# !IMPORTANT SECURITY NOTICE FOR IIS AND APACHE WEB SERVER USERS! #

-BACKGROUND-
RackForms allows you to save XML job files. These files are exactly what they sound like, XML structured files with your jobs 
information. You can use these files to create archives of existing jobs and, using the Upload XML function, restore a job that 
has been removed from the RackForms system.

By design, all XML files output from RackForms are saved to /output/xml/


-THE CONCERN-
As your job's XML file contains all job information, their is a potential security risk, as if your job contains sensitive 
information such as Database passwords and other information, any web user on your site would be able to navigate to your RackForms 
/output/xml/ directory and read these sensitive XML files. 


-THE FIX-
To prevent unwanted access to your /output/xml/ directory, starting with RackForms version 561 their are two security precautions, 1 for each type of Web Server you may be using:

FOR APACHE USERS:
An .htaccess file is now included in the /output/xml/ directory with the following options:
Options -Indexes
Deny from All

These two directives will prevent users from listing the contents of your /output/xml/ directory, as well as prevent Apache from "serving" 
any of the .xml job files. 

FOR IIS USERS:
IIS users need to select the /output/xml/ directory in Internet Services Manager and make sure:
-Directory Browsing is disabled
-Read/write permissions are unchecked
Please see: http://support.microsoft.com/kb/313075 for detailed instructions.


-THE TEST-
In both cases, test your security settings by navigating to the /output/xml/ directory. Assuming your RackForms folder is: 
[rackforms]

Type: http://www.yourhost.com/rackforms/output/xml
You should see a "Access Forbidden" or similar message.

Now create a simple text in the /output/xml/ directory and call it test.xml.
Now type http://www.yourhost.com/rackforms/output/xml/test.xml in your browsers address bar.

Again, you should see a "Forbidden" or similar message. 

If you receive the "error" messages for both tests, your /output/xml/ directory is safe. If you can still view the directory 
structure or download/view the test.xml file, please be sure you have followed the steps above. If the problem persists, please email 
support at support@rackforms.com.

