You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by rb...@apache.org on 2026/05/02 19:54:29 UTC
svn commit: r1933721 - in httpd/httpd/branches/2.4.x/docs/manual: . howto mod
Author: rbowen
Date: Sat May 2 19:54:29 2026
New Revision: 1933721
Log:
Bug 69891: Warn that <Limit> inside <Location> can silently override <Directory> auth
Modified:
httpd/httpd/branches/2.4.x/docs/manual/howto/access.xml
httpd/httpd/branches/2.4.x/docs/manual/mod/core.xml
httpd/httpd/branches/2.4.x/docs/manual/sections.xml
Modified: httpd/httpd/branches/2.4.x/docs/manual/howto/access.xml
==============================================================================
--- httpd/httpd/branches/2.4.x/docs/manual/howto/access.xml Sat May 2 19:54:14 2026 (r1933720)
+++ httpd/httpd/branches/2.4.x/docs/manual/howto/access.xml Sat May 2 19:54:29 2026 (r1933721)
@@ -202,6 +202,14 @@ RewriteRule "^/fridge" "-" [F]
<p>See also the <a href="auth.html">Authentication and Authorization</a>
howto.</p>
+
+ <p>See the <a href="../sections.html#merging">configuration sections
+ merging documentation</a> for a warning about how
+ <directive type="section" module="core">Limit</directive> inside
+ <directive type="section" module="core">Location</directive>
+ can silently override
+ <directive type="section" module="core">Directory</directive>
+ access restrictions.</p>
</section>
</manualpage>
Modified: httpd/httpd/branches/2.4.x/docs/manual/mod/core.xml
==============================================================================
--- httpd/httpd/branches/2.4.x/docs/manual/mod/core.xml Sat May 2 19:54:14 2026 (r1933720)
+++ httpd/httpd/branches/2.4.x/docs/manual/mod/core.xml Sat May 2 19:54:29 2026 (r1933721)
@@ -2750,7 +2750,14 @@ methods</description>
used in preference to a <directive type="section">Limit</directive>
section when restricting access, since a <directive type="section"
module="core">LimitExcept</directive> section provides protection
- against arbitrary methods.</note>
+ against arbitrary methods. See also the
+ <a href="../sections.html#merging">configuration sections
+ merging documentation</a> for a warning about how
+ <directive type="section">Limit</directive> inside
+ <directive type="section" module="core">Location</directive>
+ can silently override
+ <directive type="section" module="core">Directory</directive>
+ restrictions.</note>
<p>The <directive type="section">Limit</directive> and
<directive type="section" module="core">LimitExcept</directive>
Modified: httpd/httpd/branches/2.4.x/docs/manual/sections.xml
==============================================================================
--- httpd/httpd/branches/2.4.x/docs/manual/sections.xml Sat May 2 19:54:14 2026 (r1933720)
+++ httpd/httpd/branches/2.4.x/docs/manual/sections.xml Sat May 2 19:54:29 2026 (r1933721)
@@ -541,6 +541,21 @@ are interpreted, it is important to unde
used in <code>.htaccess</code>, the enclosed directives in a parent
directory will be merged <em>after</em> non-enclosed directives in a
subdirectory.</li>
+ <li><note type="warning"><title>Caution: <Limit> inside
+ <Location> can silently grant access</title>
+ <p>Using <directive type="section" module="core">Limit</directive>
+ inside a <directive type="section" module="core">Location</directive>
+ section to restrict authorization to specific HTTP methods can have
+ unexpected results. For methods not listed in the
+ <directive type="section" module="core">Limit</directive>, the
+ enclosing <directive type="section" module="core">Location</directive>
+ section is treated as having no authorization requirements — which
+ effectively grants access and overrides any
+ <directive type="section" module="core">Directory</directive>
+ restrictions that would otherwise apply. Use
+ <directive type="section" module="core">LimitExcept</directive>
+ instead, or apply authorization without method restrictions.</p>
+ </note></li>
</ul>
<note><title>Technical Note</title>