Re: cvs commit: httpd-2.0/server request.c

["Paul J. Reder" <re...@remulak.net>]

wrowe@apache.org wrote:

> wrowe       2002/12/11 23:05:54
> 
>   Modified:    server   request.c
>   Log:
>     Make the code simpler to follow, and perhaps clear up the follow-symlink
>     bug reports we have seen on bugzilla.  e.g. 14206 etc.
>   
>   Revision  Changes    Path
>   1.122     +23 -43    httpd-2.0/server/request.c


Sorry to be the bearer of bad news but the problem reported in 14206 still

occurs with this new code. All you have to do is the following:

In your htdocs directory:

mv index.html foo.html
ln -s foo.html index.html

In your httpd.conf:


# Note: Options should not allow FollowSymLinks
<Directory />
     Options None
     AllowOverride None
</Directory>

<Directory /home/Apache/htdocs>
    Options None
    AllowOverride None
    Order deny,allow
    Allow from all
</Directory>


Now bring up your browser and request:

http://your.machine.name:port/index.html

You'll get a 403:forbidden error.

http://your.machine.name:port/

You'll get the page foo.html.

I can spend more time tracking this if you want, but it won't be
till this afternoon.

-- 
Paul J. Reder
-----------------------------------------------------------
"The strength of the Constitution lies entirely in the determination of each
citizen to defend it.  Only if every single citizen feels duty bound to do
his share in this defense are the constitutional rights secure."
-- Albert Einstein

Re: cvs commit: httpd-2.0/server request.c

[Francis Daly <de...@daoine.org>]

On Thu, Dec 12, 2002 at 11:31:44AM -0500, Paul J.  Reder wrote:

> wrowe@apache.org wrote:
> 
> >wrowe       2002/12/11 23:05:54
> >
> >  Modified:    server   request.c
> >  Log:
> >    Make the code simpler to follow, and perhaps clear up the 
> >    follow-symlink
> >    bug reports we have seen on bugzilla.  e.g. 14206 etc.
> 
> Sorry to be the bearer of bad news but the problem reported in 14206 still
> occurs with this new code. 

[snip]

> Now bring up your browser and request:
> 
> http://your.machine.name:port/index.html
> 
> You'll get a 403:forbidden error.
> 
> http://your.machine.name:port/
> 
> You'll get the page foo.html.
> 
> I can spend more time tracking this if you want, but it won't be
> till this afternoon.

Can I point out the mail archived at

http://marc.theaimsgroup.com/?l=apache-httpd-dev&m=103938644204488&w=2

sent on December 8th, which has some discussion of this issue.

It might give some pointers as to where to start looking.

The patch there probably won't apply cleanly any more, of course.

All the best,

	f
-- 
Francis Daly        deva@daoine.org