Fix for the buggy behavior of proxy_ftp.c which would return incorrect links
for ".." directory entries , depending on the fact whether the request contained a trailing slash or not. Also add a small "feature": the full directory path broken down into separate clickable path components which makes traversal of public ftp servers much easier. Future improvements in this area include: 0) add appropriate cache control headers to prevent caches from keeping sensitive documents (user:password@) 1) make clickable header optional ("ProxyOptions +ClickHeader" 2) return an external redirection if proxy_ftp detects a directory but the request did not contain a trailing slash (that would make the current BASE HREF= header field obsolete which in turn would allow the removal of the last occurrence of the "user:password@" prefix from the generated document). 3) return a 401 authenticate reply if the addressed ftp server requires a user name (other than "anonymous") or a password (other than "apache@"), unless the request contained a WWW-Authenticate: header already. 4) Optionally convert requests ftp://user:password@host/ on-the-fly into requests of the form ftp://host/ plus the appropriate WWW-Authenticate: header when forwarding to an upstream proxy, lessening the danger of publishing passwords thru use of log file analyzers. Reviewed by: Ken Coar, Roy T. Fielding git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@79647 13f79535-47bb-0310-9956-ffa450edef68
parent
4c013578
Please register or sign in to comment