Merge r382147 from trunk:

  APR_FILEPATH_NOTABOVEROOT was undefined with a left-hand NULL
  or empty path.  The SECUREROOTPATH and NOTABSOLUTE tests were
  sufficient for this application.  Adjusts for a bug in earlier
  versions of APR with this undefined value.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@390606 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/STATUS b/STATUS
index 206e11f218da2dbe6e992c2a1bd3aa1a236b495f..a759aebdee049f6822f38f5faf396ce2d7b42335 100644 (file)
--- a/STATUS
+++ b/STATUS
@@ -83,14 +83,6 @@ PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
          Trunk version of patch works
       +1: rpluem, jim, pquerna
 
-    * mod_include:  APR_FILEPATH_NOTABOVEROOT was undefined with
-      a left-hand NULL or empty path.  The SECUREROOTPATH and 
-      NOTABSOLUTE tests are sufficient for this application.  
-      Adjust for this bug in earlier versions of APR that mishandled
-      the NOTABOVEROOT flag with an empty left hand value.
-        http://svn.apache.org/viewcvs?rev=382147&view=rev
-      +1: wrowe, bnicholes, pquerna
-
 PATCHES PROPOSED TO BACKPORT FROM TRUNK:
 
     * mod_dbd: When threaded, create a private pool in child_init

diff --git a/modules/filters/mod_include.c b/modules/filters/mod_include.c
index 757bad3c9b2c6703ce994522c11a62c88e35832b..c28fb82f7791534b80d07bf2f4c6e6dd22ef1ba3 100644 (file)
--- a/modules/filters/mod_include.c
+++ b/modules/filters/mod_include.c
@@ -1539,7 +1539,6 @@ static int find_file(request_rec *r, const char *directive, const char *tag,
 
         /* be safe; only files in this directory or below allowed */
         rv = apr_filepath_merge(&newpath, NULL, tag_val,
-                                APR_FILEPATH_NOTABOVEROOT |
                                 APR_FILEPATH_SECUREROOTTEST |
                                 APR_FILEPATH_NOTABSOLUTE, r->pool);
 
@@ -1655,7 +1654,6 @@ static apr_status_t handle_include(include_ctx_t *ctx, ap_filter_t *f,
 
             /* be safe; only files in this directory or below allowed */
             rv = apr_filepath_merge(&newpath, NULL, parsed_string,
-                                    APR_FILEPATH_NOTABOVEROOT |
                                     APR_FILEPATH_SECUREROOTTEST |
                                     APR_FILEPATH_NOTABSOLUTE, ctx->dpool);