[Pkg-roundcube-maintainers] Bug#476162: conf.d/roundcube shouldn't contain any Alias entries

[Roderick Schertler]

Package: roundcube
Version: 0.1-4
Severity: normal

The Apache configuration snippet in /etc/apache2/conf.d/roundcube is
loaded by the server outside of any virtual host definition, so it
applies to all viertual hosts.  This means that the 

    Alias /roundcube/program/js/tiny_mce/ /usr/share/tinymce/www/

there applies to all virtual hosts, and so that path allows access to
that directory from all your virtual hosts.

Just a few lines down from there is this entry:

    # This alias does not work properly with several hosts on your apache server
    # Uncomment it to use it
    #    Alias /roundcube /var/lib/roundcube

The tiny_mce Alias should similarly be commented out by default.

-- 
Roderick Schertler
roderick at argon.org