Changeset 1871

Timestamp:

06/15/2007 02:46:17 PM (15 months ago)

Author:

jan

Message:

check the URL twice, before and after path-info handling. (fixes #1230)

Location:

branches/lighttpd-1.4.x

Files:

• src/mod_access.c (modified) (4 diffs)
• tests/docroot/www/Makefile.am (modified) (1 diff)
• tests/docroot/www/index.html~ (added)
• tests/mod-access.t (modified) (2 diffs)
• tests/prepare.sh (modified) (1 diff)

branches/lighttpd-1.4.x/src/mod_access.c

@@ -112 +112 @@
 #undef PATCH
 
+/**
+ * URI handler
+ *
+ * we will get called twice:
+ * - after the clean up of the URL and 
+ * - after the pathinfo checks are done
+ *
+ * this handles the issue of trailing slashes
+ */
 URIHANDLER_FUNC(mod_access_uri_handler) {
         plugin_data *p = p_d;
@@ -123 +132 @@
         s_len = con->uri.path->used - 1;
 
+        if (con->conf.log_request_handling) {
+                log_error_write(srv, __FILE__, __LINE__, "s", 
+                                "-- mod_access_uri_handler called");
+        }
+
         for (k = 0; k < p->conf.access_deny->used; k++) {
                 data_string *ds = (data_string *)p->conf.access_deny->data[k];
                 int ct_len = ds->value->used - 1;
+                int denied = 0;
+
 
                 if (ct_len > s_len) continue;
-
                 if (ds->value->used == 0) continue;
 
@@ -135 +150 @@
                 if (con->conf.force_lowercase_filenames) {
                         if (0 == strncasecmp(con->uri.path->ptr + s_len - ct_len, ds->value->ptr, ct_len)) {
-                                con->http_status = 403;
-
-                                return HANDLER_FINISHED;
+                                denied = 1;
                         }
                 } else {
                         if (0 == strncmp(con->uri.path->ptr + s_len - ct_len, ds->value->ptr, ct_len)) {
-                                con->http_status = 403;
+                                denied = 1;
+                        }
+                }
 
-                                return HANDLER_FINISHED;
+                if (denied) {
+                        con->http_status = 403;
+
+                        if (con->conf.log_request_handling) {
+                                log_error_write(srv, __FILE__, __LINE__, "sb", 
+                                        "url denied as we match:", ds->value);
                         }
+
+                        return HANDLER_FINISHED;
                 }
         }
@@ -159 +181 @@
         p->init        = mod_access_init;
         p->set_defaults = mod_access_set_defaults;
-        p->handle_uri_clean  = mod_access_uri_handler;
+        p->handle_uri_clean = mod_access_uri_handler;
+        p->handle_subrequest_start  = mod_access_uri_handler;
         p->cleanup     = mod_access_free;
 

branches/lighttpd-1.4.x/tests/docroot/www/Makefile.am

@@ -2 +2 @@
            redirect.php cgi-pathinfo.pl get-env.php get-server-env.php \
            nph-status.pl prefix.fcgi get-header.pl ssi.shtml get-post-len.pl \
-           exec-date.shtml
+           exec-date.shtml index.html~
 SUBDIRS=go indexfile expire

branches/lighttpd-1.4.x/tests/mod-access.t

@@ -9 +9 @@
 use strict;
 use IO::Socket;
-use Test::More tests => 3;
+use Test::More tests => 4;
 use LightyTest;
 
@@ -24 +24 @@
 ok($tf->handle_http($t) == 0, 'forbid access to ...~');
 
+$t->{REQUEST}  = ( <<EOF
+GET /index.html~/ HTTP/1.0
+EOF
+ );
+$t->{RESPONSE} = [ { 'HTTP-Protocol' => 'HTTP/1.0', 'HTTP-Status' => 403 } ];
+ok($tf->handle_http($t) == 0, '#1230 - forbid access to ...~ - trailing slash');
+
 ok($tf->stop_proc == 0, "Stopping lighttpd");
 

branches/lighttpd-1.4.x/tests/prepare.sh

@@ -26 +26 @@
 cp $srcdir/docroot/www/*.html \
    $srcdir/docroot/www/*.php \
+   $srcdir/docroot/www/*.html~ \
    $srcdir/docroot/www/*.pl \
    $srcdir/docroot/www/*.fcgi \