[Bug 28657] mod_negotiation should not store Content-Location header as an error header

2018-12-05 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=28657

--- Comment #17 from Michael Gere  ---
Hi all, 

Despite the bugs, i prefer apache to nginx.

I use web server apache on all my sites like : https://www.levelsanswers.com/";>Levelsanswers

all works fine so thank you for your job.

Regards.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-
To unsubscribe, e-mail: bugs-unsubscr...@httpd.apache.org
For additional commands, e-mail: bugs-h...@httpd.apache.org



[Bug 61355] DirectorySlash directive should use protocol in X-Forwarded-Proto header when available

2018-12-05 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=61355

Axel Reinhold  changed:

   What|Removed |Added

 CC||apa...@freakout.de

--- Comment #1 from Axel Reinhold  ---
Created attachment 36295
  --> https://bz.apache.org/bugzilla/attachment.cgi?id=36295&action=edit
Bug 61355 - make http_scheme use X-Forwarded-Proto header

As DirectorySlash honors the scheme given in ServerName the scheme in
http_scheme() from http_core.c should respect X-Forwarded-Proto header instead
of fixing mod_dir.c for this bug. This has been implemented in the attached
patch. Should also be mentioned in the doc. Add respect of X-Forwarded-Proto to
http_scheme() instead of fixing mod_dir

-- 
You are receiving this mail because:
You are the assignee for the bug.
-
To unsubscribe, e-mail: bugs-unsubscr...@httpd.apache.org
For additional commands, e-mail: bugs-h...@httpd.apache.org



[Bug 62983] New: apache latest version cause segmentation fault when enable php5 and php7 in the same time

2018-12-05 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=62983

Bug ID: 62983
   Summary: apache latest version cause segmentation fault when
enable php5 and php7 in the same time
   Product: Apache httpd-2
   Version: 2.4.37
  Hardware: All
OS: All
Status: NEW
  Severity: trivial
  Priority: P2
 Component: All
  Assignee: bugs@httpd.apache.org
  Reporter: dinhbao...@gmail.com
  Target Milestone: ---

Created attachment 36294
  --> https://bz.apache.org/bugzilla/attachment.cgi?id=36294&action=edit
poc in apache 2.4.37

all info please download the vagrant box:
https://drive.google.com/file/d/1uQELpsiBaXOAZpXtcHDdciZ_waXHShi8/view?usp=sharing

-- 
You are receiving this mail because:
You are the assignee for the bug.
-
To unsubscribe, e-mail: bugs-unsubscr...@httpd.apache.org
For additional commands, e-mail: bugs-h...@httpd.apache.org



[Bug 55348] mod_remoteip updates the "ip" (%a), but "host" (%h) still reflects the connection's ip

2018-12-05 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=55348

--- Comment #11 from William A. Rowe Jr.  ---
It appears I fixed this some time ago in
http://svn.apache.org/viewvc?rev=1730129&view=rev
which reads more cleanly than the patch above.

Proposed for backport.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-
To unsubscribe, e-mail: bugs-unsubscr...@httpd.apache.org
For additional commands, e-mail: bugs-h...@httpd.apache.org



Re: [Bug 45187] Long File name requests gives FORBIDDEN response

2018-12-05 Thread William A Rowe Jr
In response to #32, Luca, this behavior is understood and clarified in the
above
comments; it is an open question how to respond to APR_ENAMETOOLONG.
Will treating this as a not-found case introduce security risks? That's the
question.

On Sat, Dec 1, 2018 at 2:52 AM  wrote:

> https://bz.apache.org/bugzilla/show_bug.cgi?id=45187
>
> --- Comment #32 from Luca Toscano  ---
> Hi Roman,
>
> have you tried to modify
> http://httpd.apache.org/docs/2.4/mod/core.html#limitrequestline ?
>
> --
> You are receiving this mail because:
> You are the assignee for the bug.
> -
> To unsubscribe, e-mail: bugs-unsubscr...@httpd.apache.org
> For additional commands, e-mail: bugs-h...@httpd.apache.org
>
>


[Bug 55348] mod_remoteip updates the "ip" (%a), but "host" (%h) still reflects the connection's ip

2018-12-05 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=55348

--- Comment #10 from msporleder  ---
okay was that test sufficient?

-- 
You are receiving this mail because:
You are the assignee for the bug.
-
To unsubscribe, e-mail: bugs-unsubscr...@httpd.apache.org
For additional commands, e-mail: bugs-h...@httpd.apache.org



[Bug 55348] mod_remoteip updates the "ip" (%a), but "host" (%h) still reflects the connection's ip

2018-12-05 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=55348

--- Comment #9 from William A. Rowe Jr.  ---
Yes, the auth phase should follow the translation by mod_remoteip, so the auth
require can be based on the trusted x-f-f: header.

The logic is written to get at the hostname, even if it wasn't previously
looked up as part of an auth transaction. (Without cgi, auth etc, it needs to
be entirely possible to fulfill a connection without ever performing a
connection or x-f-f: reverse name lookup.)

-- 
You are receiving this mail because:
You are the assignee for the bug.
-
To unsubscribe, e-mail: bugs-unsubscr...@httpd.apache.org
For additional commands, e-mail: bugs-h...@httpd.apache.org