Bug 44262 - AllowOverride Options= grants the permission of the 'All' option.
Summary: AllowOverride Options= grants the permission of the 'All' option.
Status: RESOLVED FIXED
Alias: None
Product: Apache httpd-2
Classification: Unclassified
Component: Core (show other bugs)
Version: 2.2.6
Hardware: All All
: P2 normal (vote)
Target Milestone: ---
Assignee: Apache HTTPD Bugs Mailing List
URL:
Keywords: FixedInTrunk, PatchAvailable
Depends on:
Blocks:
 
Reported: 2008-01-18 00:36 UTC by aoyama
Modified: 2009-08-23 13:43 UTC (History)
0 users


Attachments
Proposed patch (867 bytes, text/plain)
2008-05-02 00:06 UTC, Michał Grzędzicki 		Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description aoyama 2008-01-18 00:36:55 UTC 
If one option is permitted, 'All' is permitted. 
Impact:
The user can use CGI/SSI/Symlink from any place with own .htaccess.
Example:

httpd.conf:
<Directory "/home/*/public_html">
    AllowOverride Options=Indexes
    Options Indexes
</Directory>

/home/user/public_html/.htaccess:
Options +All


source code:
httpd-2.2.6/server/core.c line 1461:
         if (!(cmd->override_opts & opt) && opt != OPT_NONE) {

When opt contains two or more bits, override_opts passes any bits of opt.
In 2.2.6 cases, OPT_ALL is defined 
as "(OPT_INDEXES|OPT_INCLUDES|OPT_SYM_LINKS|OPT_EXECCGI)".
Comment 1 Michał Grzędzicki 2008-05-02 00:06:08 UTC 
Created attachment 21899 [details]
Proposed patch

Fix 2 issues
1)  AllowOverride Options allows overriding all the options just as in 2.0
2) Options All in .htacess is allowed only if all it's bits are allowed to be overriden, fix this bug
Comment 2 Ruediger Pluem 2008-05-02 13:03:25 UTC 
Thanks for the patch. I only committed the second part of your patch as r652885 (http://svn.apache.org/viewvc?rev=652885&view=rev) that fixes your bug. For the first part of your patch I think the current behaviour is as designed. In the case you disagree please continue this discussion on dev@httpd.apache.org.
Comment 3 Michał Grzędzicki 2008-05-02 14:22:43 UTC 
(In reply to comment #2)
> Thanks for the patch. I only committed the second part of your patch as r652885
> (http://svn.apache.org/viewvc?rev=652885&view=rev) that fixes your bug. For the
> first part of your patch I think the current behaviour is as designed. In the
> case you disagree please continue this discussion on dev@httpd.apache.org.

Ok I will recheck it and continue ther later.
Comment 4 Ruediger Pluem 2008-05-26 13:06:09 UTC 
Proposed for backport to 2.2.x as r660284 (http://svn.apache.org/viewvc?rev=660284&view=rev).
Comment 5 Nick Kew 2009-08-23 13:43:56 UTC 
Fix was backported; PR wasn't closed.