You are viewing a plain text version of this content. The canonical link for it is here.
Posted to bugs@httpd.apache.org by bu...@apache.org on 2020/10/05 11:51:31 UTC
[Bug 64785] New: allowmethods should be able to disable individual
methods
https://bz.apache.org/bugzilla/show_bug.cgi?id=64785
Bug ID: 64785
Summary: allowmethods should be able to disable individual
methods
Product: Apache httpd-2
Version: 2.5-HEAD
Hardware: PC
OS: Mac OS X 10.1
Status: NEW
Severity: enhancement
Priority: P2
Component: mod_allowmethods
Assignee: bugs@httpd.apache.org
Reporter: covener@gmail.com
Target Milestone: ---
Currently mod_allowmethods can only allow all methods (reset) or specific
methods (FOO, BAR, BAZ) but cannot simply prevent a method from being used.
It would be nice to support something like this including merge:
AllowMethods -OPTIONS
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 64785] allowmethods should be able to disable individual
methods
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=64785
--- Comment #1 from Marcel Montes <sp...@gmail.com> ---
I've been talking to Eric Covener that I'm willing to give this a try.
I have no background on httpd hacking so wish me luck.
For now I'm checking the source code of allowmethods and server/core.c to see
how doing the same with Options was handled.
Any pointers are welcome.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 64785] allowmethods should be able to disable individual
methods
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=64785
--- Comment #4 from Marcel Montes <sp...@gmail.com> ---
Created attachment 37490
--> https://bz.apache.org/bugzilla/attachment.cgi?id=37490&action=edit
mod_allowmethods implementation of +-METHOD options
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 64785] allowmethods should be able to disable individual
methods
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=64785
Marcel Montes <sp...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Attachment #37497|0 |1
is obsolete| |
--- Comment #9 from Marcel Montes <sp...@gmail.com> ---
Created attachment 37501
--> https://bz.apache.org/bugzilla/attachment.cgi?id=37501&action=edit
mod_allowmethods implementation of +-METHOD options
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 64785] allowmethods should be able to disable individual
methods
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=64785
--- Comment #5 from Marcel Montes <sp...@gmail.com> ---
Created attachment 37491
--> https://bz.apache.org/bugzilla/attachment.cgi?id=37491&action=edit
mod_allowmethods tests
Patch for two simple test cases.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 64785] allowmethods should be able to disable individual
methods
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=64785
Marcel Montes <sp...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Attachment #37491|0 |1
is obsolete| |
--- Comment #8 from Marcel Montes <sp...@gmail.com> ---
Created attachment 37500
--> https://bz.apache.org/bugzilla/attachment.cgi?id=37500&action=edit
mod_allowmethods tests
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 64785] allowmethods should be able to disable individual
methods
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=64785
--- Comment #13 from Marcel Montes <sp...@gmail.com> ---
Yes, forgot to add t/htdocs/modules/allowmethods/NoPost for the -POST test,
sorry.
New patch attached.
(In reply to Eric Covener from comment #11)
> I think you may have forgotten to "svn add" some of the static files in
> t/htdocs. Check svn status /t/htdocs/modules/allowmethods|egrep ^?
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 64785] allowmethods should be able to disable individual
methods
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=64785
Eric Covener <co...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Keywords| |PatchAvailable
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 64785] allowmethods should be able to disable individual
methods
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=64785
Marcel Montes <sp...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Attachment #37490|0 |1
is obsolete| |
--- Comment #7 from Marcel Montes <sp...@gmail.com> ---
Created attachment 37497
--> https://bz.apache.org/bugzilla/attachment.cgi?id=37497&action=edit
mod_allowmethods implementation of +-METHOD options
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 64785] allowmethods should be able to disable individual
methods
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=64785
Marcel Montes <sp...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
OS|Mac OS X 10.1 |All
Hardware|PC |All
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 64785] allowmethods should be able to disable individual
methods
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=64785
--- Comment #6 from Marcel Montes <sp...@gmail.com> ---
Created attachment 37495
--> https://bz.apache.org/bugzilla/attachment.cgi?id=37495&action=edit
documentation of AllowMethods +|-Method
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 64785] allowmethods should be able to disable individual
methods
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=64785
Eric Covener <co...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Keywords| |FixedInTrunk
--- Comment #14 from Eric Covener <co...@gmail.com> ---
Thank you Marcel! Committed in
http://svn.apache.org/viewvc?rev=1883203&view=rev and will propose for 2.4.x
soon.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 64785] allowmethods should be able to disable individual
methods
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=64785
Marcel Montes <sp...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |spiceman@gmail.com
--- Comment #2 from Marcel Montes <sp...@gmail.com> ---
Created attachment 37484
--> https://bz.apache.org/bugzilla/attachment.cgi?id=37484&action=edit
mod_allowmethods implementation of +-METHOD options
Well, I'm attaching my jab at implementing this.
There's probably some not so stellar code.
In particular I'm interested in knowing if there's a better way to get a hold
of list of available/recognized methods.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 64785] allowmethods should be able to disable individual
methods
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=64785
--- Comment #3 from Marcel Montes <sp...@gmail.com> ---
Another aspect I'm not sure about is if a specific aspect of the implementation
makes sense.
Previously, when conf->allowed == 0, it meant no method was flagged as allowed,
so all where (it was effectively a reset/no conf)
But now, in the following case, no method would be flagged as allowed, but I'd
still expect it to be enforced for /foo/bar:
<Directory /foo>
AllowMethods GET
</Directory>
<Directory /foo/bar>
AllowMethods -GET
</Directory>
I think that makes sense, but I'd like know other people's view on this.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 64785] allowmethods should be able to disable individual
methods
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=64785
--- Comment #10 from Marcel Montes <sp...@gmail.com> ---
Well, got it working.
I've added some tests and everything seems to be in working order, finally.
This needs some reviewing :)
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 64785] allowmethods should be able to disable individual
methods
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=64785
Eric Covener <co...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |NEEDINFO
--- Comment #11 from Eric Covener <co...@gmail.com> ---
I think you may have forgotten to "svn add" some of the static files in
t/htdocs. Check svn status /t/htdocs/modules/allowmethods|egrep ^?
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 64785] allowmethods should be able to disable individual
methods
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=64785
Marcel Montes <sp...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEEDINFO |NEW
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 64785] allowmethods should be able to disable individual
methods
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=64785
Marcel Montes <sp...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Attachment #37484|0 |1
is obsolete| |
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 64785] allowmethods should be able to disable individual
methods
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=64785
Marcel Montes <sp...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Attachment #37500|0 |1
is obsolete| |
--- Comment #12 from Marcel Montes <sp...@gmail.com> ---
Created attachment 37523
--> https://bz.apache.org/bugzilla/attachment.cgi?id=37523&action=edit
mod_allowmethods tests
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org