You are viewing a plain text version of this content. The canonical link for it is here.
Posted to bugs@httpd.apache.org by bu...@apache.org on 2007/08/23 12:42:37 UTC
DO NOT REPLY [Bug 43196] New: - Require statement not honored.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=43196>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=43196
Summary: Require statement not honored.
Product: Apache httpd-2
Version: 2.2.4
Platform: Other
OS/Version: Linux
Status: NEW
Severity: major
Priority: P2
Component: Core
AssignedTo: bugs@httpd.apache.org
ReportedBy: jesus.climent@gmail.com
While trying to protect some files for access to certain groups of users, we
found that the "Require" statement was not honored.
We are using apache with mod_ldap and mod_authnz_ldap.
In LDAP we have some groups defined.
In the main configuration file we have
AllowOverride AuthConfig
In our .htaccess file we have:
AuthType basic
AuthName "Restricted"
AuthBasicProvider ldap
AuthLDAPGroupAttribute memberUid
AuthLDAPGroupAttributeIsDN off
AuthLDAPURL
ldap://localhost:389/dc=local?uid?sub?(employeeType=active)
<FilesMatch "\.tgz$">
require ldap-group cn=images,ou=1x,ou=groups,dc=local
</FilesMatch>
If a user belongs to the given group, the user can see and download the files.
However, if a user does NOT belong to the group, the user cannot see those .tgz
files but she CAN download them if the filenames are known to her.
We believe this is not a proper behavior, as the documentation states that the
users belonging to the "images" group should not be able to access those files.
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 43196] - Require statement not honored.
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=43196>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=43196
------- Additional Comments From bnicholes@apache.org 2007-08-23 08:23 -------
I would suggest taking a look at the ldap cache to see what it says about
group membership matching
http://httpd.apache.org/docs/2.2/mod/mod_ldap.html#cache
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 43196] - Require statement not honored.
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=43196>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=43196
------- Additional Comments From jesus.climent@gmail.com 2007-08-28 09:05 -------
Created an attachment (id=20723)
--> (http://issues.apache.org/bugzilla/attachment.cgi?id=20723&action=view)
apache config "<location />" block
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 43196] - Require statement not honored.
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=43196>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=43196
nick@webthing.com changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|RESOLVED |REOPENED
Component|Core |mod_auth_ldap
Resolution|INVALID |
------- Additional Comments From nick@webthing.com 2007-08-23 07:31 -------
Are you saying that it allows access for users who are authenticated with the
server but don't match the LDAP Require?
OK, I don't know enough about LDAP to follow up on this. Reassigning
(hopefully) to those who do.
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 43196] - Require statement not honored.
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=43196>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=43196
------- Additional Comments From jesus.climent@gmail.com 2007-08-23 04:36 -------
We found a bit of more information while testing with a non-production server:
If the authentication happens previously (on a parent directory) before
accessing the non-accessible files, apache allows the user to get that file.
If previously there is no authentication happening, and it occurs at the moment
of accessing the required file, the access is then denied.
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 43196] - Require statement not honored.
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=43196>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=43196
jesus.climent@gmail.com changed:
What |Removed |Added
----------------------------------------------------------------------------
Version|2.2.4 |2.2.3
------- Additional Comments From jesus.climent@gmail.com 2007-08-23 04:21 -------
Version is 2.2.3-4 from Debian etch.
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 43196] - Require statement not honored.
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=43196>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=43196
------- Additional Comments From stefano.mosconi@gmail.com 2007-08-29 01:50 -------
(In reply to comment #11)
Hi Rici,
I'm working with Jesus at the thing.
> Although the <Location /> block presented above has a 'Require ldap-attribute'
> directive in it, I suspect that the configuration actually used to generate
> the debugging output did not have that directive, and that the only require
> directive in the <Location /> block was "require valid-user". That's
> consistent with the debugging output, and demonstrates that the <Location />
> block was merged last (in the second debugging run, with a direct url to the
> file); the request succeeds since the userid has been authenticated.
You are right the config of the debug output had just "require valid-user" as
require directive.
> This leaves the question of why mod_autoindex denied access to the file when
> creating a directory listing. The answer is that mod_autoindex does a
> ap_sub_req_lookup_dirent() to check the file; as far as I know, that version
> of sub_req does not do a <Location /> merge.
>
> If there is a bug here, it's a documentation bug; the documentation for
> <Location> correctly states:
> Use <Location> to apply directives to content that lives outside
> the filesystem. For content that lives in the filesystem, use
> <Directory> and <Files>.
>
> But then goes on to say:
> An exception is <Location />, which is an easy way to apply
> a configuration to the entire server.
>
> As can be seen here, attempts to use <Location /> for the purpose of
> applying a default configuration to the entire server are likely to
> fail, and the documentation possibly should be tightened up.
So you are saying that the <Location /> "wins" over the .htaccess inside the
directory because is merged last and the thing that we put inside the
<Directory> an "AllowOverride All" does non count at all...
The fact that mod_autoindex is not showing the files in any case is highly
misleading. A non careful administrator could just stop there and conclude that
"yes it's working". So either also mod_autoindex shows the files or also
mod_authnz_ldap behaves as mod_autoindex. We cannot have to modules that work in
so different way on a so crucial thing.
Moreover this way the admin lose a lot of power on fine-grained access control
and easiness of configuration.
But anyway those are just my opinions, on the other hand what is your advice?
Just change the <Location /> for the root <Directory ...> and then specify other
Locations residing outside that directory if needed?
Thanks
Stefano
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 43196] - Require statement not honored.
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=43196>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=43196
------- Additional Comments From stefano.mosconi@gmail.com 2007-08-30 00:44 -------
(In reply to comment #13)
> Yes, that is a problem, but it's not specific to mod_authnz_ldap. Any
> access control, even mod_access, would have the same behaviour, as far as
> I know.
So it's mod_autoindex that is behaving differently and that one needs to be
reviewed IMHO.
> But I believe the basic problem is trying to use a <Location>
> section with a filesystem-mapped site. If you'd used <Directory /> to set
> defaults, it probably would have worked as expected.
I agree.
You should change the docs in Chapter 2.5 - when to use what:
[quote]There is, however, one exception to this rule. Putting configuration
restrictions in a <Location /> section is perfectly safe because this section
will apply to all requests regardless of
the specific URL.[/quote]
Extend the Chapter 6.5 - Merging of .htaccess with the main configuration files,
pointing out this very particular case.
And correct Chapter 10 - Location directive as you said in a previous message.
> With the exception of changing Location to Directory in the last line, yes.
Right thanks now it works properly.
Regards
Stefano
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 43196] - Require statement not honored.
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=43196>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=43196
------- Additional Comments From slive@apache.org 2007-08-30 06:40 -------
Although configuration section merging can be confusing, I don't see any problem
with the docs. It IS safe to use <Location /> to restrict access. Nowhere does
it say that this is a "default" configuration that can be overridden by
.htaccess. And, in fact, there are several examples in the .htaccess tutorial
and in the "Configuration Sections" guide that show how <Location> overrides
other sections.
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 43196] - Require statement not honored.
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=43196>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=43196
rici@ricilake.net changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|REOPENED |RESOLVED
Resolution| |INVALID
------- Additional Comments From rici@ricilake.net 2007-08-28 10:52 -------
I believe this has nothing to do with LDAP, and is a configuration error.
The configuration includes an authn/authz block in <Location /> as well as one
in .htaccess (in a <FilesMatch> section). Since <Location> is merged after
<FilesMatch>, the <Location /> block will be at the end of the merge.
It should be noted that the merge of "Require" directives simply uses the
Require directives of the last-merged block which contains a Require.
Consequently, it is not possible to build up Requires by merging two
blocks.
Although the <Location /> block presented above has a 'Require ldap-attribute'
directive in it, I suspect that the configuration actually used to generate
the debugging output did not have that directive, and that the only require
directive in the <Location /> block was "require valid-user". That's
consistent with the debugging output, and demonstrates that the <Location />
block was merged last (in the second debugging run, with a direct url to the
file); the request succeeds since the userid has been authenticated.
This leaves the question of why mod_autoindex denied access to the file when
creating a directory listing. The answer is that mod_autoindex does a
ap_sub_req_lookup_dirent() to check the file; as far as I know, that version
of sub_req does not do a <Location /> merge.
If there is a bug here, it's a documentation bug; the documentation for
<Location> correctly states:
Use <Location> to apply directives to content that lives outside
the filesystem. For content that lives in the filesystem, use
<Directory> and <Files>.
But then goes on to say:
An exception is <Location />, which is an easy way to apply
a configuration to the entire server.
As can be seen here, attempts to use <Location /> for the purpose of
applying a default configuration to the entire server are likely to
fail, and the documentation possibly should be tightened up.
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 43196] - Require statement not honored.
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=43196>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=43196
------- Additional Comments From jesus.climent@gmail.com 2007-08-23 06:36 -------
So adding on a subdirectory a .htaccess file which includes a
<FilesMatch "\.tgz$">
Require ldap-group cn=mygroup
</FilesMatch>
does not add a requirement to the user for accessing those .tgz files as "the
user has to belong to that group" ?? (For that subdirectory and all the
directories under that one)
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 43196] - Require statement not honored.
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=43196>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=43196
rici@ricilake.net changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |rici@ricilake.net
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 43196] - Require statement not honored.
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=43196>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=43196
------- Additional Comments From rici@ricilake.net 2007-08-29 07:44 -------
(In reply to comment #12)
> (In reply to comment #11)
> So you are saying that the <Location /> "wins" over the .htaccess inside the
> directory because is merged last and the thing that we put inside the
> <Directory> an "AllowOverride All" does non count at all...
The .htaccess file is being read. It's just not being applied last, so the
<Location /> section can still override it's settings.
> The fact that mod_autoindex is not showing the files in any case is highly
> misleading. A non careful administrator could just stop there and conclude that
> "yes it's working". So either also mod_autoindex shows the files or also
> mod_authnz_ldap behaves as mod_autoindex. We cannot have to modules that work in
> so different way on a so crucial thing.
Yes, that is a problem, but it's not specific to mod_authnz_ldap. Any
access control, even mod_access, would have the same behaviour, as far as
I know. But I believe the basic problem is trying to use a <Location>
section with a filesystem-mapped site. If you'd used <Directory /> to set
defaults, it probably would have worked as expected.
>
> Moreover this way the admin lose a lot of power on fine-grained access control
> and easiness of configuration.
I don't see why the use of a <Location> block is required to give fine-grained
access control.
>
> But anyway those are just my opinions, on the other hand what is your advice?
> Just change the <Location /> for the root <Directory ...> and then specify other
> Locations residing outside that directory if needed?
With the exception of changing Location to Directory in the last line, yes.
> Thanks
> Stefano
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 43196] - Require statement not honored.
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=43196>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=43196
nick@webthing.com changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution| |INVALID
------- Additional Comments From nick@webthing.com 2007-08-23 05:23 -------
(In reply to comment #2)
> We found a bit of more information while testing with a non-production server:
>
> If the authentication happens previously (on a parent directory) before
> accessing the non-accessible files, apache allows the user to get that file.
So the user is already authenticated with the server, and the browser sends its
credentials. That's how HTTP authentication works.
> If previously there is no authentication happening, and it occurs at the moment
> of accessing the required file, the access is then denied.
Presumably when you say "denied" you mean a 401 response.
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 43196] - Require statement not honored.
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=43196>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=43196
------- Additional Comments From jesus.climent@gmail.com 2007-08-23 08:01 -------
(In reply to comment #5)
> Are you saying that it allows access for users who are authenticated with the
> server but don't match the LDAP Require?
Exactly. Users that are allowed to login within the big scope are also allowed
to download the file eventhough they do not match the Require, that is, dont
belong to the LDAP group.
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 43196] - Require statement not honored.
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=43196>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=43196
------- Additional Comments From jesus.climent@gmail.com 2007-08-23 10:16 -------
I read what it says about groups and i believe it does not apply.
Again, the problem is that a user that exists in LDAP can retrieve a file that
is under the scope of a regular expression on a <FilesMatch> entry with a
"Require ldap-group" that is not matched because the user does not belong to
such LDAP group.
The problem occurs even when the server is restarted (thus the caches are cleared).
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 43196] - Require statement not honored.
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=43196>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=43196
stefano.mosconi@gmail.com changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |stefano.mosconi@gmail.com
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 43196] - Require statement not honored.
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=43196>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=43196
------- Additional Comments From jesus.climent@gmail.com 2007-08-28 08:37 -------
Created an attachment (id=20722)
--> (http://issues.apache.org/bugzilla/attachment.cgi?id=20722&action=view)
Debug output
This log shows that when a directory has been accesses using authentication,
accessing a non-authorized file is granted because there is no authorization
phase. The non-authorized files are not shown because there is an authorization
phase during the view of the directory and access to view those is denied.
However, when the file is accesses from a directory where no authorization has
happened, the file access is denied during the authorization phase.
So, summarizing, it seems there is an error in the process logic that allows a
user to access a non-authorized file when the user has been previously
authenticated to access the directory where the file resides.
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org