You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@httpd.apache.org by Rob Hartill <ro...@imdb.com> on 1996/06/28 15:52:34 UTC
Re: WWW Form Bug Report: "SetEnv in .htaccess" on HPUX
I'll pass your suggestion on to the developers list.
thanks.
rob
>Submitter: sfk@hplb.hpl.hp.com
>Operating system: HPUX, version:
>Version of Apache Used: 1.1b4
>Extra Modules used: not relevant
>URL exhibiting problem:
>
>Symptoms:
>--
>This is actually an enhancement request (but there
>is no relevant form.) Would it be possible to
>allow SetEnv directives to appear in .htaccess?
>We are running sites where it would be very useful
>to allow users to specify environment variables
>for their CGI scripts without having to request
>us to put it into the *.conf files.
>
>Thanks, Steve
>--
>
>Backtrace:
>--
>
>--
--
Rob Hartill (robh@imdb.com)
The Internet Movie Database (IMDb) http://www.imdb.com/
...more movie info than you can poke a stick at.
Re: WWW Form Bug Report: "SetEnv in .htaccess" on HPUX
Posted by "James H. Cloos Jr." <cl...@jhcloos.com>.
Brian> This seems reasonable enough to me. Isn't it a simple change
Brian> in the command_rec?
Ben> And the stuff of CERT alerts. This would possibly allow, at
Ben> least, shared library hacks, and perhaps worse stuff. If there
Ben> were a list somewhere else of envs which .htaccess is permitted
Ben> to change it might be OK.
Of course, if they have CGI access they can already set such variables
and call other binaries to make use of alternate shared objects, etc.
But that wouldn't affect the server itself.
So a compromise might be a directive that will set a table of
name/value pairs that get added to the environment whenever an
external process is called, such as CGIs, anything exec'ed by
mod_include, etc.
This would create extra bloat, but it is at least worth it to discuss
it or other solutions.
-JimC
--
James H. Cloos, Jr. <URL:http://www.io.com/~cloos/>
cloos@io.com LPF,Usenix,SAGE,ISOC,ACLU
Re: WWW Form Bug Report: "SetEnv in .htaccess" on HPUX
Posted by Alexei Kosut <ak...@organic.com>.
On Fri, 28 Jun 1996, Brian Behlendorf wrote:
> This seems reasonable enough to me. Isn't it a simple change in the
> command_rec?
Nope. You need to redo the configuration as a per-dir config, not a server
config. It's pretty straightforward, but not as simple as just changing
the command_rec entry.
-- Alexei Kosut <ak...@organic.com> The Apache HTTP Server
http://www.nueva.pvt.k12.ca.us/~akosut/ http://www.apache.org/
Re: WWW Form Bug Report: "SetEnv in .htaccess" on HPUX
Posted by Brian Behlendorf <br...@organic.com>.
This seems reasonable enough to me. Isn't it a simple change in the
command_rec?
Brian
On Fri, 28 Jun 1996, Rob Hartill wrote:
> I'll pass your suggestion on to the developers list.
> thanks.
>
>
> rob
>
> >Submitter: sfk@hplb.hpl.hp.com
> >Operating system: HPUX, version:
> >Version of Apache Used: 1.1b4
> >Extra Modules used: not relevant
> >URL exhibiting problem:
> >
> >Symptoms:
> >--
> >This is actually an enhancement request (but there
> >is no relevant form.) Would it be possible to
> >allow SetEnv directives to appear in .htaccess?
> >We are running sites where it would be very useful
> >to allow users to specify environment variables
> >for their CGI scripts without having to request
> >us to put it into the *.conf files.
> >
> >Thanks, Steve
> >--
> >
> >Backtrace:
> >--
> >
> >--
>
>
> --
> Rob Hartill (robh@imdb.com)
> The Internet Movie Database (IMDb) http://www.imdb.com/
> ...more movie info than you can poke a stick at.
>
--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--
brian@organic.com www.apache.org hyperreal.com http://www.organic.com/JOBS