Merge r1807655 from trunk:

core: Disallow Methods' registration at run time (.htaccess), they may be
used only if registered at init time (httpd.conf).

Calling ap_method_register() in children processes is not the right scope
since it won't be shared for all requests.

Reviewed by: ylavic, covener, icing

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1807754 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/CHANGES b/CHANGES
index 1988d2cca3cefe7b02132832ae896cc3a1989c6f..05626f24235b55147ff336f3b85877e07315b555 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,6 +1,9 @@
                                                          -*- coding: utf-8 -*-
 Changes with Apache 2.4.28
 
+  *) core: Disallow Methods' registration at runtime (.htaccess), they may be
+     used only if registered at init time (httpd.conf).  [Yann Ylavic]
+
   *) mod_ssl, ab: Fix compatibility with LibreSSL.  PR 61184.
      [Bernard Spil <brnrd freebsd.org>, Michael Schlenker <msc contact.de>,
       Yann Ylavic]

diff --git a/STATUS b/STATUS
index 8c27a5fcd9bf1ad6838e5c471206d5eb4bdc05fc..cbb7e165a7defbd5e415a19ed046071f896f4fe6 100644 (file)
--- a/STATUS
+++ b/STATUS
@@ -161,13 +161,6 @@ PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
      2.4.x patch svn merge -c 1745039 ^/httpd/httpd/trunk .
      +1: jim, ylavic, icing
 
-  *) core: Disallow Methods' registration at runtime (.htaccess), they may be
-     used only if registered at init time (httpd.conf).
-     trunk patch: http://svn.apache.org/r1807655
-     2.4.x patch: svn merge -c 1807655 ^/httpd/httpd/trunk .
-                  (modulo CHANGES)
-     +1: ylavic, covener, icing
-
 
 PATCHES PROPOSED TO BACKPORT FROM TRUNK:
   [ New proposals should be added at the end of the list ]

diff --git a/server/core.c b/server/core.c
index de2400d92a0e32ce3382c9df0d77222b5f57092c..6516b09a055e01a3918892de54b4cfcada26f527 100644 (file)
--- a/server/core.c
+++ b/server/core.c
@@ -2266,6 +2266,12 @@ AP_CORE_DECLARE_NONSTD(const char *) ap_limit_section(cmd_parms *cmd,
             /* method has not been registered yet, but resource restriction
              * is always checked before method handling, so register it.
              */
+            if (cmd->pool == cmd->temp_pool) {
+                /* In .htaccess, we can't globally register new methods. */
+                return apr_psprintf(cmd->pool, "Could not register method '%s' "
+                                   "for %s from .htaccess configuration",
+                                    method, cmd->cmd->name);
+            }
             methnum = ap_method_register(cmd->pool,
                                          apr_pstrdup(cmd->pool, method));
         }