your changes whenever you change the system configuration in certain ways; you'd be better off writing a custom template fragment to do this (as Bill's already provided a link about).
Yet another alternative would be to disable indexing on an ibay-by-ibay basis. You'd need to do some coding to do that, but you might want to take a look at
http://www.familybrown.org/howtos/advanced-ibay-howto.html to get you started (I strongly doubt it'll work on SME 5.6, but it might give you some ideas). FWIW, the 90e-smithAccess40ibays template on SME 5.6 does look very similar to the one on 4.1.2, so you might not need to change much.
10 Replies
2166 Views