>Number: 3182 >Category: mod_auth-any >Synopsis: Authorization skipped in ScriptAlias-ed directory >Confidential: no >Severity: serious >Priority: medium >Responsible: apache >State: open >Class: sw-bug >Submitter-Id: apache >Arrival-Date: Sun Oct 11 13:20:00 PDT 1998 >Last-Modified: >Originator: [EMAIL PROTECTED] >Organization: apache >Release: 1.3.3 >Environment: Linux RedHat 5.0, Cyrix 166+, gcc 2.7, >Description: If I invoke a script living in /cgi-bin/, Apache doesn't request user authentication even if authorization is required by an Auth directive in config files. I checked many times my config files and the problem doesn't seem to be there. Note that ordinary directories are protected by a pwd request; the directives given to Apache are the same everywhere. So authorization seems to works everywhere else, but not in scriptaliased directory. >How-To-Repeat: Protect a scriptaliased directory and try to access a script like test-cgi enclosed in any of your standard distribution. Apache will not challenge you and the evironment variable REMOTE_USER will be empty. >Fix: I can only say that the problem was not in apache 1.3.0 >Audit-Trail: >Unformatted: [In order for any reply to be added to the PR database, ] [you need to include <[EMAIL PROTECTED]> in the Cc line ] [and leave the subject line UNCHANGED. This is not done] [automatically because of the potential for mail loops. ] [If you do not include this Cc, your reply may be ig- ] [nored unless you are responding to an explicit request ] [from a developer. ] [Reply only with text; DO NOT SEND ATTACHMENTS! ]
