REALLY discourage people from using <Limit>.

(Because people don't necessarily know all the methods that their
server deals with, and because crummy cgi scripts may take
"post" and treat it like "POST" or other similar bad
behavior.)

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@100839 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/docs/manual/mod/core.html.en b/docs/manual/mod/core.html.en
index 2a1b0d1f992866eaa43341d6564c28e23c3f76d5..49f14f22b180a10adf44e7dc5052b71cc093ccdf 100644 (file)
--- a/docs/manual/mod/core.html.en
+++ b/docs/manual/mod/core.html.en
@@ -1504,6 +1504,12 @@ methods</td></tr>
     restrict <code>HEAD</code> requests. The <code>TRACE</code> method
     cannot be limited.</p>
 
+    <div class="warning">A <code class="directive"><a href="#limitexcept">&lt;LimitExcept&gt;</a></code> section should always be
+    used in preference to a <code class="directive"><a href="#limit">&lt;Limit&gt;</a></code> section when restricting access,
+    since a <code class="directive"><a href="#limitexcept">&lt;LimitExcept&gt;</a></code> section provides protection
+    against arbitrary methods.</div>
+
+
 </div>
 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 <div class="directive-section"><h2><a name="LimitExcept" id="LimitExcept">&lt;LimitExcept&gt;</a> <a name="limitexcept" id="limitexcept">Directive</a></h2>

diff --git a/docs/manual/mod/core.xml b/docs/manual/mod/core.xml
index 8b4854f06c78a1fe38032fb97c9426ed2d059201..5c60d77ea289c8b0cf3f9e6e4bfa5dfb91126e34 100644 (file)
--- a/docs/manual/mod/core.xml
+++ b/docs/manual/mod/core.xml
@@ -1453,6 +1453,15 @@ methods</description>
     case-sensitive.</strong> If <code>GET</code> is used it will also
     restrict <code>HEAD</code> requests. The <code>TRACE</code> method
     cannot be limited.</p>
+
+    <note type="warning">A <directive type="section"
+    module="core">LimitExcept</directive> section should always be
+    used in preference to a <directive type="section"
+    module="core">Limit</directive> section when restricting access,
+    since a <directive type="section"
+    module="core">LimitExcept</directive> section provides protection
+    against arbitrary methods.</note>
+
 </usage>
 </directivesynopsis>