Fix for the buggy behavior of proxy_ftp.c which would return incorrect links
for ".." directory entries , depending on the fact whether the request
contained a trailing slash or not.
Also add a small "feature": the full directory path broken down into separate
clickable path components which makes traversal of public ftp servers much
easier.
Future improvements in this area include:
0) add appropriate cache control headers to prevent caches from keeping
sensitive documents (user:password@)
1) make clickable header optional ("ProxyOptions +ClickHeader"
2) return an external redirection if proxy_ftp detects a directory but the
request did not contain a trailing slash (that would make the current BASE
HREF= header field obsolete which in turn would allow the removal of the
last occurrence of the "user:password@" prefix from the generated document).
3) return a 401 authenticate reply if the addressed ftp server requires a
user name (other than "anonymous") or a password (other than "apache@"),
unless the request contained a WWW-Authenticate: header already.
4) Optionally convert requests ftp://user:password@host/ on-the-fly into
requests of the form ftp://host/ plus the appropriate WWW-Authenticate:
header when forwarding to an upstream proxy, lessening the danger of
publishing passwords thru use of log file analyzers.
Reviewed by: Ken Coar, Roy T. Fielding
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@79647 13f79535-47bb-0310-9956-ffa450edef68
Loading
Please sign in to comment