-*- coding: utf-8 -*-
Changes with Apache 2.5.0
+ *) mod_dav: Allow other modules to become providers and add ACLs
+ to the DAV response.
+ [Jari Urpalainen <jari.urpalainen nokia.com>, Graham Leggett]
+
*) mod_dav: Add dav_begin_multistatus, dav_send_one_response,
dav_finish_multistatus, dav_send_multistatus, dav_handle_err,
dav_failed_proppatch, dav_success_proppatch to mod_dav.h.
* dav_finish_multistatus, dav_send_multistatus,
* dav_handle_err, dav_failed_proppatch,
* dav_success_proppatch.
+ * 20160608.4 (2.5.0-dev) Add dav_acl_provider, dav_acl_provider_register
+ * dav_get_acl_providers.
*/
#define MODULE_MAGIC_COOKIE 0x41503235UL /* "AP25" */
#ifndef MODULE_MAGIC_NUMBER_MAJOR
#define MODULE_MAGIC_NUMBER_MAJOR 20160608
#endif
-#define MODULE_MAGIC_NUMBER_MINOR 3 /* 0...n */
+#define MODULE_MAGIC_NUMBER_MINOR 4 /* 0...n */
/**
* Determine if the server's current MODULE_MAGIC_NUMBER is at least a
* add it now */
dav_add_vary_header(r, r, *res_p);
+#ifdef APR_XML_X2T_PARSED
+ /* if acls checking -> check if allowed method excluding propfind */
+ if (((*res_p)->acls = dav_get_acl_providers()) &&
+ (err = (*res_p)->acls->acl_check_method(r, *res_p))) {
+ return err;
+ }
+#endif
+
return NULL;
}
int has_range;
apr_off_t range_start;
apr_off_t range_end;
+ int rc;
/* Ask repository module to resolve the resource */
err = dav_get_resource(r, 0 /* label_allowed */, 0 /* use_checked_in */,
/* NOTE: WebDAV spec, S8.7.1 states properties should be unaffected */
/* return an appropriate response (HTTP_CREATED or HTTP_NO_CONTENT) */
- return dav_created(r, NULL, "Resource", resource_state == DAV_RESOURCE_EXISTS);
+ rc = dav_created(r, NULL, "Resource", resource_state == DAV_RESOURCE_EXISTS);
+
+#ifdef APR_XML_X2T_PARSED
+ if (resource->acls) {
+ resource->acls->acl_post_processing(r, resource,
+ r->status == HTTP_CREATED);
+ }
+#endif
+
+ return rc;
}
dav_log_err(r, err, APLOG_WARNING);
}
+#ifdef APR_XML_X2T_PARSED
+ if (resource->acls) {
+ resource->acls->acl_post_processing(r, resource, FALSE);
+ }
+#endif
+
/* ### HTTP_NO_CONTENT if no body, HTTP_OK if there is a body (some day) */
/* Apache will supply a default error for this. */
dav_error *err;
dav_propdb *propdb;
dav_get_props_result propstats = { 0 };
+#ifdef APR_XML_X2T_PARSED
+ dav_resource *resource = (dav_resource *)wres->resource;
+
+ /* propfind skipped if no read privilege to a resource
+ ** setting acls from parent resource
+ */
+ resource->acls = ctx->w.root->acls;
+ if (resource->acls &&
+ (err = resource->acls->acl_check_read(ctx->r, resource))) {
+ return NULL;
+ }
+#endif
/*
** Note: ctx->doc can only be NULL for DAV_PROPFIND_IS_ALLPROP. Since
dav_send_multistatus(r, HTTP_MULTI_STATUS, &resp, doc->namespaces);
+#ifdef APR_XML_X2T_PARSED
+ if (resource->acls) {
+ resource->acls->acl_post_processing(r, resource, FALSE);
+ }
+#endif
+
/* the response has been sent. */
return DONE;
}
dav_error *err;
dav_error *err2;
int result;
+ int rc;
dav_response *multi_status;
/* handle the request body */
}
/* return an appropriate response (HTTP_CREATED) */
- return dav_created(r, NULL, "Collection", 0);
+ rc = dav_created(r, NULL, "Collection", 0);
+
+#ifdef APR_XML_X2T_PARSED
+ if (resource->acls) {
+ resource->acls->acl_post_processing(r, resource, r->status == 201);
+ }
+#endif
+
+ return rc;
}
/* handle the COPY and MOVE methods */
dav_lockdb *lockdb;
int replace_dest;
int resnew_state;
+ int rc;
/* Ask repository module to resolve the resource */
err = dav_get_resource(r, !is_move /* label_allowed */,
}
/* return an appropriate response (HTTP_CREATED or HTTP_NO_CONTENT) */
- return dav_created(r, lookup.rnew->unparsed_uri, "Destination",
- resnew_state == DAV_RESOURCE_EXISTS);
+ rc = dav_created(r, lookup.rnew->uri, "Destination",
+ resnew_state == DAV_RESOURCE_EXISTS);
+
+#ifdef APR_XML_X2T_PARSED
+ if (resource->acls) {
+ resource->acls->acl_post_processing(r, resource, FALSE);
+
+ resource->acls->acl_post_processing(r, resnew,
+ r->status == HTTP_CREATED);
+ }
+#endif
+
+ return rc;
}
/* dav_method_lock: Handler to implement the DAV LOCK method
*/
typedef struct dav_resource_private dav_resource_private;
+#ifdef APR_XML_X2T_PARSED
+typedef struct dav_acl_provider dav_acl_provider;
+#endif
+
/*
** Resource descriptor, generated by a repository provider.
**
long as the dav_resource structure. */
apr_pool_t *pool;
+#ifdef APR_XML_X2T_PARSED
+ const dav_acl_provider *acls; /* acls used for this resource */
+#endif
+
+ void *ctx; /* additional parameter */
+
} dav_resource;
/*
const dav_hooks_liveprop *provider; /* the provider defining this prop */
} dav_elem_private;
+
+/* --------------------------------------------------------------------
+**
+** DAV ACL HOOKS
+*/
+#ifdef APR_XML_X2T_PARSED
+
+typedef struct dav_acl_provider
+{
+ dav_error * (*acl_check_method)(request_rec *r,
+ const dav_resource *resource);
+
+ dav_error * (*acl_check_read)(request_rec *r,
+ const dav_resource *resource);
+
+ dav_error * (*acl_check_prop)(request_rec *r,
+ const dav_resource *resource,
+ const dav_prop_name *name,
+ dav_prop_insert what);
+
+ void (*acl_post_processing)(request_rec *r,
+ const dav_resource *resource,
+ int new_resource_created);
+ void *ctx;
+} dav_acl_provider;
+
+DAV_DECLARE(void) dav_acl_provider_register(apr_pool_t *p,
+ const dav_acl_provider *acl);
+
+DAV_DECLARE(const dav_acl_provider *) dav_get_acl_providers();
+
+#endif
+
/* --------------------------------------------------------------------
**
** DAV OPTIONS
int found_contenttype = 0;
int found_contentlang = 0;
dav_prop_insert unused_inserted;
+#ifdef APR_XML_X2T_PARSED
+ apr_text *text;
+#endif
/* if not just getting supported live properties,
* scan all properties in the dead prop database
}
}
+#ifdef APR_XML_X2T_PARSED
+ /* check for possible special acl restrictions not provided by read privilege */
+ if (propdb->resource->acls &&
+ propdb->resource->acls->acl_check_prop &&
+ propdb->resource->acls->
+ acl_check_prop(propdb->r, propdb->resource,
+ &name, what)) {
+ goto next_key;
+ }
+#endif
+
if (what == DAV_PROP_INSERT_VALUE) {
int found;
/* add namespaces for all the liveprop providers */
dav_add_all_liveprop_xmlns(propdb->p, &hdr_ns);
}
+#ifdef APR_XML_X2T_PARSED
+ text = hdr.last;
+#endif
/* ask the liveprop providers to insert their properties */
dav_run_insert_all_liveprops(propdb->r, propdb->resource, what, &hdr);
what, &hdr, &unused_inserted);
}
+#ifdef APR_XML_X2T_PARSED
+ if (propdb->resource->acls &&
+ propdb->resource->acls->acl_check_prop) {
+
+ /* unfortunately liveprops cannot be checked beforehand */
+ apr_xml_doc *doc = NULL;
+ apr_text *t;
+ apr_xml_elem *elem;
+ apr_pool_t *pool;
+ apr_xml_parser *parser;
+
+ apr_pool_create (&pool, propdb->p);
+ parser = apr_xml_parser_create (pool);
+
+ apr_xml_parser_feed(parser, "<r xmlns:D=\"DAV:\" ", 18);
+ for (t = hdr_ns.first; t; t = t->next) {
+ if (t->text)
+ apr_xml_parser_feed(parser, t->text, strlen(t->text));
+ }
+ apr_xml_parser_feed(parser, ">", 1);
+
+ hdr.last = text ? text : hdr.first;
+
+ for (text = text ? text->next : hdr.first; text; text = text->next) {
+ if (text->text)
+ apr_xml_parser_feed(parser, text->text, strlen(text->text));
+ }
+ apr_xml_parser_feed(parser, "</r>", 4);
+
+ apr_xml_parser_done(parser, &doc);
+
+ for (elem = doc ? doc->root->first_child : NULL; elem;
+ elem = elem->next) {
+ dav_prop_name name[1];
+
+ name->ns = elem->ns == APR_XML_NS_NONE ? "" :
+ APR_XML_GET_URI_ITEM(doc->namespaces, elem->ns);
+ name->name = elem->name;
+
+ if (propdb->resource->acls->
+ acl_check_prop(propdb->r, propdb->resource,
+ name, what) == NULL) {
+ const char *buf;
+
+ /* APR_XML_X2T_FULL_NS_LANG mangles original namespace prefixes */
+ apr_xml_to_text(pool, elem, APR_XML_X2T_PARSED,
+ NULL, NULL, &buf, NULL);
+
+ buf = apr_pstrcat (pool, buf, DEBUG_CR, NULL);
+ apr_text_append(propdb->p, &hdr, buf);
+ }
+ }
+ apr_pool_destroy(pool);
+ }
+#endif
+
/* if not just reporting on supported live props,
* terminate the result */
if (what != DAV_PROP_INSERT_SUPPORTED) {
apr_xml_elem *elem = dav_find_child(doc->root, "prop");
apr_text_header hdr_good = { 0 };
apr_text_header hdr_bad = { 0 };
+#ifdef APR_XML_X2T_PARSED
+ apr_text_header hdr_not_auth = { 0 };
+#endif
apr_text_header hdr_ns = { 0 };
int have_good = 0;
dav_get_props_result result = { 0 };
priv = elem->priv;
/* cache the propid; dav_get_props() could be called many times */
- if (priv->propid == 0)
+ if (priv->propid == 0) {
dav_find_liveprop(propdb, elem);
+ }
if (priv->propid != DAV_PROPID_CORE_UNKNOWN) {
+#ifdef APR_XML_X2T_PARSED
+ /* check for possible special acl restrictions not provided by read privilege
+ * ask for each live prop separately (e.g. read-acl privilege) */
+ if (propdb->resource->acls &&
+ propdb->resource->acls->acl_check_prop) {
+ name.ns = elem->ns == APR_XML_NS_NONE ? "" :
+ APR_XML_GET_URI_ITEM(propdb->ns_xlate, elem->ns);
+ name.name = elem->name;
+
+ if (propdb->resource->acls->
+ acl_check_prop(propdb->r, propdb->resource,
+ &name, DAV_PROP_INSERT_VALUE)) {
+
+ if (hdr_not_auth.first == NULL) {
+ apr_text_append(propdb->p, &hdr_not_auth,
+ "<D:propstat>" DEBUG_CR
+ "<D:prop>" DEBUG_CR);
+ }
+
+ if (!name.ns) {
+ name.ns = "";
+ }
+ dav_output_prop_name(propdb->p, &name, xi, &hdr_not_auth);
+ continue;
+ }
+ }
+#endif
+
/* insert the property. returns 1 if an insertion was done. */
if ((err = dav_insert_liveprop(propdb, elem, DAV_PROP_INSERT_VALUE,
&hdr_good, &inserted)) != NULL) {
}
}
+#ifdef APR_XML_X2T_PARSED
+ if (hdr_not_auth.first != NULL) {
+ apr_text_append(propdb->p, &hdr_not_auth,
+ "</D:prop>" DEBUG_CR
+ "<D:status>HTTP/1.1 403 Forbidden</D:status>" DEBUG_CR
+ "</D:propstat>" DEBUG_CR);
+
+ if (!have_good && !hdr_bad.first) {
+ result.propstats = hdr_not_auth.first;
+ }
+ else if (hdr_bad.first != NULL) {
+ hdr_bad.last->next = hdr_not_auth.first;
+ }
+ else {
+ hdr_good.last->next = hdr_not_auth.first;
+ }
+ }
+#endif
+
/* add in all the various namespaces, and return them */
dav_xmlns_generate(xi, &hdr_ns);
result.xmlns = hdr_ns.first;
return ap_lookup_provider(DAV_PROVIDER_GROUP, name, "0");
}
+#ifdef APR_XML_X2T_PARSED
+DAV_DECLARE(void) dav_acl_provider_register(apr_pool_t *p,
+ const dav_acl_provider *provider)
+{
+ ap_register_provider(p, DAV_PROVIDER_GROUP, "acl", "0", provider);
+}
+
+DAV_DECLARE(const dav_acl_provider *) dav_get_acl_providers()
+{
+ return ap_lookup_provider(DAV_PROVIDER_GROUP, "acl", "0");
+}
+#endif
+
DAV_DECLARE(void) dav_options_provider_register(apr_pool_t *p,
const char *name,
const dav_options_provider *provider)
projects / apache / commitdiff