Prevent Santy with htaccess?

[kusadasi-guy]

Shawn recommend for preventing santy that

Make a .htaccess file with the following in the root folder:
RewriteEngine on
RewriteCond %{HTTP_USER_AGENT} ^LWP* [OR]
RewriteCond %{HTTP_USER_AGENT} ^lwp*
RewriteRule .* - [F]That will of course require your server allows you to use mod_rewrite.

as i as i know that htaccess file prevent infamous browser access to the website. am i correct?

And, it may close the access to googlebot, msnbot, yahoobot ..etc?

[flawebworks]

This shouldn't affect robots at all, unless they're indicated. It's preventing the user agent lwp (which is a perl module that can be used with a script to get files) from accessing your site.

[kusadasi-guy]

Thank You so much!

[subnet_rx]

I thought Santy only affects phpBB forums?

[GuyFromChicago]

No, it exploits php...which phpbb happens to use.

[Will.Spencer]

This work-around does not work against today's new Santy variant which spoofs User-Agent.

Also, Santy appears to exploit the phpBB highlight vulnerability -- but may not exploit the php unserialize vulnerability.

[GuyFromChicago]

Do you know what user agent(s) Santy is spoofing?