From ed408d28e55c85d267c037d7176871da5115d791 Mon Sep 17 00:00:00 2001 From: Luca Toscano Date: Mon, 11 Apr 2016 08:11:34 +0000 Subject: [PATCH] Documentation rebuild git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1738543 13f79535-47bb-0310-9956-ffa450edef68 --- docs/manual/howto/auth.html.en | 12 +++++ docs/manual/mod/mod_access_compat.html.en | 12 +++-- docs/manual/upgrading.html.en | 56 +++++++++++++++++++++++ 3 files changed, 77 insertions(+), 3 deletions(-) diff --git a/docs/manual/howto/auth.html.en b/docs/manual/howto/auth.html.en index 2bbb0f8c9e..cbdfe35ac9 100644 --- a/docs/manual/howto/auth.html.en +++ b/docs/manual/howto/auth.html.en @@ -563,6 +563,18 @@ Require group GroupName Satisfy are no longer needed. However to provide backwards compatibility for older configurations, these directives have been moved to the mod_access_compat module.

+ +

Note

+

The directives provided by mod_access_compat have + been deprecated by mod_authz_host. + Mixing old directives like Order, Allow or Deny with new ones like + Require is technically possible + but discouraged. The mod_access_compat module was created to support + configurations containing only old directives to facilitate the 2.4 upgrade. + Please check the upgrading guide for more + information. +

+
top
diff --git a/docs/manual/mod/mod_access_compat.html.en b/docs/manual/mod/mod_access_compat.html.en index be8dbd19f9..220c2588c8 100644 --- a/docs/manual/mod/mod_access_compat.html.en +++ b/docs/manual/mod/mod_access_compat.html.en @@ -62,9 +62,15 @@ have been deprecated by the new authz refactoring. Please see

Note

The directives provided by mod_access_compat have - been deprecated by the new authz refactoring. Please see - mod_authz_host.

-
+ been deprecated by mod_authz_host. + Mixing old directives like Order, Allow or Deny with new ones like + Require is technically possible + but discouraged. This module was created to support + configurations containing only old directives to facilitate the 2.4 upgrade. + Please check the upgrading guide for more + information. +

+

In general, access restriction directives apply to all access methods (GET, PUT, diff --git a/docs/manual/upgrading.html.en b/docs/manual/upgrading.html.en index 7604ebf0e2..8c1863c259 100644 --- a/docs/manual/upgrading.html.en +++ b/docs/manual/upgrading.html.en @@ -138,6 +138,15 @@ although for compatibility with old configurations, the new module mod_access_compat is provided.

+

Mixing old and new directives

+

Mixing old directives like Order, Allow or Deny with new ones like + Require is technically possible + but discouraged. mod_access_compat was created to support + configurations containing only old directives to facilitate the 2.4 upgrade. + Please check the examples below to get a better idea about issues that might arise. +

+
+

Here are some examples of old and new ways to do the same access control.

@@ -164,6 +173,53 @@ Allow from example.org

2.4 configuration:

Require host example.org
+ +

In the following example, mixing old and new directives leads to + unexpected results.

+ +

Mixing old and new directives: NOT WORKING AS EXPECTED

DocumentRoot "/var/www/html"
+
+<Directory "/">
+    AllowOverride None
+    Order deny,allow
+    Deny from all
+</Directory>
+
+<Location "/server-status">
+    SetHandler server-status
+    Require 127.0.0.1
+</Location>
+
+access.log - GET /server-status 403 127.0.0.1
+error.log - AH01797: client denied by server configuration: /var/www/html/server-status
+
+

Why httpd denies access to servers-status even if the configuration seems to allow it? + Because mod_access_compat directives take precedence + over the mod_authz_host one in this configuration + merge scenario.

+ +

This example conversely works as expected:

+ +

Mixing old and new directives: WORKING AS EXPECTED

DocumentRoot "/var/www/html"
+
+<Directory "/">
+    AllowOverride None
+    Require all denied
+</Directory>
+
+<Location "/server-status">
+    SetHandler server-status
+    Order deny,allow
+    Deny from all
+    Allow From 127.0.0.1
+</Location>
+
+access.log - GET /server-status 200 127.0.0.1
+
+

So even if mixing configuration is still + possible, please try to avoid it when upgrading: either keep old directives and then migrate + to the new ones on a later stage or just migrate everything in bulk. +

-- 2.50.0