170 Commits

Author SHA1 Message Date
48cf630810 * Use apr_size_t instead of int to harden against overflows.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1903680 13f79535-47bb-0310-9956-ffa450edef68
2022-08-25 15:57:59 +00:00
c17967b447 server/util_script.c: reserve one APLOGNO number after r1879253
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1879348 13f79535-47bb-0310-9956-ffa450edef68
2020-06-29 19:29:47 +00:00
1f6d74d465 server/util_script.c: tune logging Last-Modified header
Follow up after Joe's feedback in STATUS:
  - If APR_DATE_BAD is returned for Last-Modified, log it at INFO level
    (as opposed to trace).
  - Remove unnecessary guard for APLOGrtrace1(r).



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1879253 13f79535-47bb-0310-9956-ffa450edef68
2020-06-27 09:11:32 +00:00
85760859ca Fix spelling errors found by codespell. [skip ci]
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1873985 13f79535-47bb-0310-9956-ffa450edef68
2020-02-13 18:15:57 +00:00
6bf1ff2618 ap_add_common_vars(): use apr_pstrmemdup().
This avoids a transient replacement/restore of '?' by '\0' in r->filename.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1818924 13f79535-47bb-0310-9956-ffa450edef68
2017-12-21 13:44:07 +00:00
4d4d063b67 * server/util_script.c (ap_add_common_vars): Allow mod_env to override
all system path environment variables, not just PATH.  (The
  behaviour for PATH alone was changed in r965679 for PR 43906.)


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1811831 13f79535-47bb-0310-9956-ffa450edef68
2017-10-11 14:48:55 +00:00
df532849b0 After a long discussion in dev@ I reviewed my previous commit to only warn
the admins about Last-Modified header violations rather than trying
to interpret datestrings (like the ones not in GMT).

I also added explicit comments to summarize the current assumptions,
so it will be easier for somebody in the future to modify the code.

The following use cases are covered:
1) (F)CGI backend sends a Last-Modified header not in GMT and considered in the future by httpd (like now() in the EU/Paris timezone)
2) (F)CGI backend sends a Last-Modified header not in GMT and not considered in the future by httpd (like now() + 2 hours in the PST timezone)
3) (F)CGI backend sends a Last-Modified header in GMT but with a datetime in the future

Suggestions and opinion are really welcome.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1757818 13f79535-47bb-0310-9956-ffa450edef68
2016-08-26 11:00:44 +00:00
dda4678919 Optimization to httpoxy workaround, for 2.4.23+ only.
Submitted by: ylavic


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1753229 13f79535-47bb-0310-9956-ffa450edef68
2016-07-18 14:09:38 +00:00
235ee2ff40 httpoxy workarounds, first draft patch as published for all 2.2.x+ sources
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1753228 13f79535-47bb-0310-9956-ffa450edef68
2016-07-18 14:07:00 +00:00
edf1a4d4ba Improve the FCGI/CGI Last-Modified header value handling.
Patch from Yann after a discussion on the dev@ mailing list. 
ap_scan_script_header_err_core_ex is now using apr_date_parse_rfc 
in order to recognize non-GMT datestr following RFC822/1123
and transforming them to GMT rather than replacing the value
with GMT now (that could add httpd's processing time to the
original value). Logging has also been improved from my initial
solution.
 


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1751138 13f79535-47bb-0310-9956-ffa450edef68
2016-07-03 09:48:06 +00:00
0f18d85a32 Fixed typo in log message, wrong RFC mentioned.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1750953 13f79535-47bb-0310-9956-ffa450edef68
2016-07-01 15:00:42 +00:00
cc532cf385 Fix indentation and extra spaces of my previous commit, apologies.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1750749 13f79535-47bb-0310-9956-ffa450edef68
2016-06-30 07:09:46 +00:00
74900ee0c4 Log CGI/FCGI Last-Modified header value changes.
The Last-Modified header coming from a backend FCGI/CGI script is inspected
by util_script.c to enforce RFC2616 (https://tools.ietf.org/html/rfc2616#section-14.29).
The Last-Modified header also needs to be compliant with RFC882/1123 as stated in
https://tools.ietf.org/html/rfc2616#section-3.3.1, and one important assumption that
httpd makes (correctly, as the RFC suggests) is to assume the GMT timezone. If the datestr
returned by the FCGI/CGI script is set with a different timezone, then the value might be considered
"in the future" and replaced with GMT now() as calculated by httpd. Adding a trace log might
help sysadmins while debugging these kind of issues. This is a follow up of r1748379. 
  


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1750747 13f79535-47bb-0310-9956-ffa450edef68
2016-06-30 07:00:31 +00:00
f2c1f268b0 Drop an invalid Last-Modified header value returned by a FCGI/CGI
script instead tranforming it to Unix Epoch.

This bug was mentioned in the users@ mailing list and outlined in
the following centos bug: https://bugs.centos.org/view.php?id=10940
To reproduce the issue it is sufficient to connect mod-fastcgi
to a PHP script that returns a HTTP response with
the header "Last-Modified: foo". The header will be modified by
script_util.c to "Last-Modified: Thu, 01 Jan 1970 00:00:00 GMT".
Dropping an invalid header in this case seems to be the most
consistent and correct option in my opinion, plus it shouldn't
break existing configurations. Returning Unix Epoch might be
dangerous and should be avoided, but please let me know your opinions.
Moreover this is my first commit outside the documentation court,
I hope to have got the procedure right.
This fix has been tested also with the 2.4.x branch.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1748379 13f79535-47bb-0310-9956-ffa450edef68
2016-06-14 10:35:23 +00:00
f4cc76ee71 Rename ap_casecmpstr[n]() to ap_cstr_casecmp[n](), update with APR doxygen
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1747469 13f79535-47bb-0310-9956-ffa450edef68
2016-06-09 00:06:42 +00:00
9b6702a85c Add CGIVar directive for configuring REQUEST_URI behavior
The goal is to use this one directive to handle any configurable
CGI variable behavior; only one CGI variable is supported initially.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1734947 13f79535-47bb-0310-9956-ffa450edef68
2016-03-14 15:42:45 +00:00
690c6105f9 hostname: Test and log useragent_host per-request across various modules,
including the scoreboard, expression and rewrite engines, setenvif,
authz_host, access_compat, custom logging, ssl and REMOTE_HOST variables.
PR55348  [William Rowe]

This is the complete change set which applies cleanly to 2.4.x as well,
the server/scoreboard.c will follow, which does not apply due to drift.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1729930 13f79535-47bb-0310-9956-ffa450edef68
2016-02-12 01:17:03 +00:00
af14d158a3 Added many log numbers to log statements that
had none.

Those were not detected by the coccinelle script.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1725485 13f79535-47bb-0310-9956-ffa450edef68
2016-01-19 12:02:41 +00:00
c80e6b2a34 Use new ap_casecmpstr[n]() functions where appropriate (not exhaustive).
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1715876 13f79535-47bb-0310-9956-ffa450edef68
2015-11-23 16:46:01 +00:00
3c9ddf44bf Revert r1715789: will re-commit without spurious functional changes.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1715869 13f79535-47bb-0310-9956-ffa450edef68
2015-11-23 16:28:36 +00:00
29843dc73f Use new ap_casecmpstr[n]() functions where appropriate (not exhaustive).
[Reverted by r1715869]


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1715789 13f79535-47bb-0310-9956-ffa450edef68
2015-11-23 12:33:09 +00:00
d5fff1ccd5 followup to r1710380 -- refactored name and didn't have 'make depend'
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1710391 13f79535-47bb-0310-9956-ffa450edef68
2015-10-24 21:34:52 +00:00
28d2d12241 Make the fix for fully qualifying REDIRECT_URL from PR#57785 opt-in.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1710380 13f79535-47bb-0310-9956-ffa450edef68
2015-10-24 19:13:16 +00:00
1b0c4542b0 core/util_script: relax alphanumeric filter of enviroment variable names
on Windows to allow '(' and ')' for passing PROGRAMFILES(X86) et.al.
unadulterated in 64 bit versions of Windows. PR 46751.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1705217 13f79535-47bb-0310-9956-ffa450edef68
2015-09-25 06:29:05 +00:00
5a649184dc Make REDIRECT_URL a complete URL (where set).
PR 57785


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1677702 13f79535-47bb-0310-9956-ffa450edef68
2015-05-04 22:05:14 +00:00
d49e6f0ad9 core: Add CGIPassAuth directive to control whether HTTP authorization
headers are passed to scripts as CGI variables.

PR: 56855


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1642847 13f79535-47bb-0310-9956-ffa450edef68
2014-12-02 12:20:21 +00:00
fb0ad3fd89 Turn some APR_BUCKET_REMOVE(e)+apr_bucket_destroy(e) into the equivalent apr_bucket_delete(e) to reduce code verbosity
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1615026 13f79535-47bb-0310-9956-ffa450edef68
2014-08-01 04:23:50 +00:00
56d0c25725 Add missing APLOGNO.
Refactor some lines to keep APLOGNO on the same line as ap_log_error, when applicable.
Split lines longer than 80.
Improve alignment.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1612068 13f79535-47bb-0310-9956-ffa450edef68
2014-07-20 09:32:58 +00:00
bb69ec6cfe Remove useless tests.
Turn
   if (*x && apr_isspace(*x))
into
   if (apr_isspace(*x))

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1452128 13f79535-47bb-0310-9956-ffa450edef68
2013-03-03 21:25:46 +00:00
85ed636d1d Avoid some memory allocation on error path in 'http2env' if TRACE1 logging is not activated.
Avoid a function call to 'apr_filepath_name_get' which ends up to a strrchr call, if TRACE1 logging is not activated. 


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1451478 13f79535-47bb-0310-9956-ffa450edef68
2013-03-01 06:33:40 +00:00
c7721a9e32 remove an unnecessary check in a nest loop of ap_create_environment()
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1378178 13f79535-47bb-0310-9956-ffa450edef68
2012-08-28 15:35:18 +00:00
56b1a71fe3 Apply the same length limit when logging Status header values
as used when logging invalid header lines.

Application of a limit on logged header data suggested by Jeff Trawick.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1376695 13f79535-47bb-0310-9956-ffa450edef68
2012-08-23 20:57:32 +00:00
36ab7eb1eb Log the value of Status header lines in script responses rather than
than just the fixed header name of "Status".


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1362538 13f79535-47bb-0310-9956-ffa450edef68
2012-07-17 15:26:27 +00:00
165e11ee96 Fix error handling in ap_scan_script_header_err_brigade() if there
is no EOS bucket in the brigade:

Also don't loop if there is a timeout when discarding the script output.

Thanks to Edgar Frank for the analysis.

PR: 48272 (partial fix)


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1311174 13f79535-47bb-0310-9956-ffa450edef68
2012-04-09 09:35:35 +00:00
e9ac8ddb83 Make sure the getsfunc_*() functions used by ap_scan_script_header_err*()
NUL-terminate the resulting string, even in case of an error. mod_cgi
and mod_cgid try to log incomplete output from CGI scripts.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1244211 13f79535-47bb-0310-9956-ffa450edef68
2012-02-14 21:18:22 +00:00
732f60dc2c Handle cases, esp when using mod_proxy_fcgi, when we do not
want SCRIPT_FILENAME to include the query string.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1242351 13f79535-47bb-0310-9956-ffa450edef68
2012-02-09 15:07:22 +00:00
cb21a0dbcc Further clarify the naming of the entity that directly connects to us by
calling that entity a client instead of a peer.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1214015 13f79535-47bb-0310-9956-ffa450edef68
2011-12-14 01:10:52 +00:00
ad489c105b Further clarify the naming of the entity that originates the request by
calling that entity a useragent instead of a client.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1214005 13f79535-47bb-0310-9956-ffa450edef68
2011-12-14 00:33:46 +00:00
394e5594d6 Introduce a per connection "peer_ip" and a per request "client_ip" to
distinguish between the raw IP address of the connection and the effective
IP address of the request.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1206291 13f79535-47bb-0310-9956-ffa450edef68
2011-11-25 19:42:04 +00:00
427c85bd23 Cleanup effort in prep for GA push:
Trim trailing whitespace... no func change



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1174751 13f79535-47bb-0310-9956-ffa450edef68
2011-09-23 13:39:32 +00:00
481fac5ce2 Make the SERVER_NAME variable include [ ] for literal IPv6 addresses, as
mandated by RFC 3875

PR: 26005


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1147614 13f79535-47bb-0310-9956-ffa450edef68
2011-07-17 13:56:28 +00:00
beb3ea9c11 Add more (trace) logging to the ap_scan_script_header*() functions
Add ap_scan_script_header*_ex() functions that take a module index for
logging.
Make mod_cgi, mod_cgid, mod_proxy_fcgi, mod_proxy_scgi, mod_isapi use the
new functions.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1147493 13f79535-47bb-0310-9956-ffa450edef68
2011-07-16 21:53:18 +00:00
255b79ce73 improve readability of 'malformed header from script' message and simplify code
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1147487 13f79535-47bb-0310-9956-ffa450edef68
2011-07-16 20:36:11 +00:00
c9fd2623da Introduce ap_(get|set)_core_module_config() functions/macros and use them
everywhere.

We know that the core module has module_index 0. Therefore we can save
some pointer operations in ap_get_module_config(cv, &core_module) and
ap_set_module_config(cv, &core_module, val). As these are called rather often,
this may actually have some (small) measurable effect.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1132781 13f79535-47bb-0310-9956-ffa450edef68
2011-06-06 21:26:56 +00:00
feca55db60 - Introduce concept of context prefix (which is an URL prefix)
and context document root (which is the file system directory that
  this URL prefix is mapped to). This generalization of the document
  root makes it easier for scripts to create self-referential URLs and
  to find their files.
- Expose CONTEXT_DOCUMENT_ROOT and CONTEXT_PREFIX as envvars, in mod_rewrite,
  and in ap_expr.
- Make mod_alias and mod_userdir set the context information.
- Allow to override the document root on a per-request basis. This allows
  mass vhosting modules to set DOCUMENT_ROOT correctly.
- Make mod_vhost_alias set the per-request document root

PR: 26052, 46198, 49705

Remaining tasks:
- Use the context document root & prefix in mod_rewrite to make RewriteBase
  unneccessary in many cases. Do this without breaking compatibility.
- Write docs.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1132494 13f79535-47bb-0310-9956-ffa450edef68
2011-06-05 21:33:12 +00:00
6c6979ede6 Make the REQUEST_SCHEME variable available to scripts and mod_rewrite
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1053872 13f79535-47bb-0310-9956-ffa450edef68
2010-12-30 12:34:19 +00:00
8ef0eb9c77 Log a trace message if we drop a header with an invalid name
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1053365 13f79535-47bb-0310-9956-ffa450edef68
2010-12-28 14:53:59 +00:00
2ae41fa476 Move duplicated code into utility functions
Submitted by: Malte S. Stretz <mss@apache.org>, Stefan Fritsch


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1053363 13f79535-47bb-0310-9956-ffa450edef68
2010-12-28 14:48:51 +00:00
afea2a1dc4 When exporting request headers to HTTP_* environment variables, drop variables
whose names contain invalid characters. Describe in the docs how to restore the
old behaviour.

Submitted by: Malte S. Stretz <mss apache org>


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1053353 13f79535-47bb-0310-9956-ffa450edef68
2010-12-28 14:20:52 +00:00
6c3b1e2ec5 Because PATH and the library path are closely interrelated, and the cause
of most confusion over cgi or fcgid failures, or even starting rotatelogs,
etc, when the server binaries have been relocated, pass the library path
as paired with the system PATH.

Of course, PATH and platform-specific library path(s) may be modified as
needed with mod_env, so there is no loss of functionality with this change.

The days of monolithic binaries are long gone, even on 1970's architectures,
and PATH should not be decoupled from the library path.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1000593 13f79535-47bb-0310-9956-ffa450edef68
2010-09-23 19:50:14 +00:00