>Number: 4727
>Category: general
>Synopsis: FilesMatch not working
>Confidential: no
>Severity: critical
>Priority: medium
>Responsible: apache
>State: open
>Class: sw-bug
>Submitter-Id: apache
>Arrival-Date: Tue Jul 13 22:10:01 PDT 1999
>Last-Modified:
>Originator: [EMAIL PROTECTED]
>Organization:
apache
>Release: 1.3.4
>Environment:
SunOS picard 5.6 Generic_105181-14 sun4u sparc SUNW,Ultra-5_10
Sun Solaris 2.6
>Description:
Hi,
i would like to use .htaccess on certain cgis in a particular dir.
I have some cgis which are meant to be run only by admin while the rest can be
run by the general public.
In my httpd.conf:
<VirtualHost>
...
AccessFileName .htaccess
<Directory /opt/VC/TMCWork/cgi-bin>
<FilesMatch "*admin*.cgi">
Options ExecCGI FollowSymLinks
AllowOverride Limit AuthConfig
</FilesMatch>
</Directory>
</VirtualHost>
And in the .htaccess in /opt/VC/TMCWork/cgi-bin dir:
AuthUserFile /etc/.htpasswd
AuthGroupFile /dev/null
AuthName "Administrative Access"
AuthType Basic
<Limit GET POST PUT DELETE>
order deny,allow
deny from all
allow from all
require user setup
</Limit>
But im not getting any protection/validation when i point to the url. All cgis
just run without prior validation request.
However when i comment off the <FilesMatch> tag, the validation works ... of
course for the whole directory.
Ive tried <Files> tag or different combination for the <FilesMatch> tag.
Nothing seems to work.
Any suggestions?
Thanks.
>How-To-Repeat:
>Fix:
>Audit-Trail:
>Unformatted:
[In order for any reply to be added to the PR database, you need]
[to include <[EMAIL PROTECTED]> in the Cc line and make sure the]
[subject line starts with the report component and number, with ]
[or without any 'Re:' prefixes (such as "general/1098:" or ]
["Re: general/1098:"). If the subject doesn't match this ]
[pattern, your message will be misfiled and ignored. The ]
["apbugs" address is not added to the Cc line of messages from ]
[the database automatically because of the potential for mail ]
[loops. If you do not include this Cc, your reply may be ig- ]
[nored unless you are responding to an explicit request from a ]
[developer. Reply only with text; DO NOT SEND ATTACHMENTS! ]
