You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by sl...@apache.org on 2007/08/23 16:50:27 UTC
svn commit: r569020 - in /httpd/httpd/branches/2.2.x/docs/manual/mod:
core.html.en core.xml
Author: slive
Date: Thu Aug 23 07:50:26 2007
New Revision: 569020
URL: http://svn.apache.org/viewvc?rev=569020&view=rev
Log:
Merge r569000 from trunk:
Correct a common misconception: symlink restrictions
are policy restrictions, not security restrictions.
Modified:
httpd/httpd/branches/2.2.x/docs/manual/mod/core.html.en
httpd/httpd/branches/2.2.x/docs/manual/mod/core.xml
Modified: httpd/httpd/branches/2.2.x/docs/manual/mod/core.html.en
URL: http://svn.apache.org/viewvc/httpd/httpd/branches/2.2.x/docs/manual/mod/core.html.en?rev=569020&r1=569019&r2=569020&view=diff
==============================================================================
--- httpd/httpd/branches/2.2.x/docs/manual/mod/core.html.en (original)
+++ httpd/httpd/branches/2.2.x/docs/manual/mod/core.html.en Thu Aug 23 07:50:26 2007
@@ -2280,6 +2280,9 @@
<p>Note also, that this option <strong>gets ignored</strong> if set
inside a <code class="directive"><a href="#location"><Location></a></code>
section.</p>
+ <p>Omitting this option should not be considered a security restriction,
+ since symlink testing is subject to race conditions that make it
+ circumventable.</p>
</div></dd>
<dt><code>Includes</code></dt>
@@ -2320,8 +2323,11 @@
target file or directory is owned by the same user id as the
link.
- <div class="note"><h3>Note</h3> This option gets ignored if
- set inside a <code class="directive"><a href="#location"><Location></a></code> section.</div>
+ <div class="note"><h3>Note</h3> <p>This option gets ignored if
+ set inside a <code class="directive"><a href="#location"><Location></a></code> section.</p>
+ <p>This option should not be considered a security restriction,
+ since symlink testing is subject to race conditions that make it
+ circumventable.</p></div>
</dd>
</dl>
Modified: httpd/httpd/branches/2.2.x/docs/manual/mod/core.xml
URL: http://svn.apache.org/viewvc/httpd/httpd/branches/2.2.x/docs/manual/mod/core.xml?rev=569020&r1=569019&r2=569020&view=diff
==============================================================================
--- httpd/httpd/branches/2.2.x/docs/manual/mod/core.xml (original)
+++ httpd/httpd/branches/2.2.x/docs/manual/mod/core.xml Thu Aug 23 07:50:26 2007
@@ -2273,6 +2273,9 @@
<p>Note also, that this option <strong>gets ignored</strong> if set
inside a <directive type="section" module="core">Location</directive>
section.</p>
+ <p>Omitting this option should not be considered a security restriction,
+ since symlink testing is subject to race conditions that make it
+ circumventable.</p>
</note></dd>
<dt><code>Includes</code></dt>
@@ -2313,9 +2316,12 @@
target file or directory is owned by the same user id as the
link.
- <note><title>Note</title> This option gets ignored if
+ <note><title>Note</title> <p>This option gets ignored if
set inside a <directive module="core"
- type="section">Location</directive> section.</note>
+ type="section">Location</directive> section.</p>
+ <p>This option should not be considered a security restriction,
+ since symlink testing is subject to race conditions that make it
+ circumventable.</p></note>
</dd>
</dl>