[PATCH] PR#717: improper vhost merging of and

[Dean Gaudet <dg...@arctic.org>]

When processing Location and Directory, all that match the url/filename
are applied.  However, when merging the main server's directives with
virtual host's, they are ordered such that the vhost's come first and
then the main server.  For example:

<Location />
    Options none
</Location>

<VirtualHost foo>
    <Location /foooof>
	Options all
    </Location>
</VirtualHost>

In this case, the vhost's Location will be matched first, and then the
main server's second... the result is that the vhost cannot override
the main server's settings at all.

A similar thing occurs with Directory sections.  But in practice it's not
as deadly because of how directory_walk works, and prior to 1.2 it
wouldn't have been a problem at all since only the first matching
<Directory> was used (and now all matches are used).  You can contrive
examples such as: 

<Directory />
    Options none
</Directory>

<VirtualHost foo>
    <Directory />
	Options all
    </Directory>
</VirtualHost>

Where the vhost cannot override the main server.

The fix is to change the ordering of the arguments to append_arrays.  Put
the main server's before the vhost's. 

This is for 1.3 and 1.2.

Dean

Index: http_core.c
===================================================================
RCS file: /export/home/cvs/apache/src/http_core.c,v
retrieving revision 1.105
diff -u -r1.105 http_core.c
--- http_core.c	1997/08/03 21:00:08	1.105
+++ http_core.c	1997/08/03 23:06:05
@@ -200,8 +200,8 @@
     *conf = *virt;
     if (!conf->access_name) conf->access_name = base->access_name;
     if (!conf->document_root) conf->document_root = base->document_root;
-    conf->sec = append_arrays (p, virt->sec, base->sec);
-    conf->sec_url = append_arrays (p, virt->sec_url, base->sec_url);
+    conf->sec = append_arrays (p, base->sec, virt->sec);
+    conf->sec_url = append_arrays (p, base->sec, virt->sec_url);
 
     return conf;
 }