Oh look, none of my Web pages work

[ro...@excc.exeter.ac.uk]

I've just upgraded from apache 1.3.9 to 1.3.12. All seemed fine until
we noticed html tags being displayed in our web pages rather than
being treated as tags. We quickly realised it was due to 'echo' in
mod_include, checked the new docs and saw that the behaviour of echo
has changed. Incompatibly. Unless you explicitly ask it not to, it
escapes html tags for you. It's that Microsoft moment.

This is very bad. I have 5961 html files on my system with the execute
bit set and grep -l is in the process of telling me how many of them
contain the string '#echo'. I'm going to write a script of course, but
I've got to be sure to preserve ownership, group and permissions, keep
a backup and Joe Webpagewriter shouldn't have to do all that. Besides,
when you do things with a script there's always this nagging fear.

Things that break existing configuration files are bad and best
avoided if possible. Things that break web pages are absolutely
fatal. By all means add new options but do not break people's legal
pages. In future, please either make the old behaviour the default or
create an entirely new command ('print' ?) with the old one as a
synonym for backwards compatibility.

Having said all that, thanks a lot for all the work on apache. The
purpose of this little diatribe is to be helpful not to criticise.


John

PS I'm in luck: only 885 html files contain '#echo'.

Re: Oh look, none of my Web pages work

[Rodent of Unusual Size <Ke...@Golux.Com>]

rowe@excc.ex.ac.uk wrote:
> 
> Things that break existing configuration files are bad and best
> avoided if possible. Things that break web pages are absolutely
> fatal.

And things that compromise security are intolerable.  This falls
into that category.  This is not a 'new option,' it is a fix
to a security loophole.

I'll leave it to others to comment on the advisability of making
the behaviour switchable; I'm of two minds about it.
-- 
#ken    P-)}

Ken Coar                    <http://Golux.Com/coar/>
Apache Software Foundation  <http://www.apache.org/>
"Apache Server for Dummies" <http://Apache-Server.Com/>
"Apache Server Unleashed"   <http://ApacheUnleashed.Com/>