Loading CHANGES +3 −0 Original line number Diff line number Diff line Loading @@ -10,6 +10,9 @@ Changes with Apache 2.2.23 possible XSS for a site where untrusted users can upload files to a location with MultiViews enabled. [Niels Heinen <heinenn google.com>] *) core: Add filesystem paths to access denied / access failed messages. [Eric Covener] *) core: Fix error handling in ap_scan_script_header_err_brigade() if there is no EOS bucket in the brigade. PR 48272. [Stefan Fritsch] Loading STATUS +0 −6 Original line number Diff line number Diff line Loading @@ -107,12 +107,6 @@ PATCHES ACCEPTED TO BACKPORT FROM TRUNK: 2.2.x patch: http://people.apache.org/~rjung/patches/treat_ldap_unavailable_transient-2_2.patch +1: rjung, fuankg, wrowe * core: add filesystem paths to some common error messages. trunk patch: http://svn.apache.org/viewvc?view=revision&revision=1301504 2.4.x patch: http://svn.apache.org/viewvc?view=revision&revision=1302426 2.2.x patch: http://people.apache.org/~rjung/patches/improve-forbidden-error-message-2_2.patch +1: rjung, trawick, wrowe PATCHES PROPOSED TO BACKPORT FROM TRUNK: [ New proposals should be added at the end of the list ] Loading server/request.c +5 −2 Original line number Diff line number Diff line Loading @@ -1011,7 +1011,9 @@ AP_DECLARE(int) ap_directory_walk(request_rec *r) } else if (APR_STATUS_IS_EACCES(rv)) { ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, "access to %s denied", r->uri); "access to %s denied (filesystem path '%s') " "because search permissions are missing on a " "component of the path", r->uri, r->filename); return r->status = HTTP_FORBIDDEN; } else if ((rv != APR_SUCCESS && rv != APR_INCOMPLETE) Loading @@ -1020,7 +1022,8 @@ AP_DECLARE(int) ap_directory_walk(request_rec *r) * rather than assume not found. */ ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, "access to %s failed", r->uri); "access to %s failed (filesystem path '%s')", r->uri, r->filename); return r->status = HTTP_FORBIDDEN; } Loading Loading
CHANGES +3 −0 Original line number Diff line number Diff line Loading @@ -10,6 +10,9 @@ Changes with Apache 2.2.23 possible XSS for a site where untrusted users can upload files to a location with MultiViews enabled. [Niels Heinen <heinenn google.com>] *) core: Add filesystem paths to access denied / access failed messages. [Eric Covener] *) core: Fix error handling in ap_scan_script_header_err_brigade() if there is no EOS bucket in the brigade. PR 48272. [Stefan Fritsch] Loading
STATUS +0 −6 Original line number Diff line number Diff line Loading @@ -107,12 +107,6 @@ PATCHES ACCEPTED TO BACKPORT FROM TRUNK: 2.2.x patch: http://people.apache.org/~rjung/patches/treat_ldap_unavailable_transient-2_2.patch +1: rjung, fuankg, wrowe * core: add filesystem paths to some common error messages. trunk patch: http://svn.apache.org/viewvc?view=revision&revision=1301504 2.4.x patch: http://svn.apache.org/viewvc?view=revision&revision=1302426 2.2.x patch: http://people.apache.org/~rjung/patches/improve-forbidden-error-message-2_2.patch +1: rjung, trawick, wrowe PATCHES PROPOSED TO BACKPORT FROM TRUNK: [ New proposals should be added at the end of the list ] Loading
server/request.c +5 −2 Original line number Diff line number Diff line Loading @@ -1011,7 +1011,9 @@ AP_DECLARE(int) ap_directory_walk(request_rec *r) } else if (APR_STATUS_IS_EACCES(rv)) { ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, "access to %s denied", r->uri); "access to %s denied (filesystem path '%s') " "because search permissions are missing on a " "component of the path", r->uri, r->filename); return r->status = HTTP_FORBIDDEN; } else if ((rv != APR_SUCCESS && rv != APR_INCOMPLETE) Loading @@ -1020,7 +1022,8 @@ AP_DECLARE(int) ap_directory_walk(request_rec *r) * rather than assume not found. */ ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, "access to %s failed", r->uri); "access to %s failed (filesystem path '%s')", r->uri, r->filename); return r->status = HTTP_FORBIDDEN; } Loading