config/4085: SymLinks are followed in 1.2.4, but not in 1.3.4

[Ken Smith <Ke...@wrd.state.or.us>]

>Number:         4085
>Category:       config
>Synopsis:       SymLinks are followed in 1.2.4, but not in 1.3.4
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    apache
>State:          open
>Class:          sw-bug
>Submitter-Id:   apache
>Arrival-Date:   Thu Mar 18 14:40:02 PST 1999
>Last-Modified:
>Originator:     Kenneth.L.Smith@wrd.state.or.us
>Organization:
apache
>Release:        1.3.4
>Environment:
HP-UX 10.20, using GCC and CC
>Description:
After attempting to upgrade from 1.2.4 to 1.3.4, I discovered that it would not
follow all symbolic links. It will follow links that are internal to the tree.
It will not follow links that are outside of the document root, or that are in
the document root, but fully qualified. I have set up a plain vanilla install
of Apache to test this without .htaccess and such and still have the problem.
Has the method of following links changed between these two versions?

My httpd.conf has the following entries:

<Directory />
  AllowOverride None
  Options FollowSymLinks
  order allow,deny
  deny from all
</Directory>

<Directory /apps/web/htdocs>
  Options Indexes FollowSymLinks IncludesNOEXEC
  AllowOverride AuthConfig
  order allow,deny
  allow from all
</Directory>

>How-To-Repeat:
http://klamath.wrd.state.or.us
>Fix:

>Audit-Trail:
>Unformatted:
[In order for any reply to be added to the PR database, ]
[you need to include <ap...@Apache.Org> in the Cc line ]
[and leave the subject line UNCHANGED.  This is not done]
[automatically because of the potential for mail loops. ]
[If you do not include this Cc, your reply may be ig-   ]
[nored unless you are responding to an explicit request ]
[from a developer.                                      ]
[Reply only with text; DO NOT SEND ATTACHMENTS!         ]