Commit e06d33da authored by Andre Malo's avatar Andre Malo
Browse files

OR_ALL is not a good choice. Use more restrictive permissions for the 

mod_filter directives.

OR_OPTIONS for all but FilterTrace, which isn't allowed in htaccess,
because it could DoS the server (see docs).

We should consider to introduce an allowoverride filters or so.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@105477 13f79535-47bb-0310-9956-ffa450edef68
parent 403fe695

modules/experimental/mod_filter.c

+10 −9
Original line number Diff line number Diff line
@@ -720,15 +720,16 @@ static void *filter_merge(apr_pool_t *pool, void *BASE, void *ADD) 
}



static const command_rec filter_cmds[] = {

    AP_INIT_TAKE23("FilterDeclare", filter_declare, NULL, OR_ALL,

    AP_INIT_TAKE23("FilterDeclare", filter_declare, NULL, OR_OPTIONS,

        "filter-name, dispatch-criterion [, filter-type]"),

    AP_INIT_TAKE3("FilterProvider", filter_provider, NULL, OR_ALL,

    AP_INIT_TAKE3("FilterProvider", filter_provider, NULL, OR_OPTIONS,

        "filter-name, provider-name, dispatch-match"),

    AP_INIT_ITERATE("FilterChain", filter_chain, NULL, OR_ALL,

    AP_INIT_ITERATE("FilterChain", filter_chain, NULL, OR_OPTIONS,

        "list of filter names with optional [+-=!@]"),

    AP_INIT_TAKE2("FilterTrace", filter_debug, NULL, OR_ALL, "Debug level") ,

    AP_INIT_TAKE2("FilterTrace", filter_debug, NULL, RSRC_CONF | ACCESS_CONF,

        "Debug level"),

#ifndef NO_PROTOCOL

    AP_INIT_TAKE23("FilterProtocol", filter_protocol, NULL, OR_ALL,

    AP_INIT_TAKE23("FilterProtocol", filter_protocol, NULL, OR_OPTIONS,

        "filter-name [provider-name] protocol-args"),

#endif

    { NULL }