svn commit: r1894455 - in /httpd/httpd/trunk: changes-entries/IndexForbiddenReturn404.txt docs/manual/mod/mod_autoindex.xml modules/generators/mod_autoindex.c

[co...@apache.org]

Author: covener
Date: Thu Oct 21 18:52:48 2021
New Revision: 1894455

URL: http://svn.apache.org/viewvc?rev=1894455&view=rev
Log:
add IndexForbiddenReturn404 to help silence scanners

Added:
    httpd/httpd/trunk/changes-entries/IndexForbiddenReturn404.txt
Modified:
    httpd/httpd/trunk/docs/manual/mod/mod_autoindex.xml
    httpd/httpd/trunk/modules/generators/mod_autoindex.c

Added: httpd/httpd/trunk/changes-entries/IndexForbiddenReturn404.txt
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/changes-entries/IndexForbiddenReturn404.txt?rev=1894455&view=auto
==============================================================================
--- httpd/httpd/trunk/changes-entries/IndexForbiddenReturn404.txt (added)
+++ httpd/httpd/trunk/changes-entries/IndexForbiddenReturn404.txt Thu Oct 21 18:52:48 2021
@@ -0,0 +1,2 @@
+  *) mod_autoindex: Add "IndexForbiddenReturn404" to return 404 instead of a 
+     403 when Options does not included "indexes". [Eric Covener]

Modified: httpd/httpd/trunk/docs/manual/mod/mod_autoindex.xml
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/docs/manual/mod/mod_autoindex.xml?rev=1894455&r1=1894454&r2=1894455&view=diff
==============================================================================
--- httpd/httpd/trunk/docs/manual/mod/mod_autoindex.xml (original)
+++ httpd/httpd/trunk/docs/manual/mod/mod_autoindex.xml Thu Oct 21 18:52:48 2021
@@ -1124,4 +1124,22 @@ ReadmeName /include/FOOTER.html
 </usage>
 </directivesynopsis>
 
+<directivesynopsis>
+<name>IndexForbiddenReturn404</name>
+<description>Return an HTTP 404 error instead of Forbidden when options 
+don't permit directory listing</description>
+<syntax>IndexForbiddenReturn404 On|Off</syntax>
+<contextlist><context>server config</context><context>virtual host</context>
+<context>directory</context><context>.htaccess</context>
+</contextlist>
+<override>Indexes</override>
+<compatibility>Added in 2.5.1</compatibility>
+
+<usage>
+    <p>The <directive>IndexForbiddenReturn404</directive> directive controls whether 
+    this module returns an HTTP 404 status code instead of an HTTP 403 status code when the
+    <directive>Options</directive> does not allow indexes to be returned.  </p>
+</usage>
+</directivesynopsis>
+
 </modulesynopsis>

Modified: httpd/httpd/trunk/modules/generators/mod_autoindex.c
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/mod_autoindex.c?rev=1894455&r1=1894454&r2=1894455&view=diff
==============================================================================
--- httpd/httpd/trunk/modules/generators/mod_autoindex.c (original)
+++ httpd/httpd/trunk/modules/generators/mod_autoindex.c Thu Oct 21 18:52:48 2021
@@ -133,6 +133,7 @@ typedef struct autoindex_config_struct {
     int desc_adjust;
     int icon_width;
     int icon_height;
+    int not_found;
     char default_keyid;
     char default_direction;
 
@@ -608,6 +609,11 @@ static const command_rec autoindex_cmds[
     AP_INIT_TAKE1("IndexHeadInsert", ap_set_string_slot,
                   (void *)APR_OFFSETOF(autoindex_config_rec, head_insert),
                   DIR_CMD_PERMS, "String to insert in HTML HEAD section"),
+    AP_INIT_FLAG("IndexForbiddenReturn404", ap_set_flag_slot,
+                 (void *)APR_OFFSETOF(autoindex_config_rec, not_found),
+                 DIR_CMD_PERMS,
+                 "Return 404 in place of 403 when Options doesn't allow indexes"),
+
     {NULL}
 };
 
@@ -2331,7 +2337,7 @@ static int handle_autoindex(request_rec
                       "Options directive",
                        r->filename,
                        index_names ? index_names : "none");
-        return HTTP_FORBIDDEN;
+        return d->not_found ? HTTP_NOT_FOUND : HTTP_FORBIDDEN;
     }
 }