You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@httpd.apache.org by Eric Covener <co...@gmail.com> on 2013/06/10 15:37:49 UTC
Location walk after directory walk?
Is there some historical or other reason that the location has higher
precedence that directory/files? I think the other way is much more
intuitive
/* Rerun the location walk, which overrides any map_to_storage config.
*/
if ((access_status = ap_location_walk(r))) {
return access_status;
}
(map_to_storage is what runs the directory_walk)
--
Eric Covener
covener@gmail.com
Re: Location walk after directory walk?
Posted by Stefan Fritsch <sf...@sfritsch.de>.
On Monday 10 June 2013, Eric Covener wrote:
> Is there some historical or other reason that the location has
> higher precedence that directory/files?
I don't know either, but I could imagine that it was just easier or
more efficient to implement in this order, considering things like
config walk caching, file-typed subrequests, etc.
Re: Location walk after directory walk?
Posted by "William A. Rowe Jr." <wm...@gmail.com>.
Historically on unix it was syntactic... would you rather control access in
filepath space or uri space? It seemed pretty simple to grant <location
/images> read access, versus the </path/to/vhost/htdocs/images> so that was
an early preference still used by some admins.
With case-insensitive filesystems it became a real problem. Granting
access by location is still simple (request the correct case pathname for
the uri, or the case-sensitive grant-ACL will fail), but denying access
became tricky. Trickier still because case-flexible filesystems are also
usually flexible in other, non-intuitive ways, like the handling of a
trailing period on an NTFS volume. So <location > cannot be safely used to
deny file access under several OS's, including several case-insensitive
unix examples such as hfs+, samba shares etc.
As with most historical artifacts, history often wins the debate over
'correctness'.
On Mon, Jun 10, 2013 at 9:31 AM, Eric Covener <co...@gmail.com> wrote:
> On Mon, Jun 10, 2013 at 10:03 AM, Reindl Harald <h....@thelounge.net>
> wrote:
> >
> >
> > Am 10.06.2013 15:58, schrieb Eric Covener:
> >>> <Directory "/">
> >>> Options -Indexes -ExecCGI -MultiViews +FollowSymLinks
> >>> AllowOverride None
> >>> Require all denied
> >>> </Directory>
> >>>
> >>> does not mean i do not need the possibility to allow
> >>> a specific Locations/Aliases outside this and the
> >>> same for specific exceptions inside vhosts with <Directory>
> >>> directives
> >>
> >> But none of that requires a Location that merges later, it's just more
> >> brief than a subsequent Directory/Files
> >
> > define "requires"
>
> Necessary for the result.
>
> > thhere are millions of configs out there which are tested and
> > often enough Directory/Files/Location are used in whatever
> > combinations
>
> > if someone would change the order of this merging it would
> > be a unpredicatable change - period
>
> > you can suggest such changes for Apache 2.5 or Apache 3.0
> > and even there only with a damned good reason - period
>
> This should be obvious, but none of it precludes discussion here -
> exclamation point.
>
Re: Location walk after directory walk?
Posted by Eric Covener <co...@gmail.com>.
On Mon, Jun 10, 2013 at 10:03 AM, Reindl Harald <h....@thelounge.net> wrote:
>
>
> Am 10.06.2013 15:58, schrieb Eric Covener:
>>> <Directory "/">
>>> Options -Indexes -ExecCGI -MultiViews +FollowSymLinks
>>> AllowOverride None
>>> Require all denied
>>> </Directory>
>>>
>>> does not mean i do not need the possibility to allow
>>> a specific Locations/Aliases outside this and the
>>> same for specific exceptions inside vhosts with <Directory>
>>> directives
>>
>> But none of that requires a Location that merges later, it's just more
>> brief than a subsequent Directory/Files
>
> define "requires"
Necessary for the result.
> thhere are millions of configs out there which are tested and
> often enough Directory/Files/Location are used in whatever
> combinations
> if someone would change the order of this merging it would
> be a unpredicatable change - period
> you can suggest such changes for Apache 2.5 or Apache 3.0
> and even there only with a damned good reason - period
This should be obvious, but none of it precludes discussion here -
exclamation point.
Re: Location walk after directory walk?
Posted by Reindl Harald <h....@thelounge.net>.
Am 10.06.2013 15:58, schrieb Eric Covener:
>> <Directory "/">
>> Options -Indexes -ExecCGI -MultiViews +FollowSymLinks
>> AllowOverride None
>> Require all denied
>> </Directory>
>>
>> does not mean i do not need the possibility to allow
>> a specific Locations/Aliases outside this and the
>> same for specific exceptions inside vhosts with <Directory>
>> directives
>
> But none of that requires a Location that merges later, it's just more
> brief than a subsequent Directory/Files
define "requires"
thhere are millions of configs out there which are tested and
often enough Directory/Files/Location are used in whatever
combinations
if someone would change the order of this merging it would
be a unpredicatable change - period
you can suggest such changes for Apache 2.5 or Apache 3.0
and even there only with a damned good reason - period
Re: Location walk after directory walk?
Posted by Eric Covener <co...@gmail.com>.
> <Directory "/">
> Options -Indexes -ExecCGI -MultiViews +FollowSymLinks
> AllowOverride None
> Require all denied
> </Directory>
>
> does not mean i do not need the possibility to allow
> a specific Locations/Aliases outside this and the
> same for specific exceptions inside vhosts with <Directory>
> directives
But none of that requires a Location that merges later, it's just more
brief than a subsequent Directory/Files.
Re: Location walk after directory walk?
Posted by Reindl Harald <h....@thelounge.net>.
Am 10.06.2013 15:37, schrieb Eric Covener:
> Is there some historical or other reason that the location has higher
> precedence that directory/files? I think the other way is much more
> intuitive
no - not from the daily use perspective
<Directory "/">
Options -Indexes -ExecCGI -MultiViews +FollowSymLinks
AllowOverride None
Require all denied
</Directory>
does not mean i do not need the possibility to allow
a specific Locations/Aliases outside this and the
same for specific exceptions inside vhosts with <Directory>
directives
use-case: allow specific paths outside the docroot without
allowing the whole directory to be accessed
Re: Location walk after directory walk?
Posted by Rainer Jung <ra...@kippdata.de>.
On 10.06.2013 15:37, Eric Covener wrote:
> Is there some historical or other reason that the location has higher
> precedence that directory/files? I think the other way is much more
> intuitive
Don't know about th real motivation, but after having learned that from
the explicit description in the docs I got very used to it. Changing it
would have major implications for existing configs.
One nice thing i saw yesterday is an explicit recipe in our docs to put
additional control on .htaccess stuff you don't want to happen by
enforcing your policy ("fixing" problematic .htaccess) with a <Location>
that merges later.
Regards,
Rainer