www/apache
1
0
Fork 0
mirror of https://github.com/apache/httpd.git synced 2025-11-08 04:22:21 +03:00
Code Activity

when asking the providers for authentication, the main loop should

Browse Source 
not only  break, if access is granted. It should also break, if
access was *denied*  by one provider. To be safe, it has to break
also, if an error occured. So  the patch turns the condition around
and continues only, if the user was  not found.
I find it also weird, that if auth was denied (by password
usually), the  AuthBasicAuthoritative behaviour can override that
by "passing to lower  modules". The patch changes that behaviour,
too.

Justin notes:
I'm kind of on the fence about that.  I was originally thinking
optimistically, but yeah, it might make sense to do it
pessimistically.  If there's any error, bug out.

Submitted by:	Andre Malo <nd@perlig.de>


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@97801 13f79535-47bb-0310-9956-ffa450edef68
This commit is contained in:
Wilfredo Sanchez
2002-12-08 21:10:37 +00:00
parent 6c3569b193
commit 1f8f74d25c
2 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
modules/aaa/mod_auth_basic.c
View File

@@ -264,8 +264,8 @@ static int authenticate_basic_user(request_rec *r)
auth_result = provider->check_password(r, sent_user, sent_pw);
/* Access is granted. Stop checking. */
if (auth_result == AUTH_GRANTED) {
/* Something occured. Stop checking. */
if (auth_result != AUTH_USER_NOT_FOUND) {
break;
}
@@ -281,7 +281,7 @@ static int authenticate_basic_user(request_rec *r)
int return_code;
/* If we're not authoritative, then any error is ignored. */
if (!(conf->authoritative)) {
if (!(conf->authoritative) && auth_result != AUTH_DENIED) {
return DECLINED;
}