make trailing-slash-behaviour configurable

Reviewed by: Justin Erenkrantz, Jeff Trawick

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/APACHE_2_0_BRANCH@104666 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/CHANGES b/CHANGES
index b2815c5e22ae2fc2d04b5ac1562918d13c49f4d3..bea2c20c7cff3756b7e4d3cef09de579f8821c9a 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,8 @@
 Changes with Apache 2.0.51
 
+  *) mod_dir: the trailing-slash behaviour is now configurable using the
+     DirectorySlash directive.  [André Malo]
+
   *) Allow proxying of resources that are invoked via DirectoryIndex.
      PR 14648, 15112, 29961.  [André Malo]
 

diff --git a/STATUS b/STATUS
index 5c8173805704543d9dd26ccd7f6963747bdb20f9..844827b7d2d0148efbed5a6f984da062af89df58 100644 (file)
--- a/STATUS
+++ b/STATUS
@@ -1,5 +1,5 @@
 APACHE 2.0 STATUS:                                              -*-text-*-
-Last modified at [$Date: 2004/08/15 21:35:15 $]
+Last modified at [$Date: 2004/08/15 21:59:57 $]
 
 Release:
 
@@ -152,11 +152,6 @@ PATCHES TO BACKPORT FROM 2.1
        <http://www.apache.org/~clar/detach-addrspace_APR_0_9.patch>
        +1: jjclar, bnicholes
 
-    *) mod_dir: Backport DirectorySlash directive to work around problems
-       with <Location>-SetHandler combinations and trailing slash redirects.
-         modules/mappers/mod_dir.c: r1.48
-       +1: nd, jerenkrantz, trawick
-
     *) mod_ssl: Remove some unused functions (after CAN-2004-0488 fix is applied)
        http://cvs.apache.org/viewcvs.cgi/httpd-2.0/modules/ssl/ssl_util.c?r1=1.46&r2=1.47
        +1: jorton

diff --git a/docs/manual/mod/mod_dir.xml b/docs/manual/mod/mod_dir.xml
index 9db0807efeff20a48b7240f07f1fea531c43e4a4..4adb36a3717663a356a34a3f7c5155b1526ea991 100644 (file)
--- a/docs/manual/mod/mod_dir.xml
+++ b/docs/manual/mod/mod_dir.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0"?>
 <!DOCTYPE modulesynopsis SYSTEM "../style/modulesynopsis.dtd">
 <?xml-stylesheet type="text/xsl" href="../style/manual.en.xsl"?>
-<!-- $Revision: 1.4.2.4 $ -->
+<!-- $Revision: 1.4.2.5 $ -->
 
 <!--
  Copyright 2002-2004 The Apache Software Foundation
@@ -96,4 +96,58 @@ a directory</description>
 </usage>
 </directivesynopsis>
 
+<directivesynopsis>
+<name>DirectorySlash</name>
+<description>Toggle trailing slash redirects on or off</description>
+<syntax>DirectorySlash On|Off</syntax>
+<default>DirectorySlash On</default>
+<contextlist><context>server config</context><context>virtual host</context>
+<context>directory</context><context>.htaccess</context></contextlist>
+<override>Indexes</override>
+<compatibility>Available in version 2.1 and later</compatibility>
+
+<usage>
+    <p>The <directive>DirectorySlash</directive> directive determines, whether
+    <module>mod_dir</module> should fixup URLs pointing to a directory or
+    not.</p>
+
+    <p>Typically if a user requests a resource without a trailing slash, which
+    points to a directory, <module>mod_dir</module> redirects him to the same
+    ressource, but <em>with</em> trailing slash for some good reasons:</p>
+
+    <ul>
+    <li>The user is finally requesting the canonical URL of the resource</li>
+    <li><module>mod_autoindex</module> works correctly. Since it doesn't emit
+    the path in the link, it would point to the wrong path.</li>
+    <li><directive module="mod_dir">DirectoryIndex</directive> will be evaluated
+    <em>only</em> for directories requested with trailing slash.</li>
+    <li>Relative URL references inside html pages will work correctly.</li>
+    </ul>
+
+    <p>Well, if you don't want this effect <em>and</em> the reasons above don't
+    apply to you, you can turn off the redirect with:</p>
+
+    <example>
+        # see security warning below!<br />
+        &lt;Location /some/path&gt;<br />
+        <indent>
+            DirectorySlash Off<br />
+            SetHandler some-handler<br />
+        </indent>
+        &lt;/Location&gt;
+    </example>
+
+    <note type="warning"><title>Security Warning</title>
+    <p>Turning off the trailing slash redirect may result in an information
+    disclosure. Consider a situation where <module>mod_autoindex</module> is
+    active (<code>Options +Indexes</code>) and <directive module="mod_dir"
+    >DirectoryIndex</directive> is set to a valid resource (say,
+    <code>index.html</code>) and there's no other special handler defined for
+    that URL. In this case a request with a trailing slash would show the
+    <code>index.html</code> file. <strong>But a request without trailing slash
+    would list the directory contents</strong>.</p>
+    </note>
+</usage>
+</directivesynopsis>
+
 </modulesynopsis>

diff --git a/modules/mappers/mod_dir.c b/modules/mappers/mod_dir.c
index 8bd5b9e60b64cb984b0b51fe6e7ae01c8d3fa498..c6e7f0d506417cdcfd9a43ac57e8b1fef7d7e512 100644 (file)
--- a/modules/mappers/mod_dir.c
+++ b/modules/mappers/mod_dir.c
@@ -30,8 +30,15 @@
 
 module AP_MODULE_DECLARE_DATA dir_module;
 
+typedef enum {
+    SLASH_OFF = 0,
+    SLASH_ON,
+    SLASH_UNSET
+} slash_cfg;
+
 typedef struct dir_config_struct {
     apr_array_header_t *index_names;
+    slash_cfg do_slash;
 } dir_config_rec;
 
 #define DIR_CMD_PERMS OR_INDEXES
@@ -47,10 +54,20 @@ static const char *add_index(cmd_parms *cmd, void *dummy, const char *arg)
     return NULL;
 }
 
+static const char *configure_slash(cmd_parms *cmd, void *d_, int arg)
+{
+    dir_config_rec *d = d_;
+
+    d->do_slash = arg ? SLASH_ON : SLASH_OFF;
+    return NULL;
+}
+
 static const command_rec dir_cmds[] =
 {
     AP_INIT_ITERATE("DirectoryIndex", add_index, NULL, DIR_CMD_PERMS,
                     "a list of file names"),
+    AP_INIT_FLAG("DirectorySlash", configure_slash, NULL, DIR_CMD_PERMS,
+                 "On or Off"),
     {NULL}
 };
 
@@ -59,6 +76,7 @@ static void *create_dir_config(apr_pool_t *p, char *dummy)
     dir_config_rec *new = apr_pcalloc(p, sizeof(dir_config_rec));
 
     new->index_names = NULL;
+    new->do_slash = SLASH_UNSET;
     return (void *) new;
 }
 
@@ -69,6 +87,8 @@ static void *merge_dir_configs(apr_pool_t *p, void *basev, void *addv)
     dir_config_rec *add = (dir_config_rec *)addv;
 
     new->index_names = add->index_names ? add->index_names : base->index_names;
+    new->do_slash =
+        (add->do_slash == SLASH_UNSET) ? base->do_slash : add->do_slash;
     return new;
 }
 
@@ -95,11 +115,18 @@ static int fixup_dir(request_rec *r)
         return DECLINED;
     }
 
+    d = (dir_config_rec *)ap_get_module_config(r->per_dir_config,
+                                               &dir_module);
+
     /* Redirect requests that are not '/' terminated */
     if (r->uri[0] == '\0' || r->uri[strlen(r->uri) - 1] != '/') 
     {
         char *ifile;
 
+        if (!d->do_slash) {
+            return DECLINED;
+        }
+
         /* Only redirect non-get requests if we have no note to warn
          * that this browser cannot handle redirs on non-GET requests 
          * (such as Microsoft's WebFolders). 
@@ -127,9 +154,6 @@ static int fixup_dir(request_rec *r)
         return DECLINED;
     }
 
-    d = (dir_config_rec *)ap_get_module_config(r->per_dir_config,
-                                               &dir_module);
-
     if (d->index_names) {
         names_ptr = (char **)d->index_names->elts;
         num_names = d->index_names->nelts;