[Zope] FrontPage Extensions incompatible with Zope?

Dimitris Andrakakis dandraka_info@yahoo.com
Wed, 7 Mar 2001 01:36:38 +0200


Dieter wrote:
> That is Zope specific.
> Other HTTP servers will not mind names beginning with '_'.

Sure, but that doesn't solve the problem :-)

> Hugh, what is that "custom HTTP-based RPCs"? Never heard about this!
> Why does "FrontPage" not simply use "PUT"?

Are you asking "why" ? When it comes to MS, who knows ?
I quote from http://www.insecure.org/sploits/Microsoft.frontpage.insecurities.html

> First of all, Frontpage is braindammaged (just have to set the stage).
>
> Ok, Frontpage works like this when you want to publish files:
>
> It tries to GET "http://www.yourdomain.com/_vti_inf.html".  This file
> contains the version of the FP extensions and the path on the server
> where the extensions are located.  When you use Frontpage to upload content,
> it will try and fetch this file, if it can, it then tries to POST to
> "http://www.yourdomain.com/_vti_bin/shtml.exe/_vti_rpc" (that's the default).

(there are more, interesting enough for you to read).

> Seems, it wants only work together with IIS?

IIS or any web server with frontpage extensions. Apache, Netscape & Oreilly,
can be configured this way --but that's a *really* bad idea, patricularly for
Apache.

Dimitris @ Nuclear