From Gallery Codex
- In a multisite Gallery 2.2 environment, I write "/onesite/people.php" in the URI for new guest view field. Then I click the Generate Files button, and it shows the PHP code for the new file. I copy this into a text file called "people.php" and move it to the public "/onesite" directory. But the Multiroot module remains pending of configuration in the plugins administration section. If I enter to configure again, all the fields are empty as the begining; and if an anonymous visitor opens "/onesite" it doesn't jump to the specified subalbum.
- --Narcis Garcia 03:14, 23 August 2007 (PDT)
It seems very easy to escape from multiroot
It seems very easy to escape from multiroot. All that's required is to take an image URL (probably /gallery2/main.php?g2_view...) and reduce it to simply /gallery2/main.php. At that point you're at the real root.
I tried blocking main.php with my Apache config, but that didn't work because then all images were blocked.
Am I missing something?
