PR 38699, 39518, 42005, 42006, 42007, 42008, 42009
The patches are all his, and are sufficiently trivial to review
at a glance.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@557837 13f79535-47bb-0310-9956-ffa450edef68
always returns APR_INCOMPLETE on Unix platforms in the case that the
call to the native stat / lstat did not fail. So we can safely assume
that the stat / lstat call has been successful in this case.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@491297 13f79535-47bb-0310-9956-ffa450edef68
of literal values.
Patch by: Dan Rall <dlr apache.org>
* server/request.c
(ap_process_request_internal): Check the return value of hook functions
against the constant OK instead of the magic number 0 to improve clarity.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@368505 13f79535-47bb-0310-9956-ffa450edef68
Merge from branches/authz-dev
Basically here is a list of what has been done:
- Convert all of the authz modules from hook based to provider based
- Remove the ap_requires field from the core_dir_config structure
- Remove the function ap_requires() since its functionality is no
longer supported or necessary in the refactoring
- Remove the calls to ap_some_auth_required() in the core request
handling to allow the hooks to be called in all cases.
- Add the new module mod_authz_core which will act as the authorization
provider vector and contain common authz directives such as 'Require',
'Reject' and '<RequireAlias>'
- Add the new module mod_authn_core which will contain common
authentication directives such as 'AuthType', 'AuthName' and
'<AuthnProviderAlias>'
- Move the check for METHOD_MASK out of the authz providers and into
the authz_core provider vector
- Define the status codes that can be returned by the authz providers
as AUTHZ_DENIED, AUTHZ_GRANTED and AUTHZ_GENERAL_ERROR
- Remove the 'Satisfy' directive
- Implement the '<RequireAll>', '<RequireOne>' block directives to
handle the 'and' and 'or' logic for authorization.
- Remove the 'AuthzXXXAuthoritative' directives from all of the authz
providers
- Implement the 'Reject' directive that will deny authorization if the
argument is true
- Fold the 'Reject' directive into the '<RequireAll>', '<RequireOne>'
logic
- Reimplement the host based authorization functionality provided by
'allow', 'deny' and 'order' as authz providers
- Remove the 'allow', 'deny' and 'order' directives
- Merge mod_authn_alias into mod_authn_core
- Add '<RequireAlias>' functionality which is similar to
'<AuthnProviderAlias>' but specific to authorization aliasing
- Remove all of the references to the 'authzxxxAuthoritative'
directives from the documentation
- Remove the 'Satisfy' directive from the documentation
- Remove 'Allow', 'Deny', 'Order' directives from the documentation
- Document '<RequireAll>', '<RequireOne>', 'Reject' directives
- Reimplement the APIs ap_auth_type(), ap_auth_name() as optional
functions and move the actual implementation into mod_authn_core
- Reimplement the API ap_some_auth_required() as an optional function
and move the actual implementation into mod_authz_core
Major Changes:
- Added the directives <RequireAll>, <RequireOne>, <RequireAlias>,
Reject
- Expanded the functionality of the directive 'Require' to handle all
authorization and access control
- Added the new authz providers 'env', 'ip', 'host', 'all' to handle
host-based access control
- Removed the directives 'Allow', 'Deny', 'Order', 'Satisfy',
'AuthzXXXAuthoritative'
- Removed the ap_require() API
- Moved the directives 'AuthType', 'AuthName' out of mod_core and into
mod_authn_core
- Moved the directive 'Require' out of mod_core and into
mod_authz_core
- Merged mod_authn_alias into mod_authn_core
- Renamed mod_authz_dbm authz providers from 'group' and 'file-group'
to 'dbm-group' and 'dbm-file-group'
Benefits:
- All authorization and access control is now handle through two
directives, 'Require' and 'Reject'
- Authorization has been expanded to allow for complex 'AND/OR' control
logic through the directives '<RequireAll>' and '<RequireOne>'
- Configuration is now much simpler and consistent across the board
- Other modules like mod_ssl and mod_proxy should be able to plug into
and take advantage of the same provider based authorization mechanism
by implementing their own providers
Issues:
- Backwards compatibility between 2.2 and 2.3 configurations will be
broken in the area of authorization and access control due to the fact
that the directives 'allow', 'deny', 'order' and 'satisfy' have been
removed. When moving from 2.2 to 2.3 these directives will have to be
changed to 'Require all granted', 'Require all denied' or some variation
of the authz host-based providers.
- Existing third party authorization modules will have to adapt to the
new structure.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@368027 13f79535-47bb-0310-9956-ffa450edef68
that not one other member of the r->vars is initialized
herein. Move this initialization elsewhere.
(If this is the 'default' - it really aught to be the
zero value, for that matter).
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@295141 13f79535-47bb-0310-9956-ffa450edef68
next_filter is NULL, since this implies that the subrequest will be
internal_fast_redirect'ed or will never be called. See line request.c:1513
onwards (in make_sub_request) also.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@291914 13f79535-47bb-0310-9956-ffa450edef68
"Symbolic link not allowed", which results in much head-scratching
if the actual problem is a broken link of some sort. The real
fix would be to propogate the correct apr_stat error into the
error log, but that would require more refactoring than I'm
prepared to do. This change simply expands the error message
to include both possibilities. It improves the situation for
PR28515 but does not solve it.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@280018 13f79535-47bb-0310-9956-ffa450edef68
internalise the ap_reg*<->PCRE wrapper:
* configure.in: Add srclib/pcre to the include path.
* include/ap_regex.h: Renamed from include/pcreposix.h. Prefix all
constants with AP_; prefix all functions and types with ap_. Define
AP_DECLARE to nothing if necessary. Remove regcomp error codes.
* include/httpd.h: Include ap_regex.h not pcreposix.h.
(ap_pregcomp, ap_regexec, ap_regfree): s/regex_t/ap_regex_t/.
(ap_regexec, ap_regerror): Prototypes moved to ap_regex.h.
* server/util.c (regex_cleanup, ap_pregcomp, ap_pregsub, ap_pregfree):
Adjust for ap_ prefixed types. (ap_regexec, ap_regerror): Removed.
* server/Makefile.in: Build util_pcre.c.
* server/util_pcre.c: Copied from srclib/pcre/pcreposix.c; remove use
of PCRE-internals to do error mapping; rename types to add AP_/ap_
prefixes as above. Use APR includes. (ap_regerror): Use apr_snprintf.
* srclib/pcre/Makefile.in: Don't build pcreposix.c into libpcre.la.
* modules/*: Update to use new type and constant names.
PR: 27750 (part one)
Submitted by: Andres Salomon <dilinger voxel.net>, Joe Orton
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@153384 13f79535-47bb-0310-9956-ffa450edef68
bottom (APR/system) up -- we can't give the client a 64bit API and
then cast it to 32bits internally without introducing security holes
on other platforms.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@105572 13f79535-47bb-0310-9956-ffa450edef68
control over what options can be used in .htaccess files.
PR: 29310
Submitted by: Tom Alsberg <alsbergt-apache cs.huji.ac.il>
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@104283 13f79535-47bb-0310-9956-ffa450edef68
because of the changes to the argument lists of apr_mmap_dup and apr_socket_create,
2.1-dev won't build with apr and apr-util's 0.9 branch anymore
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@101154 13f79535-47bb-0310-9956-ffa450edef68
new LimitInternalRecursion directive configures limits of subsequent
internal redirects and nested subrequests, after which the request
will be aborted.
[William Rowe, Jeff Trawick, Andr� Malo]
PR: 19753 (and probably others)
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@99911 13f79535-47bb-0310-9956-ffa450edef68
decoded into '/', allowing the *_walk to do their magic and
return 404 if it's in the path, and allowing it in the path-info.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@98479 13f79535-47bb-0310-9956-ffa450edef68
Factor out the opts/override merging (since we do it three times)
and eliminate all the nasty goto's. This bug likely caused all
sorts of dir_walk configuration issues including htaccess issues.
Also add a few more docs where things aren't so obvious.
PR: 14147
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@97380 13f79535-47bb-0310-9956-ffa450edef68
which affected DAV MOVE operations and even general file access.
PR 14147, 10687, 10236 [Dan Good <debug@gooddan.com>]
I'm accepting Jeff Trawick's suggestion of twisting the test into an
assert, since it seems very unlikely (after correctly resetting the flag)
that this will fault.
Reviewed by: Jeff Trawick, Will Rowe
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@97366 13f79535-47bb-0310-9956-ffa450edef68
when we are the main request.
This fixes a problem with mod_include printing out an error message on DAV
sub-requests because mod_dav will return DONE instead of OK. This would
result in the correct output merged in with an error string.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@96642 13f79535-47bb-0310-9956-ffa450edef68
