Re: PCI compliance issue

2009/6/2 Skip Evans <skip@bigskypenguin.com> > Hey all, > > The original programmer created the following in the system's .htaccess > file: > > RewriteCond %{REQUEST_FILENAME} !-f > RewriteCond %{REQUEST_FILENAME} !-d > RewriteRule .* index.php > > ...which sends any incorrect URL to the home page, correct? It rewrites any request for a non-existent file or directory to index.php. The first url (http://www.ranghart.com/cgi-bin/?D=A) requests the cgi-bin directory. Presumably this directory exists in some form which would prevent your rewrite rule from firing, but access to the directory is denied - hence the 403 FORBIDDEN. The second url (http://www.ranghart.com/cgi-bin/%3fD=A) requests a file called /cgi-bin/?D=A. This file genuinely doesn't exist so the url gets rewritten to index.php - hence your 200 OK response. -robin