You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by gregory duchesnes <gr...@icilalune.com> on 2004/12/03 14:40:54 UTC
[users@httpd] POST to cgi Authentification Bug
hi all,
Prior to explain my problem let's explain my config :
I have a bunch of Vhosts (all password protected Authtype Basic + MySQL).
As i have a lot of scripts which are shared by all Vhosts, i have set up a
shared folder thanks to an alias :
Alias /shared /var/www/shared/
<Directory /var/www/shared>
Options FollowSymLinks
AllowOverride None
Order allow,deny
Allow from all
</Directory>
My Vhosts config look like that :
<VirtualHost *>
ServerName admin.ndd.tlp
DocumentRoot /var/www/ndd.tlp/admin/web
CustomLog /var/www/ndd.tlp/admin/logs/access.log combined
<LocationMatch /* >
Authtype Basic
AuthName "Administration"
Auth_MySQL_DB myauthdb
Auth_MySQL_Password_Table user_info
Auth_MySQL_Encrypted_Passwords Off
require valid-user
</LocationMatch>
</VirtualHost>
I use LocationMatch to make sure anything in the website tree is protected
(including aliases such as the /shared directory) and have a simple
Vhosts.conf file
All this works perfectly well, but now problems begin...
I also have a shared cgi script folder (password protected also thanks to my
LocationMatch rule) :
ScriptAlias /upload/ /usr/lib/cgi-bin/upload/
<Directory /usr/lib/cgi-bin/upload/>
AllowOverride None
Options ExecCGI
Order allow,deny
Allow from all
</Directory>
in this upload folder, i installed the MegaUpload cgi scripts.
Those scripts consist in 2 parts :
PHP scripts (located in /var/www/shared/private/php/upload)
cgi scripts (located in /usr/lib/cgi-bin/upload/)
First i connect to the /shared/private/php/upload/upload.php page (a form
where i can choose files to upload), then when i click submit, this page
issues a POST request to /upload/upload.cgi and the cgi handles the upload
(and provide a progress bar).
The scripts work perfectly well, except in one browser... (guess which?)
... internet explorer (Bingo!)
What goes wrong is that when i click submit, the file seems to be uploaded
(the little blue progress in the status bar moves), but in fact nothing is
uploaded.
Nothing appears in the logs until i click on stop in the browser, and then i
have a nice 401 error :
82.66.244.63 - - [03/Dec/2004:14:07:26 +0100] "POST /upload/upload.cgi
HTTP/1.1" 401 397
"http://admin.ndd.tlp/shared/private/php/upload/upload.php" "Mozilla/4.0
(compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR1.1.4322)"
I've tried to comment out my LocationMatch rule and everything works fine,
my guess is that IE doesn't send its credentials when issuing the POST
request.
Unfortunately a vast majority of my clients use this browser so i can't ask
them to change to firefox (for example).
Anyone's ever seen this? Know a workaround?
I'd like to keep my LocationMatch rule, since it simplifies greatly my
Vhosts.conf file
Thanks for your help.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
RE: [users@httpd] POST to cgi Authentification Bug
Posted by gregory duchesnes <gr...@icilalune.com>.
I said yesterday that i stopped working again with IE.
I've made some tests with Safari on the mac, it worked like a charm for
about 50 times, and now i have the same problem, i doesn't work anymore
(whatever the computer).
Does apache have a built in mechanism to ban browsers that behave badly
after a certain number of times?
I really don't understand what's going on...
-----Message d'origine-----
De : gregory duchesnes [mailto:gregory@icilalune.com]
Envoyé : vendredi 3 décembre 2004 18:03
À : users@httpd.apache.org
Objet : RE: [users@httpd] POST to cgi Authentification Bug
oups, seems like i wasn't the miracle solution...
it stopped working again
that IE really is a !%$?@ browser
-----Message d'origine-----
De : gregory duchesnes [mailto:gregory@icilalune.com]
Envoyé : vendredi 3 décembre 2004 17:45
À : users@httpd.apache.org
Objet : RE: [users@httpd] POST to cgi Authentification Bug
that's exactly what i did.
thanks for the tip anyway.
-----Message d'origine-----
De : Ralf Glauberman [mailto:rglauberman@michaeli-gymnasium.de]
Envoyé : vendredi 3 décembre 2004 17:42
À : users@httpd.apache.org
Objet : Re: [users@httpd] POST to cgi Authentification Bug
hi,
for performance reasons i would give you the tip to disable keepalive only
for this directory. it really reduces load.
ralf
----- Original Message -----
From: "gregory duchesnes" <gr...@icilalune.com>
To: <us...@httpd.apache.org>
Sent: Friday, December 03, 2004 4:49 PM
Subject: RE: [users@httpd] POST to cgi Authentification Bug
> replying to myself...
>
> After a lot of googling, i've solved my problem with this :
>
> BrowserMatchNoCase msie nokeepalive
>
> it's a bit dirty since it desactivates keepalives for any MSIE browser,
> but
> who cares? (Not me, that's for sure).
>
> By the way, it would be nice if someone can report this buggy IE behavior
>
> -----Message d'origine-----
> De : gregory duchesnes [mailto:gregory@icilalune.com]
> Envoye : vendredi 3 decembre 2004 14:41
> A : users@httpd.apache.org
> Objet : [users@httpd] POST to cgi Authentification Bug
>
>
> hi all,
>
> Prior to explain my problem let's explain my config :
>
> I have a bunch of Vhosts (all password protected Authtype Basic + MySQL).
> As i have a lot of scripts which are shared by all Vhosts, i have set up a
> shared folder thanks to an alias :
>
> Alias /shared /var/www/shared/
>
> <Directory /var/www/shared>
> Options FollowSymLinks
> AllowOverride None
> Order allow,deny
> Allow from all
> </Directory>
>
>
> My Vhosts config look like that :
>
> <VirtualHost *>
> ServerName admin.ndd.tlp
> DocumentRoot /var/www/ndd.tlp/admin/web
> CustomLog /var/www/ndd.tlp/admin/logs/access.log combined
> <LocationMatch /* >
> Authtype Basic
> AuthName "Administration"
> Auth_MySQL_DB myauthdb
> Auth_MySQL_Password_Table user_info
> Auth_MySQL_Encrypted_Passwords Off
> require valid-user
> </LocationMatch>
> </VirtualHost>
>
> I use LocationMatch to make sure anything in the website tree is protected
> (including aliases such as the /shared directory) and have a simple
> Vhosts.conf file
> All this works perfectly well, but now problems begin...
>
>
>
> I also have a shared cgi script folder (password protected also thanks to
> my
> LocationMatch rule) :
>
> ScriptAlias /upload/ /usr/lib/cgi-bin/upload/
>
> <Directory /usr/lib/cgi-bin/upload/>
> AllowOverride None
> Options ExecCGI
> Order allow,deny
> Allow from all
> </Directory>
>
> in this upload folder, i installed the MegaUpload cgi scripts.
> Those scripts consist in 2 parts :
> PHP scripts (located in /var/www/shared/private/php/upload)
> cgi scripts (located in /usr/lib/cgi-bin/upload/)
>
> First i connect to the /shared/private/php/upload/upload.php page (a form
> where i can choose files to upload), then when i click submit, this page
> issues a POST request to /upload/upload.cgi and the cgi handles the upload
> (and provide a progress bar).
>
> The scripts work perfectly well, except in one browser... (guess which?)
> ... internet explorer (Bingo!)
>
> What goes wrong is that when i click submit, the file seems to be uploaded
> (the little blue progress in the status bar moves), but in fact nothing is
> uploaded.
> Nothing appears in the logs until i click on stop in the browser, and then
> i
> have a nice 401 error :
>
> 82.66.244.63 - - [03/Dec/2004:14:07:26 +0100] "POST /upload/upload.cgi
> HTTP/1.1" 401 397
> "http://admin.ndd.tlp/shared/private/php/upload/upload.php" "Mozilla/4.0
> (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR1.1.4322)"
>
>
> I've tried to comment out my LocationMatch rule and everything works fine,
> my guess is that IE doesn't send its credentials when issuing the POST
> request.
> Unfortunately a vast majority of my clients use this browser so i can't
> ask
> them to change to firefox (for example).
>
> Anyone's ever seen this? Know a workaround?
> I'd like to keep my LocationMatch rule, since it simplifies greatly my
> Vhosts.conf file
>
>
>
> Thanks for your help.
>
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
RE: [users@httpd] POST to cgi Authentification Bug
Posted by gregory duchesnes <gr...@icilalune.com>.
oups, seems like i wasn't the miracle solution...
it stopped working again
that IE really is a !%$?@ browser
-----Message d'origine-----
De : gregory duchesnes [mailto:gregory@icilalune.com]
Envoyé : vendredi 3 décembre 2004 17:45
À : users@httpd.apache.org
Objet : RE: [users@httpd] POST to cgi Authentification Bug
that's exactly what i did.
thanks for the tip anyway.
-----Message d'origine-----
De : Ralf Glauberman [mailto:rglauberman@michaeli-gymnasium.de]
Envoyé : vendredi 3 décembre 2004 17:42
À : users@httpd.apache.org
Objet : Re: [users@httpd] POST to cgi Authentification Bug
hi,
for performance reasons i would give you the tip to disable keepalive only
for this directory. it really reduces load.
ralf
----- Original Message -----
From: "gregory duchesnes" <gr...@icilalune.com>
To: <us...@httpd.apache.org>
Sent: Friday, December 03, 2004 4:49 PM
Subject: RE: [users@httpd] POST to cgi Authentification Bug
> replying to myself...
>
> After a lot of googling, i've solved my problem with this :
>
> BrowserMatchNoCase msie nokeepalive
>
> it's a bit dirty since it desactivates keepalives for any MSIE browser,
> but
> who cares? (Not me, that's for sure).
>
> By the way, it would be nice if someone can report this buggy IE behavior
>
> -----Message d'origine-----
> De : gregory duchesnes [mailto:gregory@icilalune.com]
> Envoye : vendredi 3 decembre 2004 14:41
> A : users@httpd.apache.org
> Objet : [users@httpd] POST to cgi Authentification Bug
>
>
> hi all,
>
> Prior to explain my problem let's explain my config :
>
> I have a bunch of Vhosts (all password protected Authtype Basic + MySQL).
> As i have a lot of scripts which are shared by all Vhosts, i have set up a
> shared folder thanks to an alias :
>
> Alias /shared /var/www/shared/
>
> <Directory /var/www/shared>
> Options FollowSymLinks
> AllowOverride None
> Order allow,deny
> Allow from all
> </Directory>
>
>
> My Vhosts config look like that :
>
> <VirtualHost *>
> ServerName admin.ndd.tlp
> DocumentRoot /var/www/ndd.tlp/admin/web
> CustomLog /var/www/ndd.tlp/admin/logs/access.log combined
> <LocationMatch /* >
> Authtype Basic
> AuthName "Administration"
> Auth_MySQL_DB myauthdb
> Auth_MySQL_Password_Table user_info
> Auth_MySQL_Encrypted_Passwords Off
> require valid-user
> </LocationMatch>
> </VirtualHost>
>
> I use LocationMatch to make sure anything in the website tree is protected
> (including aliases such as the /shared directory) and have a simple
> Vhosts.conf file
> All this works perfectly well, but now problems begin...
>
>
>
> I also have a shared cgi script folder (password protected also thanks to
> my
> LocationMatch rule) :
>
> ScriptAlias /upload/ /usr/lib/cgi-bin/upload/
>
> <Directory /usr/lib/cgi-bin/upload/>
> AllowOverride None
> Options ExecCGI
> Order allow,deny
> Allow from all
> </Directory>
>
> in this upload folder, i installed the MegaUpload cgi scripts.
> Those scripts consist in 2 parts :
> PHP scripts (located in /var/www/shared/private/php/upload)
> cgi scripts (located in /usr/lib/cgi-bin/upload/)
>
> First i connect to the /shared/private/php/upload/upload.php page (a form
> where i can choose files to upload), then when i click submit, this page
> issues a POST request to /upload/upload.cgi and the cgi handles the upload
> (and provide a progress bar).
>
> The scripts work perfectly well, except in one browser... (guess which?)
> ... internet explorer (Bingo!)
>
> What goes wrong is that when i click submit, the file seems to be uploaded
> (the little blue progress in the status bar moves), but in fact nothing is
> uploaded.
> Nothing appears in the logs until i click on stop in the browser, and then
> i
> have a nice 401 error :
>
> 82.66.244.63 - - [03/Dec/2004:14:07:26 +0100] "POST /upload/upload.cgi
> HTTP/1.1" 401 397
> "http://admin.ndd.tlp/shared/private/php/upload/upload.php" "Mozilla/4.0
> (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR1.1.4322)"
>
>
> I've tried to comment out my LocationMatch rule and everything works fine,
> my guess is that IE doesn't send its credentials when issuing the POST
> request.
> Unfortunately a vast majority of my clients use this browser so i can't
> ask
> them to change to firefox (for example).
>
> Anyone's ever seen this? Know a workaround?
> I'd like to keep my LocationMatch rule, since it simplifies greatly my
> Vhosts.conf file
>
>
>
> Thanks for your help.
>
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
RE: [users@httpd] POST to cgi Authentification Bug
Posted by gregory duchesnes <gr...@icilalune.com>.
that's exactly what i did.
thanks for the tip anyway.
-----Message d'origine-----
De : Ralf Glauberman [mailto:rglauberman@michaeli-gymnasium.de]
Envoyé : vendredi 3 décembre 2004 17:42
À : users@httpd.apache.org
Objet : Re: [users@httpd] POST to cgi Authentification Bug
hi,
for performance reasons i would give you the tip to disable keepalive only
for this directory. it really reduces load.
ralf
----- Original Message -----
From: "gregory duchesnes" <gr...@icilalune.com>
To: <us...@httpd.apache.org>
Sent: Friday, December 03, 2004 4:49 PM
Subject: RE: [users@httpd] POST to cgi Authentification Bug
> replying to myself...
>
> After a lot of googling, i've solved my problem with this :
>
> BrowserMatchNoCase msie nokeepalive
>
> it's a bit dirty since it desactivates keepalives for any MSIE browser,
> but
> who cares? (Not me, that's for sure).
>
> By the way, it would be nice if someone can report this buggy IE behavior
>
> -----Message d'origine-----
> De : gregory duchesnes [mailto:gregory@icilalune.com]
> Envoye : vendredi 3 decembre 2004 14:41
> A : users@httpd.apache.org
> Objet : [users@httpd] POST to cgi Authentification Bug
>
>
> hi all,
>
> Prior to explain my problem let's explain my config :
>
> I have a bunch of Vhosts (all password protected Authtype Basic + MySQL).
> As i have a lot of scripts which are shared by all Vhosts, i have set up a
> shared folder thanks to an alias :
>
> Alias /shared /var/www/shared/
>
> <Directory /var/www/shared>
> Options FollowSymLinks
> AllowOverride None
> Order allow,deny
> Allow from all
> </Directory>
>
>
> My Vhosts config look like that :
>
> <VirtualHost *>
> ServerName admin.ndd.tlp
> DocumentRoot /var/www/ndd.tlp/admin/web
> CustomLog /var/www/ndd.tlp/admin/logs/access.log combined
> <LocationMatch /* >
> Authtype Basic
> AuthName "Administration"
> Auth_MySQL_DB myauthdb
> Auth_MySQL_Password_Table user_info
> Auth_MySQL_Encrypted_Passwords Off
> require valid-user
> </LocationMatch>
> </VirtualHost>
>
> I use LocationMatch to make sure anything in the website tree is protected
> (including aliases such as the /shared directory) and have a simple
> Vhosts.conf file
> All this works perfectly well, but now problems begin...
>
>
>
> I also have a shared cgi script folder (password protected also thanks to
> my
> LocationMatch rule) :
>
> ScriptAlias /upload/ /usr/lib/cgi-bin/upload/
>
> <Directory /usr/lib/cgi-bin/upload/>
> AllowOverride None
> Options ExecCGI
> Order allow,deny
> Allow from all
> </Directory>
>
> in this upload folder, i installed the MegaUpload cgi scripts.
> Those scripts consist in 2 parts :
> PHP scripts (located in /var/www/shared/private/php/upload)
> cgi scripts (located in /usr/lib/cgi-bin/upload/)
>
> First i connect to the /shared/private/php/upload/upload.php page (a form
> where i can choose files to upload), then when i click submit, this page
> issues a POST request to /upload/upload.cgi and the cgi handles the upload
> (and provide a progress bar).
>
> The scripts work perfectly well, except in one browser... (guess which?)
> ... internet explorer (Bingo!)
>
> What goes wrong is that when i click submit, the file seems to be uploaded
> (the little blue progress in the status bar moves), but in fact nothing is
> uploaded.
> Nothing appears in the logs until i click on stop in the browser, and then
> i
> have a nice 401 error :
>
> 82.66.244.63 - - [03/Dec/2004:14:07:26 +0100] "POST /upload/upload.cgi
> HTTP/1.1" 401 397
> "http://admin.ndd.tlp/shared/private/php/upload/upload.php" "Mozilla/4.0
> (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR1.1.4322)"
>
>
> I've tried to comment out my LocationMatch rule and everything works fine,
> my guess is that IE doesn't send its credentials when issuing the POST
> request.
> Unfortunately a vast majority of my clients use this browser so i can't
> ask
> them to change to firefox (for example).
>
> Anyone's ever seen this? Know a workaround?
> I'd like to keep my LocationMatch rule, since it simplifies greatly my
> Vhosts.conf file
>
>
>
> Thanks for your help.
>
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] POST to cgi Authentification Bug
Posted by Ralf Glauberman <rg...@michaeli-gymnasium.de>.
hi,
for performance reasons i would give you the tip to disable keepalive only
for this directory. it really reduces load.
ralf
----- Original Message -----
From: "gregory duchesnes" <gr...@icilalune.com>
To: <us...@httpd.apache.org>
Sent: Friday, December 03, 2004 4:49 PM
Subject: RE: [users@httpd] POST to cgi Authentification Bug
> replying to myself...
>
> After a lot of googling, i've solved my problem with this :
>
> BrowserMatchNoCase msie nokeepalive
>
> it's a bit dirty since it desactivates keepalives for any MSIE browser,
> but
> who cares? (Not me, that's for sure).
>
> By the way, it would be nice if someone can report this buggy IE behavior
>
> -----Message d'origine-----
> De : gregory duchesnes [mailto:gregory@icilalune.com]
> Envoye : vendredi 3 decembre 2004 14:41
> A : users@httpd.apache.org
> Objet : [users@httpd] POST to cgi Authentification Bug
>
>
> hi all,
>
> Prior to explain my problem let's explain my config :
>
> I have a bunch of Vhosts (all password protected Authtype Basic + MySQL).
> As i have a lot of scripts which are shared by all Vhosts, i have set up a
> shared folder thanks to an alias :
>
> Alias /shared /var/www/shared/
>
> <Directory /var/www/shared>
> Options FollowSymLinks
> AllowOverride None
> Order allow,deny
> Allow from all
> </Directory>
>
>
> My Vhosts config look like that :
>
> <VirtualHost *>
> ServerName admin.ndd.tlp
> DocumentRoot /var/www/ndd.tlp/admin/web
> CustomLog /var/www/ndd.tlp/admin/logs/access.log combined
> <LocationMatch /* >
> Authtype Basic
> AuthName "Administration"
> Auth_MySQL_DB myauthdb
> Auth_MySQL_Password_Table user_info
> Auth_MySQL_Encrypted_Passwords Off
> require valid-user
> </LocationMatch>
> </VirtualHost>
>
> I use LocationMatch to make sure anything in the website tree is protected
> (including aliases such as the /shared directory) and have a simple
> Vhosts.conf file
> All this works perfectly well, but now problems begin...
>
>
>
> I also have a shared cgi script folder (password protected also thanks to
> my
> LocationMatch rule) :
>
> ScriptAlias /upload/ /usr/lib/cgi-bin/upload/
>
> <Directory /usr/lib/cgi-bin/upload/>
> AllowOverride None
> Options ExecCGI
> Order allow,deny
> Allow from all
> </Directory>
>
> in this upload folder, i installed the MegaUpload cgi scripts.
> Those scripts consist in 2 parts :
> PHP scripts (located in /var/www/shared/private/php/upload)
> cgi scripts (located in /usr/lib/cgi-bin/upload/)
>
> First i connect to the /shared/private/php/upload/upload.php page (a form
> where i can choose files to upload), then when i click submit, this page
> issues a POST request to /upload/upload.cgi and the cgi handles the upload
> (and provide a progress bar).
>
> The scripts work perfectly well, except in one browser... (guess which?)
> ... internet explorer (Bingo!)
>
> What goes wrong is that when i click submit, the file seems to be uploaded
> (the little blue progress in the status bar moves), but in fact nothing is
> uploaded.
> Nothing appears in the logs until i click on stop in the browser, and then
> i
> have a nice 401 error :
>
> 82.66.244.63 - - [03/Dec/2004:14:07:26 +0100] "POST /upload/upload.cgi
> HTTP/1.1" 401 397
> "http://admin.ndd.tlp/shared/private/php/upload/upload.php" "Mozilla/4.0
> (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR1.1.4322)"
>
>
> I've tried to comment out my LocationMatch rule and everything works fine,
> my guess is that IE doesn't send its credentials when issuing the POST
> request.
> Unfortunately a vast majority of my clients use this browser so i can't
> ask
> them to change to firefox (for example).
>
> Anyone's ever seen this? Know a workaround?
> I'd like to keep my LocationMatch rule, since it simplifies greatly my
> Vhosts.conf file
>
>
>
> Thanks for your help.
>
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
RE: [users@httpd] POST to cgi Authentification Bug
Posted by gregory duchesnes <gr...@icilalune.com>.
replying to myself...
After a lot of googling, i've solved my problem with this :
BrowserMatchNoCase msie nokeepalive
it's a bit dirty since it desactivates keepalives for any MSIE browser, but
who cares? (Not me, that's for sure).
By the way, it would be nice if someone can report this buggy IE behavior
-----Message d'origine-----
De : gregory duchesnes [mailto:gregory@icilalune.com]
Envoye : vendredi 3 decembre 2004 14:41
A : users@httpd.apache.org
Objet : [users@httpd] POST to cgi Authentification Bug
hi all,
Prior to explain my problem let's explain my config :
I have a bunch of Vhosts (all password protected Authtype Basic + MySQL).
As i have a lot of scripts which are shared by all Vhosts, i have set up a
shared folder thanks to an alias :
Alias /shared /var/www/shared/
<Directory /var/www/shared>
Options FollowSymLinks
AllowOverride None
Order allow,deny
Allow from all
</Directory>
My Vhosts config look like that :
<VirtualHost *>
ServerName admin.ndd.tlp
DocumentRoot /var/www/ndd.tlp/admin/web
CustomLog /var/www/ndd.tlp/admin/logs/access.log combined
<LocationMatch /* >
Authtype Basic
AuthName "Administration"
Auth_MySQL_DB myauthdb
Auth_MySQL_Password_Table user_info
Auth_MySQL_Encrypted_Passwords Off
require valid-user
</LocationMatch>
</VirtualHost>
I use LocationMatch to make sure anything in the website tree is protected
(including aliases such as the /shared directory) and have a simple
Vhosts.conf file
All this works perfectly well, but now problems begin...
I also have a shared cgi script folder (password protected also thanks to my
LocationMatch rule) :
ScriptAlias /upload/ /usr/lib/cgi-bin/upload/
<Directory /usr/lib/cgi-bin/upload/>
AllowOverride None
Options ExecCGI
Order allow,deny
Allow from all
</Directory>
in this upload folder, i installed the MegaUpload cgi scripts.
Those scripts consist in 2 parts :
PHP scripts (located in /var/www/shared/private/php/upload)
cgi scripts (located in /usr/lib/cgi-bin/upload/)
First i connect to the /shared/private/php/upload/upload.php page (a form
where i can choose files to upload), then when i click submit, this page
issues a POST request to /upload/upload.cgi and the cgi handles the upload
(and provide a progress bar).
The scripts work perfectly well, except in one browser... (guess which?)
... internet explorer (Bingo!)
What goes wrong is that when i click submit, the file seems to be uploaded
(the little blue progress in the status bar moves), but in fact nothing is
uploaded.
Nothing appears in the logs until i click on stop in the browser, and then i
have a nice 401 error :
82.66.244.63 - - [03/Dec/2004:14:07:26 +0100] "POST /upload/upload.cgi
HTTP/1.1" 401 397
"http://admin.ndd.tlp/shared/private/php/upload/upload.php" "Mozilla/4.0
(compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR1.1.4322)"
I've tried to comment out my LocationMatch rule and everything works fine,
my guess is that IE doesn't send its credentials when issuing the POST
request.
Unfortunately a vast majority of my clients use this browser so i can't ask
them to change to firefox (for example).
Anyone's ever seen this? Know a workaround?
I'd like to keep my LocationMatch rule, since it simplifies greatly my
Vhosts.conf file
Thanks for your help.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org