possible XSS for a site where untrusted users can upload files to
a location with MultiViews enabled. [Niels Heinen <heinenn google.com>]
+ *) mod_authz_core: Fix parsing of Require arguments in <AuthzProviderAlias>.
+ PR 53048. [Stefan Fritsch]
+
*) mod_log_config: Fix %{abc}C truncating cookie values at first "=".
PR 53104. [Greg Ames]
PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
[ start all new proposals below, under PATCHES PROPOSED. ]
- * mod_authz_core: Fix parsing of Require arguments in <AuthzProviderAlias>.
- Add some logging and an assert for a case that should not happen.
- PR: 53048
- Trunk patch: http://svn.apache.org/viewvc?view=revision&revision=1311183
- 2.4 patch: Trunk patch works
- +1: sf, covener, jim
PATCHES PROPOSED TO BACKPORT FROM TRUNK:
r->per_dir_config = orig_dir_config;
}
+ else {
+ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02305)
+ "no alias provider found for '%s' (BUG?)",
+ provider_name);
+ }
+ }
+ else {
+ ap_assert(provider_name != NULL);
}
return ret;
"Unknown Authz provider: %s",
provider_name);
}
+ if (prvdraliasrec->provider->parse_require_line) {
+ const char *err = prvdraliasrec->provider->parse_require_line(cmd,
+ provider_args, &prvdraliasrec->provider_parsed_args);
+ if (err)
+ return apr_psprintf(cmd->pool,
+ "Can't parse 'Require %s %s': %s",
+ provider_name, provider_args, err);
+ }
authcfg = ap_get_module_config(cmd->server->module_config,
&authz_core_module);