title: How do I access the parent directory of public_html in Apache?
body: <p>I remember reading a while ago how it's possible for someone to access your computers filesystem from the website. I want to know how to do it, so I can test and prevent it from happening. </p>
  
  <p>Running Apache 2.4 on Windows via XAMPP</p>
  
  <p>My virtualhost is set up like so:</p>
  
  <pre><code>&lt;VirtualHost *:80&gt;
      ServerName local.scrap
      DocumentRoot "D:/Dropbox/www/scrap/public_html/"
      &lt;Directory "D:/Dropbox/www/scrap/"&gt;
      Order allow,deny
      Allow from all
      Require all granted
      &lt;/Directory&gt;
      ErrorLog "D:/Dropbox/www/scrap/logs/error.log"
  &lt;/VirtualHost&gt;
  </code></pre>
  
  <p>There is an <code>index2.html</code> in <code>scrap/</code> and <code>index.html</code> in <code>scrap/public_html/</code></p>
  
  <p>hosts is set up to be <code>127.0.0.1 local.scrap</code></p>
  
  <p>If I type the URL <code>http://local.scrap/</code> I get index.html.
  If I type the URL <code>http://local.scrap/../index2.html</code> it gets redirected to <code>http://local.scrap/index2.html</code></p>
  
  <p>Why is the ../ URL getting redirected to the DocumentRoot path?</p>