Skip to content
  1. May 14, 2009
  3. May 13, 2009
  5. May 12, 2009
  7. May 10, 2009
  9. May 08, 2009
    • Joe Orton's avatar
      * .gdbinit (dump_table): Dump pointer value of table entries, · f383fa33
      Joe Orton authored 
        sometimes useful.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@773039 13f79535-47bb-0310-9956-ffa450edef68
      f383fa33
    • Joe Orton's avatar
      Security fix for CVE-2009-1195: fix Options handling such that · 701b5288
      Joe Orton authored 
      'AllowOverride Options=IncludesNoExec' does not permit Includes with
exec= enabled to be configured in an .htaccess file:

* include/http_core.h: Change semantics of Includes/IncludeNoExec
  options bits to be additive; OPT_INCLUDES now means SSI is enabled
  without exec=.  OPT_INCLUDES|OPT_INC_WITH_EXEC means SSI is enabled
  with exec=.

* server/core.c (create_core_dir_config): Remove defunct OPT_INCNOEXEC
  from default override_opts; no functional change.
  (merge_core_dir_configs): Update logic to ensure that exec= is
  disabled in a context where IncludesNoexec is configured, even if
  Includes-with-exec is permitted in the inherited options set.
  (set_allow_opts, set_options): Update to reflect new semantics
  of OPT_INCLUDES, OPT_INC_WITH_EXEC.

* server/config.c: Update to remove OPT_INCNOEXEC from default 
  override_opts; no functional change.

* modules/filters/mod_include.c (includes_filter): Update to reflect
  new options semantics - disable exec= support if the
  OPT_INC_WITH_EXEC bit is not set.

Submitted by: Jonathan Peatfield <j.s.peatfield damtp.cam.ac.uk>,
          jorton
Thanks to: Vincent Danon <vdanon redhat.com>


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@772997 13f79535-47bb-0310-9956-ffa450edef68
      701b5288