[cgiwrap-users] incorrect username extracted from PATHINFO

[Andrew V. <av...@dr...>]

I host a number of virtual domains that use cgiwrap, each owned by a
different user.

In many cases, cgiwrap incorrectly guesses the username the script
should run under.

To keep them out of the rest of my system, I disallow shell and chroot
their FTP session into their home directories.

Each virtual domain is defined like this:

NameVirtualHost 208.15.218.26
<VirtualHost 208.15.218.26>
    ServerAdmin web...@mc...
    DocumentRoot /home/ataylor/public_html
    ServerName www.mcfumbler.com
    AddHandler cgi-wrapper .cgi
    Action cgi-wrapper /cgiwrap/cgiwrap/ataylor
    <Directory /home/ataylor/public_html>
        Options Indexes Includes ExecCGI
    </Directory>
   <Directory /home/ataylor/public_html/havers/dross>
        Options Indexes Includes ExecCGI
    </Directory>
   CustomLog /var/log/httpd/mcfumbler.com-access_log combined
</VirtualHost>

This should allow the domain owner (ataylor in this case) to run
scripts through the wrapper anywhere in their web space.

However, this fails for http://www.mcfumbler.com/havers/dross/gm.cgi

It's as though Apache or cgiwrap ignores the "ataylor" part of the action
directive.

I used the following config to build the wrapper:

../configure  --with-local-contact-name=Webmaster \
  --with-local-contact-email=web...@dr... \
  --with-wall \
  --with-perl=/usr/bin/perl \
  --with-cgi-dir=public_html \
  --with-install-dir=/home/httpd/cgiwrap \
  --with-httpd-user=nobody \
  --with-minimum-uid=500 \
  --with-logging-file=/var/log/httpd/cgiwrap.log \
  --with-rlimit-cpu=15