Re: "Forbid" directive in core?

2020-04-27 Thread Nick Kew
> On 27 Apr 2020, at 16:37, Eric Covener wrote: > > > Bumping a very old thread. tl;dr people are often surprised that when > Location sections have access control directives and overlap with the > filesystem it undoes the default > >Require all denied > We always warn against mixing

Re: "Forbid" directive in core?

2020-04-27 Thread Eric Covener
On Mon, Apr 27, 2020 at 12:14 PM Yann Ylavic wrote: > > On Mon, Apr 27, 2020 at 5:37 PM Eric Covener wrote: > > > > Bumping a very old thread. tl;dr people are often surprised that when > > Location sections have access control directives and overlap with the > > filesystem it undoes the

Re: "Forbid" directive in core?

2020-04-27 Thread Yann Ylavic
On Mon, Apr 27, 2020 at 5:37 PM Eric Covener wrote: > > Bumping a very old thread. tl;dr people are often surprised that when > Location sections have access control directives and overlap with the > filesystem it undoes the default > > Require all denied > Thanks for pointing at this, I

Re: "Forbid" directive in core?

2020-04-27 Thread Yehuda Katz
On Mon, Apr 27, 2020 at 11:37 AM Eric Covener wrote: > On Sat, Sep 28, 2013 at 12:21 PM Tim Bannister > wrote: > > The second time in a few days, I'm going to suggest adding an optional > parameter to a directive. > > > > Taking a leaf out of cascading stylesheets, how about “Forbidden On >

Re: "Forbid" directive in core?

2020-04-27 Thread Eric Covener
On Sat, Sep 28, 2013 at 12:21 PM Tim Bannister wrote: > > On 28 Sep 2013, at 14:19, Eric Covener wrote: > > > I've come back to this because I've struggled in another area with > > access_checker vs. access_checker_ex. I really think we need basic access > > control outside of Require and

Re: Forbid directive in core?

2013-09-29 Thread Stefan Fritsch
Am Samstag, 28. September 2013, 09:19:28 schrieb Eric Covener: I've come back to this because I've struggled in another area with access_checker vs. access_checker_ex. I really think we need basic access control outside of Require and Satisfy. I have a copy of the Forbidden directive in

Re: Forbid directive in core?

2013-09-28 Thread Eric Covener
I've come back to this because I've struggled in another area with access_checker vs. access_checker_ex. I really think we need basic access control outside of Require and Satisfy. I have a copy of the Forbidden directive in mod_authz_core and I am currrently allowing ON/OFF flags. * using a

Re: Forbid directive in core?

2013-09-28 Thread Tim Bannister
On 28 Sep 2013, at 14:19, Eric Covener cove...@gmail.com wrote: I've come back to this because I've struggled in another area with access_checker vs. access_checker_ex. I really think we need basic access control outside of Require and Satisfy. I have a copy of the Forbidden directive in

Re: Forbid directive in core?

2013-09-28 Thread Reindl Harald
Am 28.09.2013 18:21, schrieb Tim Bannister: On 28 Sep 2013, at 14:19, Eric Covener cove...@gmail.com wrote: I've come back to this because I've struggled in another area with access_checker vs. access_checker_ex. I really think we need basic access control outside of Require and Satisfy.

Re: Forbid directive in core?

2013-06-10 Thread Tim Bannister
On 10 Jun 2013, at 14:35, Eric Covener cove...@gmail.com wrote: I'd like to add an immutable Forbid directive to the core and use it in some places in the default configuration instead of require all denied. http://people.apache.org/~covener/forbid.diff This protects from a broad

Re: Forbid directive in core?

2013-06-10 Thread Nick Kew
On 10 Jun 2013, at 14:35, Eric Covener wrote: I'd like to add an immutable Forbid directive to the core and use it in some places in the default configuration instead of require all denied. http://people.apache.org/~covener/forbid.diff This protects from a broad Location or If being

RE: Forbid directive in core?

2013-06-10 Thread Plüm , Rüdiger , Vodafone Group
-Original Message- From: Nick Kew [mailto:n...@webthing.com] Sent: Montag, 10. Juni 2013 16:02 To: dev@httpd.apache.org Subject: Re: Forbid directive in core? On 10 Jun 2013, at 14:35, Eric Covener wrote: I'd like to add an immutable Forbid directive to the core and use

Re: Forbid directive in core?

2013-06-10 Thread Graham Leggett
On 10 Jun 2013, at 3:35 PM, Eric Covener cove...@gmail.com wrote: I'd like to add an immutable Forbid directive to the core and use it in some places in the default configuration instead of require all denied. http://people.apache.org/~covener/forbid.diff This protects from a broad

Re: Forbid directive in core?

2013-06-10 Thread Tim Bannister
On 10 Jun 2013, at 15:17, Graham Leggett minf...@sharp.fm wrote: On 10 Jun 2013, at 3:35 PM, Eric Covener cove...@gmail.com wrote: I'd like to add an immutable Forbid directive to the core and use it in some places in the default configuration instead of require all denied.

Re: Forbid directive in core?

2013-06-10 Thread Eric Covener
Why indeed in core? Started there because that's where AccessFileName lives.

Re: Forbid directive in core?

2013-06-10 Thread Stefan Fritsch
On Monday 10 June 2013, Tim Bannister wrote: On 10 Jun 2013, at 15:17, Graham Leggett minf...@sharp.fm wrote: On 10 Jun 2013, at 3:35 PM, Eric Covener cove...@gmail.com wrote: I'd like to add an immutable Forbid directive to the core and use it in some places in the default configuration

Re: Forbid directive in core?

2013-06-10 Thread Stefan Fritsch
On Monday 10 June 2013, Plüm, Rüdiger, Vodafone Group wrote: I'd like to add an immutable Forbid directive to the core and use it in some places in the default configuration instead of require all denied. http://people.apache.org/~covener/forbid.diff This protects from a