mod_alias: Ensure Redirect issues a valid URL

PR 44020
Patch by Håkon Stordahl

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@785575 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/CHANGES b/CHANGES
index 5b588e46d2bc3c22a3e06d2ebb33fbd24f65577a..798096439bf4f393b4da79b09d8d9e4e8bf566aa 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -6,6 +6,9 @@ Changes with Apache 2.3.3
      mod_proxy_ajp: Avoid delivering content from a previous request which
      failed to send a request body. PR 46949 [Ruediger Pluem]
 
+  *) mod_alias: ensure Redirect issues a valid URL.
+     PR 44020 [Håkon Stordahl <hakon stordahl.org>]
+
   *) mod_dir: add DefaultHandler directive, to enable admin to specify
      an action to happen when a URL maps to no file, without resorting
      to ErrorDocument or mod_rewrite.  PR 47184 [Nick Kew]

diff --git a/modules/mappers/mod_alias.c b/modules/mappers/mod_alias.c
index 495c74520bbebc7bd425318cbc2a5ca9c29d7acd..fdefaf54d7bfc2ea41467d511a44c819d0b80873 100644 (file)
--- a/modules/mappers/mod_alias.c
+++ b/modules/mappers/mod_alias.c
@@ -425,11 +425,31 @@ static int translate_alias_redir(request_rec *r)
 
     if ((ret = try_alias_list(r, serverconf->redirects, 1, &status)) != NULL) {
         if (ap_is_HTTP_REDIRECT(status)) {
-            /* include QUERY_STRING if any */
-            if (r->args) {
-                ret = apr_pstrcat(r->pool, ret, "?", r->args, NULL);
+            if (ret[0] == '/') {
+                char *orig_target = ret;
+
+                ret = ap_construct_url(r->pool, ret, r);
+                ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
+                              "incomplete redirection target of '%s' for "
+                              "URI '%s' modified to '%s'",
+                              orig_target, r->uri, ret);
+            }
+            if (!ap_is_url(ret)) {
+                status = HTTP_INTERNAL_SERVER_ERROR;
+                ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
+                              "cannot redirect '%s' to '%s'; "
+                              "target is not a valid absoluteURI or abs_path",
+                              r->uri, ret);
+            }
+            else {
+                /* append requested query only, if the config didn't
+                 * supply its own.
+                 */
+                if (r->args && !ap_strchr(ret, '?')) {
+                    ret = apr_pstrcat(r->pool, ret, "?", r->args, NULL);
+                }
+                apr_table_setn(r->headers_out, "Location", ret);
             }
-            apr_table_setn(r->headers_out, "Location", ret);
         }
         return status;
     }