Skip to content

Commit 4cc2782

Browse files
committed
core: Disallow Methods' registration at run time (.htaccess), they may be
used only if registered at init time (httpd.conf). Calling ap_method_register() in children processes is not the right scope since it won't be shared for all requests. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1807655 13f79535-47bb-0310-9956-ffa450edef68
1 parent 2483191 commit 4cc2782

File tree

2 files changed

+9
-0
lines changed

2 files changed

+9
-0
lines changed

Diff for: CHANGES

+3
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,9 @@
11
-*- coding: utf-8 -*-
22
Changes with Apache 2.5.0
33

4+
*) core: Disallow Methods' registration at runtime (.htaccess), they may be
5+
used only if registered at init time (httpd.conf). [Yann Ylavic]
6+
47
*) mod_md: v0.9.1:
58
- various fixes in MDRenewWindow handling when specifying percent. Serialization changed. If
69
someone already used percent configurations, it is advised to change these to a new value,

Diff for: server/core.c

+6
Original file line numberDiff line numberDiff line change
@@ -2331,6 +2331,12 @@ AP_CORE_DECLARE_NONSTD(const char *) ap_limit_section(cmd_parms *cmd,
23312331
/* method has not been registered yet, but resource restriction
23322332
* is always checked before method handling, so register it.
23332333
*/
2334+
if (cmd->pool == cmd->temp_pool) {
2335+
/* In .htaccess, we can't globally register new methods. */
2336+
return apr_psprintf(cmd->pool, "Could not register method '%s' "
2337+
"for %s from .htaccess configuration",
2338+
method, cmd->cmd->name);
2339+
}
23342340
methnum = ap_method_register(cmd->pool,
23352341
apr_pstrdup(cmd->pool, method));
23362342
}

0 commit comments

Comments
 (0)