Enabling Directory Listings in User's Web Directories

Jul 10 20:41 UTC 1999

This is kind of an obscure/minor point, but the issue came up and staff
thought it might as well have some public discussion.

Grex allows people to create web directories for themselves.  Normally
one would create an index.html file in each directory which would be
displayed if access the directory without specifying a file (eg, if you
hit http://www.grex.org/~janc/ then you see the (boring) contents of
/a/j/a/janc/www/index.html.  The question at issue is what happens if
there is no index.html file in a web directory, and someone tries to
access the directory.  Two options are common:

(A) You get a directory list, listing names, last modification dates,
    and sizes of files in the directory.  Clicking on a file name
    displays the file.

(B) You get an error.

Grex is currently configured for option B.  The thought was that option
A, though common, is not an intuitively expected behavior.

Some people have wondered if we should turn this on.  Staff generally
didn't seem to give a darn one way or the other.

response 2 of 38:

Jul 11 08:40 UTC 1999

Why not make a link to /etc ?

response 4 of 38:

Jul 13 14:14 UTC 1999

Me, too.  I hate for people to get an error message when they
try to do something.

response 6 of 38:

Jul 13 15:31 UTC 1999

You could only see the user's public_html directory, right?  Not their 
home directory.

response 8 of 38:

Jul 13 19:12 UTC 1999

Stick with option B.  People have no business snooping, even if by accident,
in others' file directories.  If the owner wanted the user to see the contents
of the directory, he could prepare an index.html or some other file for that
purpose.

response 10 of 38:

Jul 14 04:25 UTC 1999

Yes.

response 12 of 38:

Jul 14 05:52 UTC 1999

Yes.  All you would need do is visit
        http://www.cyberspace.org/~mdw/root/a/l/i/lilmo
Now, you *could* argue that perhaps I shouldn't have a symlink to root
in my www directory, but the fact is, I didn't use any special
permissions to make it, so anyone could make this, so if we turn the
directory option on, we ought to be willing to publish everyone's home
directory in just this fashion.  Or, even better yet, perhaps we should
set it up so that http://www.cyberspace.org/everything/a/l/i/lilmo works
and we don't need to worry about search engines discovering 6 different
paths to everything on grex.

response 14 of 38:

Jul 14 06:56 UTC 1999

I agree with Marcus. Yes. Let's say that I have a group of files
available under http://www.cyberspace.org/~fungster/naotw, like
when I was publishing News Articles of the Week. Each NAOTW file
is individually numbered. I could have had a link on the main
NAOTW page to www.grex.org/~fungster/naotw/archive to the
individual file, which are all named under a date scheme, but
because of the current configuration, I have to make a page
with the links to them, which actually uses up more bandwidth
than it would option A.

response 16 of 38:

Jul 15 02:10 UTC 1999

Why?  Symlinks would probably be turned off only for users' www
directories, not for system directories.  I don't think a lot of users
have any compelling need for symlinks.

The bigger problem with turning symlinks off is that doing so means
Apache must check every directory in the path name to see if it is a
symlink, and this can be a bit slow.  That's the main reason we
currently have them enabled.  However, if the symlinks were turned off
only in the user directories, it would check only the part of the path
name below the user's www directory, which normally isn't much.

response 18 of 38:

Jul 16 03:19 UTC 1999

I don't have any strong opinions one way or the other about whether
directory listings should be turned on or not.  I don't have any strong
opinions about whether symbolic links should be followed if they are
turned on.

response 20 of 38:

Jul 22 02:02 UTC 1999

My druthers would be to have both directory listings and symlinks
enabled, on the grounds that I can think of reasonable uses for
both features, and that enabling them will not allow people to
see any files and directories that they can't already see when
they telnet or direct-dial in.

Speaking from personal experience, I've used the symlink feature
(to make a file that's not in my web directory visible via the
web) and the directory-listing feature (not on Grex, to make a
group of related files available over the web without the hassle
of having to maintain an index file). Not having those features
available would make things somewhat less convenient for me.
And if they're useful to me, they're no doubt useful to other
people too. 

The Grex philosophy has always been that we keep the system as
open as possible, depermitting features only when permitting them
proves to be a significant problem. We do a modest amount of
protecting the users from themselves -- e.g. not making people's
mail files and directories world-readable -- but aside from that
protecting a user's files is basically that user's responsibility.
Why should we have a different philosophy from that for web access?

If you think about it, saying that directory listings shouldn't
be enabled because the feature could be used for potentially
mischievious purposes is like saying that users shouldn't have
access to the C compiler because it can be used for potentially
mischievious purposes. In fact, the C compiler *is* regularly
used for mischievious purposes, like writing fork bombs and
compiling eggdrop. That's a worse problem than anything that
could happen from enabling directory listings over the web, I
think. But I don't hear anyone saying that we should take the
C compiler away from users.

So I'd like to see web directory listings enabled, and have
symlinks continue to be enabled as well.

response 22 of 38:

Jul 22 18:38 UTC 1999

I like symlinks, keep 'em.  #21 said quite well why I think that directory
listings for missing index.html file should *not* be enabled.