apache: privilege escalation

Agreed. It *is* the standard behaviour of PATH-searching programs to consider an empty element to mean '.', but nobody seems to expect it: I've encountered empty elements half a dozen times now, and in each case the person who introduced it did so accidentally, thought an empty element would be skipped, and didn't realise the consequences.

Perhaps some (really crappy) code out there is depending on this behaviour. Let it break, I say. (Oddly Uli was happy to say 'let it break' about much more significant bodies of code at times.)