Boost-generated .htaccess file in cache dir re-written on CRON run

Admittedly I know nothing about AFS, but the directive are apache core directives setHandler requires <em>AllowOverride Fileinfo</em> to be set up on the apache server

http://httpd.apache.org/docs/2.2/mod/core.html#allowoverride

Options require <em>options</em>

http://httpd.apache.org/docs/2.2/mod/directive-dict.html#Override

and if Options +FollwsymLinks is not working, then clean URL's would not work and therefore boost would not either, However if clean urls are working then poassibly what is happening if that there is something like

<Directory "/cache_folder">
AllowOverride none
</DIrectory>

in play. You can quite easily hack the module by doing a search through the files with any decent text editor or searching program (I use grep) and remove the lines from the output but it's not advised in any way, the code is there to stop file/ command execution as anything other than outputting html as text to avoid the scenario where for example if your server had server side includes active for html files, then a cached file with

in the comments could execute a file on your system. So that would be the danger if you decide to remove those lines from boost.

I do not think it is AFS, I think it is your main server config because if you can enable mod_rewrite then symlinks are possible but in the server config you must have something like AllowOverride FileInfo and not AllowOverrride All.

set_handler is good (very) and it looks like symlinks are enabled by default on the server to enable you to have clean urls, so the options are not really that necessary since the first directive "none" just remove all options, and the second turns on the one required to allow rewrite to work. You should grep your boost files for

Drupal_Security_Do_Not_Remove_See_SA_2006_006

(good that you are using grep) as the easiest method of changing the module, you may have to disable and re-enable to get it to pick up the changes.

The only thing is that the 6.x is maintenance release only, it could be done on 7.x but in general it appears that most people have AllowOverride Options set by default on shared hosting and it's not an issue on dedicated hosting (VMS or otherwise) as they have complete control, I think in the last 6 months that there have only been two comments about this and one of those was not related, if BGM instructs me, then I would put it into the 7.x module but like quite a few things there's limited resources and time for features that only 1 out of a thousand would need.

It was however good that you were able to diagnoses that it was cron regenerating and used tools like grep to solve the issue, makes support a lot easier. I'd still be worried out the possibility of server being set up with Options Includes by default as though shtml is not fashionable it creates a great big exploitable hole if comments are not filtered correctly by core and the resultant files in the cache. Same with set_handler and some sites being set up to server everything through mod_php, bad idea but some people do it and we have to cover those scenarios.

Have you tried the setting at the bottom of the page admin/config/system/boost/htaccess to enable SymLinksIfOwnerMatch instead of FollowSymLinks ?

Philip

Can you use clean URL's ? if you can then SymLinksifOwnerMatch should work.

You have to download the dev version of boost possibly, (I wrote that section but don't know if it's been put through to stable even though it is).

I understand entirely about some shared hosting and Options not being permitted, but if mod rewrite (clean urls) works then somewhere in the server configuration SymLinks of some description are enabled which is why the configuration was put into boost, #1806158-3: Adding the "expire" module as recommended/dependencies

Commenting out any section of the module should be only a last resort as changes are going to be overwritten in the next release.