History log of /httpd/modules/aaa/mod_authz_dbd.c
Revision Date Author Comments Expand
f6098228fada9d4d6dcdc0cd321f4f5904040d1e 1558483 15-Jan-2014 trawick

follow-up to r1554161, r1554168, r1554170, r1554175, r1554188, and r1554195: axe unnecessary initialization/pool allocation

c391425e78669ebefa01c928dea44d4dd4ffe1bf 1554176 30-Dec-2013 minfrin

Pass the correct pointer that made it past the test suite.

0cf25f370efc889c01f7028bdfc8204b17aa4ce4 1554168 30-Dec-2013 minfrin

mod_authnz_dbd: Support the expression parser within the require directives.

02f90098143fb719f54c9ab6d3964582a36a6967 1407853 10-Nov-2012 jailletc36

cppCheck: Suspicious condition. AFAIK, there is no actual problem with the existing code. 'rv' would only not have the 'expected' value, but the execution path would remain the same. However, the patched code is more logical. We put the returned value in 'rv', then test it against 0.

14e0c468a75ddee46ced5c55ea2287642d907ca2 1364229 22-Jul-2012 sf

Correctly log the error returned by apr_dbd_pvselect()

185aa71728867671e105178b4c66fbc22b65ae26 1209766 03-Dec-2011 sf

Add lots of unique tags to error log messages

/httpd/docs/log-message-tags/next-number mod_access_compat.c mod_allowmethods.c mod_auth_basic.c mod_auth_digest.c mod_auth_form.c mod_authn_anon.c mod_authn_core.c mod_authn_dbd.c mod_authn_dbm.c mod_authn_file.c mod_authn_socache.c mod_authnz_ldap.c mod_authz_core.c mod_authz_dbd.c mod_authz_dbm.c mod_authz_groupfile.c mod_authz_host.c mod_authz_owner.c mod_authz_user.c /httpd/modules/apreq/filter.c /httpd/modules/arch/netware/mod_netware.c /httpd/modules/arch/netware/mod_nw_ssl.c /httpd/modules/arch/unix/mod_privileges.c /httpd/modules/arch/unix/mod_unixd.c /httpd/modules/arch/win32/mod_isapi.c /httpd/modules/arch/win32/mod_win32.c /httpd/modules/cache/cache_storage.c /httpd/modules/cache/cache_util.c /httpd/modules/cache/mod_cache.c /httpd/modules/cache/mod_cache_disk.c /httpd/modules/cache/mod_file_cache.c /httpd/modules/cache/mod_socache_dbm.c /httpd/modules/cache/mod_socache_dc.c /httpd/modules/cache/mod_socache_memcache.c /httpd/modules/cache/mod_socache_shmcb.c /httpd/modules/cluster/mod_heartbeat.c /httpd/modules/cluster/mod_heartmonitor.c /httpd/modules/core/mod_so.c /httpd/modules/core/mod_watchdog.c /httpd/modules/database/mod_dbd.c /httpd/modules/dav/fs/dbm.c /httpd/modules/dav/main/mod_dav.c /httpd/modules/dav/main/util_lock.c /httpd/modules/echo/mod_echo.c /httpd/modules/examples/mod_example_hooks.c /httpd/modules/examples/mod_example_ipc.c /httpd/modules/experimental/mod_noloris.c /httpd/modules/filters/mod_charset_lite.c /httpd/modules/filters/mod_deflate.c /httpd/modules/filters/mod_ext_filter.c /httpd/modules/filters/mod_filter.c /httpd/modules/filters/mod_include.c /httpd/modules/filters/mod_proxy_html.c /httpd/modules/filters/mod_ratelimit.c /httpd/modules/filters/mod_reflector.c /httpd/modules/filters/mod_reqtimeout.c /httpd/modules/filters/mod_request.c /httpd/modules/filters/mod_sed.c /httpd/modules/filters/mod_substitute.c /httpd/modules/filters/mod_xml2enc.c /httpd/modules/generators/mod_asis.c /httpd/modules/generators/mod_autoindex.c /httpd/modules/generators/mod_cgi.c /httpd/modules/generators/mod_cgid.c /httpd/modules/generators/mod_status.c /httpd/modules/generators/mod_suexec.c /httpd/modules/http/byterange_filter.c /httpd/modules/http/http_filters.c /httpd/modules/http/http_protocol.c /httpd/modules/http/http_request.c /httpd/modules/http/mod_mime.c /httpd/modules/ldap/util_ldap.c /httpd/modules/ldap/util_ldap_cache_mgr.c /httpd/modules/loggers/mod_log_config.c /httpd/modules/loggers/mod_log_debug.c /httpd/modules/loggers/mod_log_forensic.c /httpd/modules/lua/lua_config.c /httpd/modules/lua/lua_request.c /httpd/modules/lua/lua_vmprep.c /httpd/modules/lua/mod_lua.c /httpd/modules/mappers/mod_actions.c /httpd/modules/mappers/mod_alias.c /httpd/modules/mappers/mod_imagemap.c /httpd/modules/mappers/mod_negotiation.c /httpd/modules/mappers/mod_rewrite.c /httpd/modules/metadata/mod_cern_meta.c /httpd/modules/metadata/mod_env.c /httpd/modules/metadata/mod_expires.c /httpd/modules/metadata/mod_headers.c /httpd/modules/metadata/mod_ident.c /httpd/modules/metadata/mod_mime_magic.c /httpd/modules/metadata/mod_remoteip.c /httpd/modules/metadata/mod_setenvif.c /httpd/modules/metadata/mod_unique_id.c /httpd/modules/metadata/mod_usertrack.c /httpd/modules/proxy/ajp_header.c /httpd/modules/proxy/ajp_link.c /httpd/modules/proxy/ajp_msg.c /httpd/modules/proxy/ajp_utils.c /httpd/modules/proxy/balancers/mod_lbmethod_bybusyness.c /httpd/modules/proxy/balancers/mod_lbmethod_byrequests.c /httpd/modules/proxy/balancers/mod_lbmethod_bytraffic.c /httpd/modules/proxy/balancers/mod_lbmethod_heartbeat.c /httpd/modules/proxy/examples/mod_lbmethod_rr.c /httpd/modules/proxy/mod_proxy.c /httpd/modules/proxy/mod_proxy_ajp.c /httpd/modules/proxy/mod_proxy_balancer.c /httpd/modules/proxy/mod_proxy_connect.c /httpd/modules/proxy/mod_proxy_express.c /httpd/modules/proxy/mod_proxy_fcgi.c /httpd/modules/proxy/mod_proxy_fdpass.c /httpd/modules/proxy/mod_proxy_ftp.c /httpd/modules/proxy/mod_proxy_http.c /httpd/modules/proxy/mod_proxy_scgi.c /httpd/modules/proxy/mod_serf.c /httpd/modules/proxy/proxy_util.c /httpd/modules/session/mod_session.c /httpd/modules/session/mod_session_crypto.c /httpd/modules/session/mod_session_dbd.c /httpd/modules/ssl/mod_ssl.c /httpd/modules/ssl/ssl_engine_init.c /httpd/modules/ssl/ssl_engine_io.c /httpd/modules/ssl/ssl_engine_kernel.c /httpd/modules/ssl/ssl_engine_log.c /httpd/modules/ssl/ssl_engine_mutex.c /httpd/modules/ssl/ssl_engine_ocsp.c /httpd/modules/ssl/ssl_engine_pphrase.c /httpd/modules/ssl/ssl_engine_rand.c /httpd/modules/ssl/ssl_engine_vars.c /httpd/modules/ssl/ssl_scache.c /httpd/modules/ssl/ssl_util_ocsp.c /httpd/modules/ssl/ssl_util_stapling.c /httpd/modules/test/mod_dialup.c /httpd/modules/test/mod_optional_fn_export.c /httpd/modules/test/mod_optional_hook_import.c /httpd/os/bs2000/os.c /httpd/os/unix/unixd.c /httpd/server/config.c /httpd/server/core.c /httpd/server/core_filters.c /httpd/server/listen.c /httpd/server/log.c /httpd/server/main.c /httpd/server/mpm/event/event.c /httpd/server/mpm/event/pod.c /httpd/server/mpm/mpmt_os2/mpmt_os2.c /httpd/server/mpm/mpmt_os2/mpmt_os2_child.c /httpd/server/mpm/netware/mpm_netware.c /httpd/server/mpm/prefork/prefork.c /httpd/server/mpm/simple/simple_api.c /httpd/server/mpm/simple/simple_children.c /httpd/server/mpm/simple/simple_core.c /httpd/server/mpm/simple/simple_io.c /httpd/server/mpm/simple/simple_run.c /httpd/server/mpm/winnt/child.c /httpd/server/mpm/winnt/mpm_winnt.c /httpd/server/mpm/winnt/service.c /httpd/server/mpm/worker/pod.c /httpd/server/mpm/worker/worker.c /httpd/server/mpm_common.c /httpd/server/mpm_unix.c /httpd/server/protocol.c /httpd/server/request.c /httpd/server/scoreboard.c /httpd/server/util.c /httpd/server/util_cookies.c /httpd/server/util_ebcdic.c /httpd/server/util_expr_eval.c /httpd/server/util_filter.c /httpd/server/util_mutex.c /httpd/server/util_xml.c /httpd/server/vhost.c
5bfaaf573bacb45c1cf290ce85ecc676587e8a64 1174751 23-Sep-2011 jim

Cleanup effort in prep for GA push: Trim trailing whitespace... no func change

mod_allowmethods.c mod_auth_digest.c mod_authn_socache.c mod_authnz_ldap.c mod_authz_core.c mod_authz_dbd.c mod_authz_dbm.c mod_authz_host.c /httpd/modules/arch/netware/mod_netware.c /httpd/modules/arch/unix/mod_unixd.c /httpd/modules/arch/win32/mod_isapi.c /httpd/modules/cache/mod_socache_dbm.c /httpd/modules/cache/mod_socache_dc.c /httpd/modules/cache/mod_socache_memcache.c /httpd/modules/cache/mod_socache_shmcb.c /httpd/modules/cluster/mod_heartmonitor.c /httpd/modules/core/mod_so.c /httpd/modules/dav/fs/repos.c /httpd/modules/dav/main/mod_dav.c /httpd/modules/dav/main/util.c /httpd/modules/echo/mod_echo.c /httpd/modules/examples/mod_case_filter.c /httpd/modules/examples/mod_example_hooks.c /httpd/modules/examples/mod_example_ipc.c /httpd/modules/experimental/mod_noloris.c /httpd/modules/filters/mod_buffer.c /httpd/modules/filters/mod_charset_lite.c /httpd/modules/filters/mod_data.c /httpd/modules/filters/mod_deflate.c /httpd/modules/filters/mod_filter.c /httpd/modules/filters/mod_include.c /httpd/modules/filters/mod_reqtimeout.c /httpd/modules/filters/mod_sed.c /httpd/modules/filters/mod_substitute.c /httpd/modules/filters/regexp.c /httpd/modules/filters/sed0.c /httpd/modules/filters/sed1.c /httpd/modules/generators/mod_autoindex.c /httpd/modules/generators/mod_cgi.c /httpd/modules/generators/mod_cgid.c /httpd/modules/generators/mod_status.c /httpd/modules/http/byterange_filter.c /httpd/modules/http/http_core.c /httpd/modules/http/http_filters.c /httpd/modules/http/http_protocol.c /httpd/modules/http/http_request.c /httpd/modules/ldap/util_ldap.c /httpd/modules/loggers/mod_log_config.c /httpd/modules/loggers/mod_log_forensic.c /httpd/modules/lua/lua_request.c /httpd/modules/lua/lua_vmprep.c /httpd/modules/lua/mod_lua.c /httpd/modules/mappers/mod_dir.c /httpd/modules/mappers/mod_imagemap.c /httpd/modules/mappers/mod_rewrite.c /httpd/modules/mappers/mod_speling.c /httpd/modules/mappers/mod_userdir.c /httpd/modules/metadata/mod_remoteip.c /httpd/modules/proxy/balancers/mod_lbmethod_bybusyness.c /httpd/modules/proxy/balancers/mod_lbmethod_byrequests.c /httpd/modules/proxy/balancers/mod_lbmethod_heartbeat.c /httpd/modules/proxy/examples/mod_lbmethod_rr.c /httpd/modules/proxy/mod_proxy.c /httpd/modules/proxy/mod_proxy_ajp.c /httpd/modules/proxy/mod_proxy_balancer.c /httpd/modules/proxy/mod_proxy_connect.c /httpd/modules/proxy/mod_proxy_express.c /httpd/modules/proxy/mod_proxy_fcgi.c /httpd/modules/proxy/mod_proxy_fdpass.c /httpd/modules/proxy/mod_proxy_ftp.c /httpd/modules/proxy/mod_proxy_http.c /httpd/modules/proxy/mod_proxy_scgi.c /httpd/modules/proxy/mod_serf.c /httpd/modules/slotmem/mod_slotmem_plain.c /httpd/modules/ssl/ssl_engine_config.c /httpd/modules/ssl/ssl_engine_init.c /httpd/modules/ssl/ssl_engine_io.c /httpd/modules/ssl/ssl_engine_kernel.c /httpd/modules/ssl/ssl_engine_log.c /httpd/modules/ssl/ssl_engine_ocsp.c /httpd/modules/ssl/ssl_engine_pphrase.c /httpd/modules/ssl/ssl_engine_vars.c /httpd/modules/ssl/ssl_scache.c /httpd/modules/ssl/ssl_util.c /httpd/modules/ssl/ssl_util_ocsp.c /httpd/modules/ssl/ssl_util_ssl.c /httpd/modules/ssl/ssl_util_stapling.c /httpd/modules/test/mod_dialup.c /httpd/server/config.c /httpd/server/log.c /httpd/server/main.c /httpd/server/mpm/event/event.c /httpd/server/mpm/event/fdqueue.c /httpd/server/mpm/prefork/prefork.c /httpd/server/mpm/simple/simple_children.c /httpd/server/mpm/simple/simple_core.c /httpd/server/mpm/simple/simple_io.c /httpd/server/mpm/simple/simple_run.c /httpd/server/mpm/winnt/child.c /httpd/server/mpm/winnt/mpm_winnt.c /httpd/server/mpm/winnt/nt_eventlog.c /httpd/server/mpm/winnt/service.c /httpd/server/mpm/worker/worker.c /httpd/server/mpm_unix.c /httpd/server/protocol.c /httpd/server/request.c /httpd/server/util.c /httpd/server/util_expr_eval.c /httpd/server/util_expr_parse.c /httpd/server/util_expr_scan.c /httpd/server/util_mutex.c /httpd/server/util_pcre.c /httpd/server/util_script.c /httpd/server/vhost.c /httpd/support/ab.c /httpd/support/htcacheclean.c /httpd/support/htpasswd.c /httpd/support/rotatelogs.c /httpd/support/win32/ApacheMonitor.c
7c2df38555e33d4c30de9973722128cc9646a1b3 1153687 04-Aug-2011 sf

Forbid some directives in .htaccess because of AllowOverrideList: core: AllowOverride, AllowOverrideList mod_authn_dbd: AuthDBDUserPWQuery, AuthDBDUserRealmQuery mod_authz_dbd: AuthzDBDQuery, AuthzDBDRedirectQuery mod_proxy: BalancerMember, ProxySet Adjust for use in .htaccess: mod_actions: Script

97cc46935ec496b83fef9d6feb094d706c895b3b 998706 19-Sep-2010 sf

Allow authz providers to check args while reading the config and allow them to cache parsed args. Use this to check that argument to 'all' provider is 'granted' or 'denied'.

18b5268e013574026b2503b1641baf3299045f45 964156 14-Jul-2010 sf

The approach for allowing authorization by user or IP introduced in r956387, etc. causes problems because the authentication module calls note_*_auth_failure if authentication fails. This is inappropriate if access is later allowed because of the IP. So, instead of calling the auth_checker hook even if authentication failed, we introduce a new access_checker_ex hook that runs between the access_checker and the check_user_id hooks. If an access_checker_ex functions returns OK, the request will be allowed without authentication. To make use of this, change mod_authz_core to walk the require blocks in the access_checker_ex phase and deny/allow the request if the authz result does not depend on an authenticated user. To distinguish a real AUTHZ_DENIED from an authz provider from an authz provider needing an authenticated user, the latter must return the new AUTHZ_DENIED_NO_USER code.

36ef8f77bffe75d1aa327882be1b5bdbe2ff567a 951895 06-Jun-2010 sf

Use the new APLOG_USE_MODULE/AP_DECLARE_MODULE macros everywhere to take advantage of per-module loglevels

mod_access_compat.c mod_auth_basic.c mod_auth_digest.c mod_auth_form.c mod_authn_anon.c mod_authn_core.c mod_authn_dbd.c mod_authn_dbm.c mod_authn_file.c mod_authnz_ldap.c mod_authz_core.c mod_authz_dbd.c mod_authz_dbm.c mod_authz_groupfile.c mod_authz_host.c mod_authz_owner.c mod_authz_user.c /httpd/modules/arch/netware/mod_netware.c /httpd/modules/arch/netware/mod_nw_ssl.c /httpd/modules/arch/unix/mod_privileges.c /httpd/modules/arch/unix/mod_unixd.c /httpd/modules/arch/win32/mod_isapi.c /httpd/modules/arch/win32/mod_win32.c /httpd/modules/cache/cache_cache.c /httpd/modules/cache/cache_storage.c /httpd/modules/cache/cache_util.c /httpd/modules/cache/mod_cache.c /httpd/modules/cache/mod_disk_cache.c /httpd/modules/cache/mod_file_cache.c /httpd/modules/cache/mod_socache_dbm.c /httpd/modules/cache/mod_socache_dc.c /httpd/modules/cache/mod_socache_memcache.c /httpd/modules/cache/mod_socache_shmcb.c /httpd/modules/cluster/mod_heartbeat.c /httpd/modules/cluster/mod_heartmonitor.c /httpd/modules/core/mod_so.c /httpd/modules/core/mod_watchdog.c /httpd/modules/database/mod_dbd.c /httpd/modules/dav/fs/mod_dav_fs.c /httpd/modules/dav/lock/mod_dav_lock.c /httpd/modules/dav/main/mod_dav.c /httpd/modules/dav/main/util_lock.c /httpd/modules/debugging/mod_bucketeer.c /httpd/modules/debugging/mod_dumpio.c /httpd/modules/echo/mod_echo.c /httpd/modules/examples/mod_case_filter.c /httpd/modules/examples/mod_case_filter_in.c /httpd/modules/examples/mod_example_hooks.c /httpd/modules/examples/mod_example_ipc.c /httpd/modules/experimental/mod_noloris.c /httpd/modules/filters/mod_buffer.c /httpd/modules/filters/mod_charset_lite.c /httpd/modules/filters/mod_deflate.c /httpd/modules/filters/mod_ext_filter.c /httpd/modules/filters/mod_filter.c /httpd/modules/filters/mod_include.c /httpd/modules/filters/mod_ratelimit.c /httpd/modules/filters/mod_reflector.c /httpd/modules/filters/mod_reqtimeout.c /httpd/modules/filters/mod_request.c /httpd/modules/filters/mod_sed.c /httpd/modules/filters/mod_substitute.c /httpd/modules/generators/mod_asis.c /httpd/modules/generators/mod_autoindex.c /httpd/modules/generators/mod_cgi.c /httpd/modules/generators/mod_cgid.c /httpd/modules/generators/mod_info.c /httpd/modules/generators/mod_status.c /httpd/modules/generators/mod_suexec.c /httpd/modules/http/byterange_filter.c /httpd/modules/http/http_core.c /httpd/modules/http/http_filters.c /httpd/modules/http/http_protocol.c /httpd/modules/http/http_request.c /httpd/modules/http/mod_mime.c /httpd/modules/ldap/util_ldap.c /httpd/modules/ldap/util_ldap_cache_mgr.c /httpd/modules/loggers/mod_log_config.c /httpd/modules/loggers/mod_log_forensic.c /httpd/modules/loggers/mod_logio.c /httpd/modules/lua/lua_config.c /httpd/modules/lua/lua_request.c /httpd/modules/lua/lua_vmprep.c /httpd/modules/lua/mod_lua.c /httpd/modules/mappers/mod_actions.c /httpd/modules/mappers/mod_alias.c /httpd/modules/mappers/mod_dir.c /httpd/modules/mappers/mod_imagemap.c /httpd/modules/mappers/mod_negotiation.c /httpd/modules/mappers/mod_rewrite.c /httpd/modules/mappers/mod_speling.c /httpd/modules/mappers/mod_userdir.c /httpd/modules/mappers/mod_vhost_alias.c /httpd/modules/metadata/mod_cern_meta.c /httpd/modules/metadata/mod_env.c /httpd/modules/metadata/mod_expires.c /httpd/modules/metadata/mod_headers.c /httpd/modules/metadata/mod_ident.c /httpd/modules/metadata/mod_mime_magic.c /httpd/modules/metadata/mod_remoteip.c /httpd/modules/metadata/mod_setenvif.c /httpd/modules/metadata/mod_unique_id.c /httpd/modules/metadata/mod_usertrack.c /httpd/modules/metadata/mod_version.c /httpd/modules/proxy/ajp_header.c /httpd/modules/proxy/ajp_link.c /httpd/modules/proxy/ajp_msg.c /httpd/modules/proxy/ajp_utils.c /httpd/modules/proxy/balancers/mod_lbmethod_bybusyness.c /httpd/modules/proxy/balancers/mod_lbmethod_byrequests.c /httpd/modules/proxy/balancers/mod_lbmethod_bytraffic.c /httpd/modules/proxy/balancers/mod_lbmethod_heartbeat.c /httpd/modules/proxy/examples/mod_lbmethod_rr.c /httpd/modules/proxy/mod_proxy.c /httpd/modules/proxy/mod_proxy_ajp.c /httpd/modules/proxy/mod_proxy_balancer.c /httpd/modules/proxy/mod_proxy_connect.c /httpd/modules/proxy/mod_proxy_fcgi.c /httpd/modules/proxy/mod_proxy_fdpass.c /httpd/modules/proxy/mod_proxy_ftp.c /httpd/modules/proxy/mod_proxy_http.c /httpd/modules/proxy/mod_proxy_scgi.c /httpd/modules/proxy/mod_serf.c /httpd/modules/proxy/proxy_util.c /httpd/modules/session/mod_session.c /httpd/modules/session/mod_session_cookie.c /httpd/modules/session/mod_session_crypto.c /httpd/modules/session/mod_session_dbd.c /httpd/modules/slotmem/mod_slotmem_plain.c /httpd/modules/slotmem/mod_slotmem_shm.c /httpd/modules/test/mod_dialup.c /httpd/modules/test/mod_optional_fn_export.c /httpd/modules/test/mod_optional_fn_import.c /httpd/modules/test/mod_optional_hook_export.c /httpd/modules/test/mod_optional_hook_import.c /httpd/os/bs2000/os.c /httpd/os/unix/unixd.c /httpd/server/core_filters.c /httpd/server/listen.c /httpd/server/main.c /httpd/server/mpm/event/event.c /httpd/server/mpm/event/pod.c /httpd/server/mpm/mpmt_os2/mpmt_os2.c /httpd/server/mpm/mpmt_os2/mpmt_os2_child.c /httpd/server/mpm/netware/mpm_netware.c /httpd/server/mpm/prefork/prefork.c /httpd/server/mpm/simple/simple_api.c /httpd/server/mpm/simple/simple_children.c /httpd/server/mpm/simple/simple_core.c /httpd/server/mpm/simple/simple_io.c /httpd/server/mpm/simple/simple_run.c /httpd/server/mpm/winnt/child.c /httpd/server/mpm/winnt/mpm_winnt.c /httpd/server/mpm/winnt/service.c /httpd/server/mpm/worker/pod.c /httpd/server/mpm/worker/worker.c /httpd/server/mpm_common.c /httpd/server/mpm_unix.c /httpd/server/protocol.c /httpd/server/request.c /httpd/server/scoreboard.c /httpd/server/util.c /httpd/server/util_cookies.c /httpd/server/util_ebcdic.c /httpd/server/util_expr.c /httpd/server/util_filter.c /httpd/server/util_mutex.c /httpd/server/util_script.c /httpd/server/util_xml.c /httpd/server/vhost.c
db027b0af55a7fa31f2e1659368d606a8b860bb0 705361 16-Oct-2008 chrisd

Prior to authn/z refactoring in r368027, if authorization Require directives had no matching AuthType and associated authentication directives, requests would generally fall through in the check_user_id hook to mod_authn_default.c's authentication_no_user() handler, which returned DECLINED if ap_auth_type() was not set. The ap_process_request_internal() function in request.c would handle this case by logging an "AuthType not set!" error and returning HTTP_INTERNAL_SERVER_ERROR. The refactoring removes this error handling in request.c, so individual modules will need to test for a lack of authentication, as necessary. Since some modules such as mod_authz_host.c support Require directives that do not need any authentication, the mod_authn_default.c handler no longer returns DECLINED if ap_auth_type() is not set. (Also, mod_authn_default can be compiled out with --disable-authn-default, so it can't be relied upon to exist.) Since r->user may now be NULL, individual handlers must test for that case when necessary. Otherwise, most Require directives in the absence of AuthType directives cause handlers to crash while performing strcmp() and friends on a NULL r->user value. NOTE: I can't test mod_authnz_ldap.c myself, so I'm not sure if it needs similar fixes. On the one hand, a NULL r->user in the authz handlers always generates a log message. However, it appears that authn_ldap_build_filter() will sometimes then be called, perform no action, which may result in a possibly uninitialized filtbuf buffer being passed to util_ldap_cache_getuserdn(). I don't know if that could cause problems in the LDAP cache code. If someone familiar with LDAP authz could take a look, that would be much appreciated.

2e242dca7111f99d54dd144b7b8418d88d560032 658046 20-May-2008 chrisd

Convert common provider version strings ("0") to AUTHN/Z_PROVIDER_VERSION macros defined in mod_auth.h.

a72211e92bab814bfa28ee086ca9b2a1a6095c92 644525 03-Apr-2008 chrisd

Avoid calling access control hooks for internal requests with configurations which match those of the initial request. Revert to the original behaviour (call access control hooks for internal requests with URIs different from the initial request) if any access control hooks or providers are not registered as permitting this optimization. Introduce wrappers for access control hook and provider registration which can accept additional mode and flag data. The configuration walk optimizations were originally proposed a while ago (see http://marc.info/?l=apache-httpd-dev&m=116536713506234&w=2); they have been used since then in production systems and appear to be stable and effective. They permit certain combinations of modules and clients to function efficiently, especially when a deeply recursive series of internal requests, such as those generated by certain WebDAV requests, are all subject to the identical authentication and authorization directives. The major change from the original proposal is a cleaner mechanism for detecting modules which may expect the old behaviour. This has been tested successfully with Subversion's mod_authz_svn, which specifically requires the old behaviour when performing path-based authorization based against its own private access control configuration files.

d56bacbfefa5aa883ce5162a115747372fc38d13 640932 25-Mar-2008 chrisd

Return AUTHZ_GRANTED not AUTHZ_DENIED when redirecting after successful login/logout. Use redirection URL from first row returned by DB query, in the same manner as that used by mod_authn_dbd when querying for a single record.

e2b6e4d548316b37b2763c7ca7c2b54f5e210ac4 569192 24-Aug-2007 wrowe

You can't borrow AP_ namespace for imports/exports. They are specific to one loadable module.

842ae4bd224140319ae7feec1872b93dfd491143 420983 11-Jul-2006 fielding

update license header text

/httpd/buildconf /httpd/include/ap_compat.h /httpd/include/ap_config.h /httpd/include/ap_listen.h /httpd/include/ap_mmn.h /httpd/include/ap_mpm.h /httpd/include/ap_provider.h /httpd/include/ap_regex.h /httpd/include/ap_regkey.h /httpd/include/ap_release.h /httpd/include/http_config.h /httpd/include/http_connection.h /httpd/include/http_core.h /httpd/include/http_log.h /httpd/include/http_main.h /httpd/include/http_protocol.h /httpd/include/http_request.h /httpd/include/http_vhost.h /httpd/include/httpd.h /httpd/include/mpm_common.h /httpd/include/scoreboard.h /httpd/include/util_cfgtree.h /httpd/include/util_charset.h /httpd/include/util_ebcdic.h /httpd/include/util_filter.h /httpd/include/util_ldap.h /httpd/include/util_md5.h /httpd/include/util_script.h /httpd/include/util_time.h /httpd/include/util_xml.h mod_access_compat.c mod_auth.h mod_auth_basic.c mod_auth_digest.c mod_authn_anon.c mod_authn_core.c mod_authn_dbd.c mod_authn_dbm.c mod_authn_default.c mod_authn_file.c mod_authnz_ldap.c mod_authz_core.c mod_authz_dbd.c mod_authz_dbd.h mod_authz_dbm.c mod_authz_default.c mod_authz_groupfile.c mod_authz_host.c mod_authz_owner.c mod_authz_user.c /httpd/modules/arch/netware/libprews.c /httpd/modules/arch/netware/mod_netware.c /httpd/modules/arch/netware/mod_nw_ssl.c /httpd/modules/arch/win32/mod_isapi.c /httpd/modules/arch/win32/mod_isapi.h /httpd/modules/arch/win32/mod_win32.c /httpd/modules/cache/cache_cache.c /httpd/modules/cache/cache_cache.h /httpd/modules/cache/cache_hash.c /httpd/modules/cache/cache_hash.h /httpd/modules/cache/cache_pqueue.c /httpd/modules/cache/cache_pqueue.h /httpd/modules/cache/cache_storage.c /httpd/modules/cache/cache_util.c /httpd/modules/cache/mod_cache.c /httpd/modules/cache/mod_cache.h /httpd/modules/cache/mod_disk_cache.c /httpd/modules/cache/mod_disk_cache.h /httpd/modules/cache/mod_file_cache.c /httpd/modules/cache/mod_mem_cache.c /httpd/modules/database/mod_dbd.c /httpd/modules/database/mod_dbd.h /httpd/modules/dav/fs/dbm.c /httpd/modules/dav/fs/lock.c /httpd/modules/dav/fs/mod_dav_fs.c /httpd/modules/dav/fs/repos.c /httpd/modules/dav/fs/repos.h /httpd/modules/dav/lock/locks.c /httpd/modules/dav/lock/locks.h /httpd/modules/dav/lock/mod_dav_lock.c /httpd/modules/dav/main/liveprop.c /httpd/modules/dav/main/mod_dav.c /httpd/modules/dav/main/mod_dav.h /httpd/modules/dav/main/props.c /httpd/modules/dav/main/providers.c /httpd/modules/dav/main/std_liveprop.c /httpd/modules/dav/main/util.c /httpd/modules/dav/main/util_lock.c /httpd/modules/debugging/mod_bucketeer.c /httpd/modules/debugging/mod_dumpio.c /httpd/modules/echo/mod_echo.c /httpd/modules/experimental/mod_case_filter.c /httpd/modules/experimental/mod_case_filter_in.c /httpd/modules/experimental/mod_example.c /httpd/modules/filters/mod_charset_lite.c /httpd/modules/filters/mod_deflate.c /httpd/modules/filters/mod_ext_filter.c /httpd/modules/filters/mod_filter.c /httpd/modules/filters/mod_include.c /httpd/modules/filters/mod_include.h /httpd/modules/generators/mod_asis.c /httpd/modules/generators/mod_autoindex.c /httpd/modules/generators/mod_cgi.c /httpd/modules/generators/mod_cgi.h /httpd/modules/generators/mod_cgid.c /httpd/modules/generators/mod_info.c /httpd/modules/generators/mod_status.c /httpd/modules/generators/mod_status.h /httpd/modules/generators/mod_suexec.c /httpd/modules/generators/mod_suexec.h /httpd/modules/http/byterange_filter.c /httpd/modules/http/chunk_filter.c /httpd/modules/http/http_core.c /httpd/modules/http/http_etag.c /httpd/modules/http/http_filters.c /httpd/modules/http/http_protocol.c /httpd/modules/http/http_request.c /httpd/modules/http/mod_core.h /httpd/modules/http/mod_mime.c /httpd/modules/ldap/util_ldap.c /httpd/modules/ldap/util_ldap_cache.c /httpd/modules/ldap/util_ldap_cache.h /httpd/modules/ldap/util_ldap_cache_mgr.c /httpd/modules/loggers/mod_log_config.c /httpd/modules/loggers/mod_log_config.h /httpd/modules/loggers/mod_log_forensic.c /httpd/modules/loggers/mod_logio.c /httpd/modules/mappers/mod_actions.c /httpd/modules/mappers/mod_alias.c /httpd/modules/mappers/mod_dir.c /httpd/modules/mappers/mod_imagemap.c /httpd/modules/mappers/mod_negotiation.c /httpd/modules/mappers/mod_rewrite.c /httpd/modules/mappers/mod_rewrite.h /httpd/modules/mappers/mod_so.c /httpd/modules/mappers/mod_so.h /httpd/modules/mappers/mod_speling.c /httpd/modules/mappers/mod_userdir.c /httpd/modules/mappers/mod_vhost_alias.c /httpd/modules/metadata/mod_cern_meta.c /httpd/modules/metadata/mod_env.c /httpd/modules/metadata/mod_expires.c /httpd/modules/metadata/mod_headers.c /httpd/modules/metadata/mod_ident.c /httpd/modules/metadata/mod_mime_magic.c /httpd/modules/metadata/mod_setenvif.c /httpd/modules/metadata/mod_unique_id.c /httpd/modules/metadata/mod_usertrack.c /httpd/modules/metadata/mod_version.c /httpd/modules/proxy/ajp.h /httpd/modules/proxy/ajp_header.c /httpd/modules/proxy/ajp_header.h /httpd/modules/proxy/ajp_link.c /httpd/modules/proxy/ajp_msg.c /httpd/modules/proxy/fcgi_protocol.h /httpd/modules/proxy/mod_proxy.c /httpd/modules/proxy/mod_proxy.h /httpd/modules/proxy/mod_proxy_ajp.c /httpd/modules/proxy/mod_proxy_balancer.c /httpd/modules/proxy/mod_proxy_connect.c /httpd/modules/proxy/mod_proxy_fcgi.c /httpd/modules/proxy/mod_proxy_ftp.c /httpd/modules/proxy/mod_proxy_http.c /httpd/modules/proxy/proxy_util.c /httpd/modules/ssl/mod_ssl.c /httpd/modules/ssl/mod_ssl.h /httpd/modules/ssl/ssl_engine_config.c /httpd/modules/ssl/ssl_engine_dh.c /httpd/modules/ssl/ssl_engine_init.c /httpd/modules/ssl/ssl_engine_io.c /httpd/modules/ssl/ssl_engine_kernel.c /httpd/modules/ssl/ssl_engine_log.c /httpd/modules/ssl/ssl_engine_mutex.c /httpd/modules/ssl/ssl_engine_pphrase.c /httpd/modules/ssl/ssl_engine_rand.c /httpd/modules/ssl/ssl_engine_vars.c /httpd/modules/ssl/ssl_expr.c /httpd/modules/ssl/ssl_expr.h /httpd/modules/ssl/ssl_expr_eval.c /httpd/modules/ssl/ssl_expr_scan.c /httpd/modules/ssl/ssl_private.h /httpd/modules/ssl/ssl_scache.c /httpd/modules/ssl/ssl_scache_dbm.c /httpd/modules/ssl/ssl_scache_dc.c /httpd/modules/ssl/ssl_scache_shmcb.c /httpd/modules/ssl/ssl_toolkit_compat.h /httpd/modules/ssl/ssl_util.c /httpd/modules/ssl/ssl_util_ssl.c /httpd/modules/ssl/ssl_util_ssl.h /httpd/modules/test/mod_optional_fn_export.c /httpd/modules/test/mod_optional_fn_export.h /httpd/modules/test/mod_optional_fn_import.c /httpd/modules/test/mod_optional_hook_export.c /httpd/modules/test/mod_optional_hook_export.h /httpd/modules/test/mod_optional_hook_import.c /httpd/os/beos/beosd.c /httpd/os/beos/beosd.h /httpd/os/beos/os.c /httpd/os/beos/os.h /httpd/os/bs2000/ebcdic.c /httpd/os/bs2000/ebcdic.h /httpd/os/bs2000/os.c /httpd/os/bs2000/os.h /httpd/os/netware/modules.c /httpd/os/netware/os.h /httpd/os/netware/pre_nw.h /httpd/os/netware/util_nw.c /httpd/os/os2/os.h /httpd/os/os2/util_os2.c /httpd/os/tpf/ebcdic.c /httpd/os/tpf/ebcdic.h /httpd/os/tpf/os.c /httpd/os/tpf/os.h /httpd/os/unix/os.h /httpd/os/unix/unixd.c /httpd/os/unix/unixd.h /httpd/os/win32/ap_regkey.c /httpd/os/win32/modules.c /httpd/os/win32/os.h /httpd/os/win32/util_win32.c /httpd/server/buildmark.c /httpd/server/config.c /httpd/server/connection.c /httpd/server/core.c /httpd/server/core_filters.c /httpd/server/eoc_bucket.c /httpd/server/eor_bucket.c /httpd/server/error_bucket.c /httpd/server/gen_test_char.c /httpd/server/listen.c /httpd/server/log.c /httpd/server/main.c /httpd/server/mpm/beos/beos.c /httpd/server/mpm/beos/beos.h /httpd/server/mpm/beos/mpm.h /httpd/server/mpm/beos/mpm_default.h /httpd/server/mpm/experimental/event/event.c /httpd/server/mpm/experimental/event/fdqueue.c /httpd/server/mpm/experimental/event/fdqueue.h /httpd/server/mpm/experimental/event/mpm.h /httpd/server/mpm/experimental/event/mpm_default.h /httpd/server/mpm/experimental/event/pod.c /httpd/server/mpm/experimental/event/pod.h /httpd/server/mpm/experimental/leader/leader.c /httpd/server/mpm/experimental/leader/mpm.h /httpd/server/mpm/experimental/leader/mpm_default.h /httpd/server/mpm/experimental/perchild/mpm.h /httpd/server/mpm/experimental/perchild/mpm_default.h /httpd/server/mpm/experimental/perchild/perchild.c /httpd/server/mpm/experimental/threadpool/mpm.h /httpd/server/mpm/experimental/threadpool/mpm_default.h /httpd/server/mpm/experimental/threadpool/pod.c /httpd/server/mpm/experimental/threadpool/pod.h /httpd/server/mpm/experimental/threadpool/threadpool.c /httpd/server/mpm/mpmt_os2/mpm.h /httpd/server/mpm/mpmt_os2/mpm_default.h /httpd/server/mpm/mpmt_os2/mpmt_os2.c /httpd/server/mpm/mpmt_os2/mpmt_os2_child.c /httpd/server/mpm/netware/mpm.h /httpd/server/mpm/netware/mpm_default.h /httpd/server/mpm/netware/mpm_netware.c /httpd/server/mpm/prefork/mpm.h /httpd/server/mpm/prefork/mpm_default.h /httpd/server/mpm/prefork/prefork.c /httpd/server/mpm/winnt/Win9xConHook.c /httpd/server/mpm/winnt/Win9xConHook.h /httpd/server/mpm/winnt/child.c /httpd/server/mpm/winnt/mpm.h /httpd/server/mpm/winnt/mpm_default.h /httpd/server/mpm/winnt/mpm_winnt.c /httpd/server/mpm/winnt/mpm_winnt.h /httpd/server/mpm/winnt/nt_eventlog.c /httpd/server/mpm/winnt/service.c /httpd/server/mpm/worker/fdqueue.c /httpd/server/mpm/worker/fdqueue.h /httpd/server/mpm/worker/mpm.h /httpd/server/mpm/worker/mpm_default.h /httpd/server/mpm/worker/pod.c /httpd/server/mpm/worker/pod.h /httpd/server/mpm/worker/worker.c /httpd/server/mpm_common.c /httpd/server/protocol.c /httpd/server/provider.c /httpd/server/request.c /httpd/server/scoreboard.c /httpd/server/util.c /httpd/server/util_cfgtree.c /httpd/server/util_charset.c /httpd/server/util_debug.c /httpd/server/util_ebcdic.c /httpd/server/util_filter.c /httpd/server/util_md5.c /httpd/server/util_script.c /httpd/server/util_time.c /httpd/server/util_xml.c /httpd/server/vhost.c /httpd/support/ab.c /httpd/support/checkgid.c /httpd/support/fcgistarter.c /httpd/support/htcacheclean.c /httpd/support/htdbm.c /httpd/support/htdigest.c /httpd/support/htpasswd.c /httpd/support/httxt2dbm.c /httpd/support/logresolve.c /httpd/support/rotatelogs.c /httpd/support/suexec.c /httpd/support/suexec.h /httpd/support/win32/ApacheMonitor.c /httpd/support/win32/ApacheMonitor.h /httpd/support/win32/wintty.c /httpd/test/cls.c /httpd/test/test-writev.c /httpd/test/test_find.c /httpd/test/test_parser.c /httpd/test/test_select.c /httpd/test/time-sem.c
367d146f245f3b1c9f77c18e6ec591b52e0b344c 368027 11-Jan-2006 bnicholes

Authz refactoring Merge from branches/authz-dev Basically here is a list of what has been done: - Convert all of the authz modules from hook based to provider based - Remove the ap_requires field from the core_dir_config structure - Remove the function ap_requires() since its functionality is no longer supported or necessary in the refactoring - Remove the calls to ap_some_auth_required() in the core request handling to allow the hooks to be called in all cases. - Add the new module mod_authz_core which will act as the authorization provider vector and contain common authz directives such as 'Require', 'Reject' and '<RequireAlias>' - Add the new module mod_authn_core which will contain common authentication directives such as 'AuthType', 'AuthName' and '<AuthnProviderAlias>' - Move the check for METHOD_MASK out of the authz providers and into the authz_core provider vector - Define the status codes that can be returned by the authz providers as AUTHZ_DENIED, AUTHZ_GRANTED and AUTHZ_GENERAL_ERROR - Remove the 'Satisfy' directive - Implement the '<RequireAll>', '<RequireOne>' block directives to handle the 'and' and 'or' logic for authorization. - Remove the 'AuthzXXXAuthoritative' directives from all of the authz providers - Implement the 'Reject' directive that will deny authorization if the argument is true - Fold the 'Reject' directive into the '<RequireAll>', '<RequireOne>' logic - Reimplement the host based authorization functionality provided by 'allow', 'deny' and 'order' as authz providers - Remove the 'allow', 'deny' and 'order' directives - Merge mod_authn_alias into mod_authn_core - Add '<RequireAlias>' functionality which is similar to '<AuthnProviderAlias>' but specific to authorization aliasing - Remove all of the references to the 'authzxxxAuthoritative' directives from the documentation - Remove the 'Satisfy' directive from the documentation - Remove 'Allow', 'Deny', 'Order' directives from the documentation - Document '<RequireAll>', '<RequireOne>', 'Reject' directives - Reimplement the APIs ap_auth_type(), ap_auth_name() as optional functions and move the actual implementation into mod_authn_core - Reimplement the API ap_some_auth_required() as an optional function and move the actual implementation into mod_authz_core Major Changes: - Added the directives <RequireAll>, <RequireOne>, <RequireAlias>, Reject - Expanded the functionality of the directive 'Require' to handle all authorization and access control - Added the new authz providers 'env', 'ip', 'host', 'all' to handle host-based access control - Removed the directives 'Allow', 'Deny', 'Order', 'Satisfy', 'AuthzXXXAuthoritative' - Removed the ap_require() API - Moved the directives 'AuthType', 'AuthName' out of mod_core and into mod_authn_core - Moved the directive 'Require' out of mod_core and into mod_authz_core - Merged mod_authn_alias into mod_authn_core - Renamed mod_authz_dbm authz providers from 'group' and 'file-group' to 'dbm-group' and 'dbm-file-group' Benefits: - All authorization and access control is now handle through two directives, 'Require' and 'Reject' - Authorization has been expanded to allow for complex 'AND/OR' control logic through the directives '<RequireAll>' and '<RequireOne>' - Configuration is now much simpler and consistent across the board - Other modules like mod_ssl and mod_proxy should be able to plug into and take advantage of the same provider based authorization mechanism by implementing their own providers Issues: - Backwards compatibility between 2.2 and 2.3 configurations will be broken in the area of authorization and access control due to the fact that the directives 'allow', 'deny', 'order' and 'satisfy' have been removed. When moving from 2.2 to 2.3 these directives will have to be changed to 'Require all granted', 'Require all denied' or some variation of the authz host-based providers. - Existing third party authorization modules will have to adapt to the new structure.

/httpd/docs/conf/extra/httpd-autoindex.conf.in /httpd/docs/conf/extra/httpd-dav.conf.in /httpd/docs/conf/extra/httpd-info.conf.in /httpd/docs/conf/extra/httpd-manual.conf.in /httpd/docs/conf/extra/httpd-multilang-errordoc.conf.in /httpd/docs/conf/extra/httpd-userdir.conf.in /httpd/docs/conf/httpd.conf.in /httpd/docs/manual/developer/request.xml /httpd/docs/manual/mod/allmodules.xml /httpd/docs/manual/mod/core.xml /httpd/docs/manual/mod/mod_auth_digest.xml /httpd/docs/manual/mod/mod_authn_alias.xml /httpd/docs/manual/mod/mod_authn_core.xml /httpd/docs/manual/mod/mod_authn_core.xml.meta /httpd/docs/manual/mod/mod_authnz_ldap.xml /httpd/docs/manual/mod/mod_authz_core.xml /httpd/docs/manual/mod/mod_authz_core.xml.meta /httpd/docs/manual/mod/mod_authz_dbd.xml /httpd/docs/manual/mod/mod_authz_dbm.xml /httpd/docs/manual/mod/mod_authz_groupfile.xml /httpd/docs/manual/mod/mod_authz_host.xml /httpd/docs/manual/mod/mod_authz_owner.xml /httpd/docs/manual/mod/mod_authz_user.xml /httpd/docs/manual/mod/mod_ldap.xml /httpd/include/ap_mmn.h /httpd/include/http_core.h NWGNUauthncore NWGNUauthzcore NWGNUmakefile config.m4 mod_auth.h mod_auth_basic.c mod_authn_core.c mod_authn_default.c mod_authnz_ldap.c mod_authz_core.c mod_authz_dbd.c mod_authz_dbm.c mod_authz_default.c mod_authz_groupfile.c mod_authz_host.c mod_authz_owner.c mod_authz_user.c /httpd/server/core.c /httpd/server/request.c
6c47a7d40935c5508868904cba1e87ca783ec386 345389 18-Nov-2005 niq

mod_authz_dbd: SQL authz with Login/Session support