Symlinks & Security

robfrew

Well-Known Member
#1
Just recently we updated to the latest version of LS. We had symbolic links to another directory outside of one of our virtual host directories so that is could access images from another virtual host. This has worked correctly since version 3.3.2 but after the latest update, it no longer works.

According to the documentation, to prevent access to files outside of the VH Root, we have to set 'Restrained' to Yes. However, if we have a symbolic link, 'Follow Symbolic Link' should be set to Yes as well and that will allow us to access only those files outside the root.

We have both set to Yes but they do not work as documented.
 

mistwang

LiteSpeed Staff
#2
If you configure vhost natively via web console, you can create a static context pointing to the directory that the symbolic link points to. That's the only way to allow accessing file outside vhost root when "Restrained" is set to yes.
 
Top