You are viewing a plain text version of this content. The canonical link for it is here.
Posted to apache-bugdb@apache.org by wr...@apache.org on 2001/08/07 15:35:23 UTC
Re: mod_dir/161: Questionable performace of mod_dir() with negotiation
[In order for any reply to be added to the PR database, you need]
[to include <ap...@Apache.Org> in the Cc line and make sure the]
[subject line starts with the report component and number, with ]
[or without any 'Re:' prefixes (such as "general/1098:" or ]
["Re: general/1098:"). If the subject doesn't match this ]
[pattern, your message will be misfiled and ignored. The ]
["apbugs" address is not added to the Cc line of messages from ]
[the database automatically because of the potential for mail ]
[loops. If you do not include this Cc, your reply may be ig- ]
[nored unless you are responding to an explicit request from a ]
[developer. Reply only with text; DO NOT SEND ATTACHMENTS! ]
Synopsis: Questionable performace of mod_dir() with negotiation
State-Changed-From-To: suspended-closed
State-Changed-By: wrowe
State-Changed-When: Tue Aug 7 06:35:22 PDT 2001
State-Changed-Why:
"We did a lot of cleanup around 1.2b8 with the request
promotion that handle_multi()"
And with that the bugs (vulnerabilities?) remained. This
function has moved into the http_protocol.c core as an
internal_fast_redirect, but it's just as likely to be
deprecated if it is not maintained. That code wasn't
resetting the uri, causing problems with query arguments.
Caching, throughout the server, is more likely to benefit
Apache 2.0. Time will tell. You are correct, that this
is a faster transition than an internal redirect, but it
bypasses some of the checkers to take advantage of some
assumptions that may not be safe.
Bill