I can see how this could *possibly* be an issue. In theory, a user on a shared system could use an ErrorDocument directive to view file that the apache user/group had access to, but the user didn't (such as another user's .htaccess file. The directive would look something like this: ErrorDocument 404 /~otheruser/.htaccess However, in my version of apache (2.0.48) it doesn't work: Given a the set of files below: -- /www/foo/.htaccess -- [see below] (no other files in this directory) -- EOF -- -- /www/foo/bar/.htaccess -- Order Deny, Allow Deny from all -- EOF -- -- /www/foo/bar/secret -- you saw my secret! -- EOF -- And I tried the following values in in /www/foo/.htaccess ---- ErrorDocument 404 /foo/bar/secret ---- ErrorDocument 404 /foo/.htaccess ---- #I knew this one had no chance ErrorDocument 404 /etc/passwd ---- For the first two .htaccess files, I got this response: ----------- Not Found The requested URL /foo/baz was not found on this server. Additionally, a 403 Forbidden error was encountered while trying to use an ErrorDocument to handle the request. Apache/2.0.48 (Fedora) Server at localhost Port 80 ----------- For the last .htaccess file, I got this response: ----------- Not Found The requested URL /foo/baz was not found on this server. Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request. Apache/2.0.48 (Fedora) Server at localhost Port 80 ----------- The reason why the last one didn't work was because ErrorDocument files are relative to the server's DocumentRoot, not the filesystem root. The first request didn't work because of my "Deny From All" in foo/bar/.htacess, while the second request failed because of the restrictions placed by default on files starting with ".ht".
