The Options directive controls which
server features are available in a particular directory.
option can be set to None , in which
case none of the extra features are enabled, or one or more of
the following:
-
All
- All options except for
MultiViews .
-
ExecCGI
-
Execution of CGI scripts using
mod_cgi
is permitted.
-
FollowSymLinks
-
The server will follow symbolic links in this directory. This is
the default setting.
Even though the server follows the symlink it does not
change the pathname used to match against <Directory> sections.
The FollowSymLinks and
SymLinksIfOwnerMatch Options work only in <Directory> sections or
.htaccess files.
Omitting this option should not be considered a security restriction,
since symlink testing is subject to race conditions that make it
circumventable.
-
Includes
-
Server-side includes provided by
mod_include
are permitted.
-
IncludesNOEXEC
-
Server-side includes are permitted, but the
#exec
cmd and #exec cgi are disabled. It is still
possible to #include virtual CGI scripts from
ScriptAlias ed
directories.
-
Indexes
-
If a URL which maps to a directory is requested and there
is no
DirectoryIndex
(e.g., index.html ) in that directory, then
mod_autoindex will return a formatted listing
of the directory.
-
MultiViews
-
Content negotiated
"MultiViews" are allowed using
mod_negotiation .
Note
This option gets ignored if set
anywhere other than <Directory> , as mod_negotiation
needs real resources to compare against and evaluate from.
-
SymLinksIfOwnerMatch
- The server will only follow symbolic links for which the
target file or directory is owned by the same user id as the
link.
Note
The FollowSymLinks and
SymLinksIfOwnerMatch Options work only in <Directory> sections or
.htaccess files.
This option should not be considered a security restriction,
since symlink testing is subject to race conditions that make it
circumventable.
Normally, if multiple Options could
apply to a directory, then the most specific one is used and
others are ignored; the options are not merged. (See how sections are merged.)
However if all the options on the
Options directive are preceded by a
+ or - symbol, the options are
merged. Any options preceded by a + are added to the
options currently in force, and any options preceded by a
- are removed from the options currently in
force.
Note
Mixing Options with a + or
- with those without is not valid syntax and will be
rejected during server startup by the syntax check with an abort.
For example, without any + and - symbols:
<Directory "/web/docs">
Options Indexes FollowSymLinks
</Directory>
<Directory "/web/docs/spec">
Options Includes
</Directory>
then only Includes will be set for the
/web/docs/spec directory. However if the second
Options directive uses the + and
- symbols:
<Directory "/web/docs">
Options Indexes FollowSymLinks
</Directory>
<Directory "/web/docs/spec">
Options +Includes -Indexes
</Directory>
then the options FollowSymLinks and
Includes are set for the /web/docs/spec
directory.
Note
Using -IncludesNOEXEC or
-Includes disables server-side includes completely
regardless of the previous setting.
The default in the absence of any other settings is
FollowSymlinks .