source:
trunk/server/common/patches/httpd-2.2.x-mod_status-security.patch
@
2581
Last change on this file since 2581 was 795, checked in by geofft, 16 years ago | |
---|---|
File size: 2.3 KB |
-
modules/generators/mod_status.c
Prevents mod_status from taking effect in .htaccess files, by requiring a directive that's only permitted in directory context. Signed-off-by: Quentin Smith <quentin@mit.edu> Signed-off-by: Geoffrey Thomas <geofft@mit.edu>
a b 115 115 static pid_t child_pid; 116 116 #endif 117 117 118 typedef struct { 119 int permit_status_handler; 120 } status_config_rec; 121 118 122 /* 119 123 * command-related code. This is here to prevent use of ExtendedStatus 120 124 * without status_module included. … … 139 143 return NULL; 140 144 } 141 145 146 static void *create_status_dir_config(apr_pool_t *p, char *d) 147 { 148 status_config_rec *conf = apr_pcalloc(p, sizeof(*conf)); 149 conf->permit_status_handler = 0; 150 return conf; 151 } 152 142 153 143 154 static const command_rec status_module_cmds[] = 144 155 { … … 147 158 AP_INIT_FLAG("SeeRequestTail", set_reqtail, NULL, RSRC_CONF, 148 159 "For verbose requests, \"On\" to see the last 63 chars of the request, " 149 160 "\"Off\" (default) to see the first 63 in extended status display"), 161 AP_INIT_FLAG("PermitStatusHandler", ap_set_flag_slot, 162 (void *)APR_OFFSETOF(status_config_rec, permit_status_handler), 163 ACCESS_CONF, 164 "As a security measure, only permit status handlers where this flag " 165 "is set. Only legal in directory context, not .htaccess."), 150 166 {NULL} 151 167 }; 152 168 … … 247 263 pid_t *pid_buffer, worker_pid; 248 264 clock_t tu, ts, tcu, tcs; 249 265 ap_generation_t worker_generation; 250 251 if (strcmp(r->handler, STATUS_MAGIC_TYPE) && 252 strcmp(r->handler, "server-status")) { 266 267 status_config_rec *conf = ap_get_module_config(r->per_dir_config, 268 &status_module); 269 270 if ((strcmp(r->handler, STATUS_MAGIC_TYPE) && 271 strcmp(r->handler, "server-status")) || 272 !conf->permit_status_handler) { 253 273 return DECLINED; 254 274 } 255 275 … … 871 891 module AP_MODULE_DECLARE_DATA status_module = 872 892 { 873 893 STANDARD20_MODULE_STUFF, 874 NULL,/* dir config creater */894 create_status_dir_config, /* dir config creater */ 875 895 NULL, /* dir merger --- default is to override */ 876 896 NULL, /* server config */ 877 897 NULL, /* merge server config */
Note: See TracBrowser
for help on using the repository browser.