iAuto script security risk

[phucdaat]

Just wondering bout the security risk on the iAuto script. For example: I can just type in the browser address bar to the path of system or any directories and I'm able to get in. Not only that the the files are set to be writetable. Is that going to be a big security issue here???

[phucdaat]

Are there any staffs watching the forum? 

[highnote]

Great Question.  I was wondering about this myself and when you brought it up, I began investigating it.
There is a fairly easy fix, though I had not tested it thoroughly for side-effects it seems to work in my configuration:

1) Create an error directory off the root called /error
2) Create an html page (called error.html) with an error message and FTP it into the new error directory: see attached file
3) Modify the .htaccess file in the root directory and add the following 4 lines at the end:

Options -Indexes
ErrorDocument 404 /error/error.html
ErrorDocument 403 /error/error.html
ErrorDocument 401 /error/error.html

-------------------------------
Direct accesses to directories should now fail by displaying the file /error/error.html

For more information, please read the entire article:
http://www.closetnoc.org/help/security.html

Regards,
Lou

[phucdaat]

Great! seems to work just fine. Thanks Lou