Wednesday, August 14, 2002

Prevent Directory Browsing in Radio

I think this should be an option built in to Radio, but it’s relatively easy for you to do on your own. Here’s the issue: Radio is a web content management system – when you add content to Radio, it automatically uploads that content to your website. For many users, their web site is hosted at http://radio.weblogs.com/. ( Others, like me, host it at their own domain.) Radio maintains its content in a hierarchical folder structure. But relatively savvy individuals can type in your URL and add folders they want to “snoop” on – and Radio doesn’t prevent this.



There’s an easy way to do this: drop a text file into any folder you want to restrict access to. The text file is just a couple lines, and it includes a meta refresh command that forces the browser to load a new page. Here’s my file – save it as index.txt, and drop it into any folder other than your “www” folder.



To try this out, try going to someone’s Radio weblog and adding /categories after the URL. You’ll now see all the categories they’ve set up. This isn’t necessarily snooping, but there may be some private categories they’ve posted. (There are other examples, but hopefully you get the idea.) If you’re the individual maintaining the blog in Radio, adding this text file to the folder will automatically redirect the browser to your site’s home page.



Memo to Userland: I’d like this to be an option in the application itself. If I disable directory browsing, Radio should automatically drop this text file into any folder it creates.

No comments:

Post a Comment