You are viewing a plain text version of this content. The canonical link for it is here.
Posted to bugs@httpd.apache.org by bu...@apache.org on 2013/03/15 03:16:48 UTC
[Bug 54699] New: [feature request] cli webaccess tester
https://issues.apache.org/bugzilla/show_bug.cgi?id=54699
Bug ID: 54699
Summary: [feature request] cli webaccess tester
Product: Apache httpd-2
Version: 2.5-HEAD
Hardware: PC
OS: Linux
Status: NEW
Severity: enhancement
Priority: P2
Component: All
Assignee: bugs@httpd.apache.org
Reporter: spamik@yum.pl
Classification: Unclassified
[feature request] cli webaccess tester
It would be very usefull if cli (shell) tool would exist that would tell if a
directory/file is accessible on the webserver (by specified IP for example).
I'm developing anti-mallware software and it is critical for it to tell if a
directory (and file in it) is web-accessible or not - if it is blocked by
either something in httpd.conf or in htaccess (like deny from all) (htaccess
are recursive). In other words if there is url (configured at webserver) that
allows for direct access to a file or directory (its index.(php|htm)).
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 54699] [feature request] cli webaccess tester
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=54699
--- Comment #6 from Eric Covener <co...@gmail.com> ---
Doesn't sound useful in practice to me, but since you insist on reverting my
state changes, I'm not going to bother with any more feedback.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 54699] [feature request] cli webaccess tester
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=54699
--- Comment #4 from spamik@yum.pl ---
only apache httpd can efeciently say if file/directory is blocked by its
configuration or not and http response is not a way to deremine it. Duplicating
apache configuration parser into other program is pointless.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 54699] [feature request] cli webaccess tester
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=54699
spamik@yum.pl changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|RESOLVED |REOPENED
Resolution|WONTFIX |---
--- Comment #2 from spamik@yum.pl ---
It is not possible to accuratly determine via http if file is actualy blocked
by apache configuration because:
file (like php script) can return 404, 401 for "normal request" while returning
other data for specified GET argument (and it is actualy ussed by mallware all
the time those days - to mask its presence)
also it is not optimal to do any such check via http
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 54699] [feature request] cli webaccess tester
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=54699
spamik@yum.pl changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|RESOLVED |REOPENED
Resolution|WONTFIX |---
--- Comment #5 from spamik@yum.pl ---
example scenario: You scanner your partition with antivirus software and found
that /home/user/public_html/abc/public/images/cache/0/a/2/5/49586.php was
malicious code
You don't know domain or url to it. How how do you suppose you could tell if
that file is actualy accessible via any domain served by your apache? Your
httpd.conf is very fancy and has a lot of data in it. Worse, user has multiple
.htaccess files with rewrite rules, deny rules and authorization rules. Finaly
actual php file returns 401 code to apache if run by webserver to mask its
presence (unless passed aprorpiate $_GET argument). Answer is YOU CANT know if
file is world accessible! It is completly impossible to analize automaticly
those configuration, htaccess, rewrites!!
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 54699] [feature request] cli webaccess tester
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=54699
Eric Covener <co...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution|--- |WONTFIX
--- Comment #1 from Eric Covener <co...@gmail.com> ---
Sounds like your just describing a command line HTTP client, which there are
plenty of. I don't see room for much in this area in our webserver project.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 54699] [feature request] cli webaccess tester
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=54699
Eric Covener <co...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|REOPENED |RESOLVED
Resolution|--- |WONTFIX
--- Comment #3 from Eric Covener <co...@gmail.com> ---
Sorry, but such a feature (a command line tools that knows not just httpd
configuration but somehow knows when PHP will decide to return a 401 or 404) is
simply not what our project is about. If you find some novel way to implement
this, reopen.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org