* Do not allow all options of ALL to be set when only a few of them are

  allowed.

PR: 44262
Submitted by: Michał Grzędzicki <lazy iq.pl>
Reviewed by: rpluem

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@652885 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/CHANGES b/CHANGES
index 58ca77c3cce79c9c6905da1d4717b8d026b7a5b1..2f6c4245659e6f42d0da9d94fcc94a8869e41abd 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -2,6 +2,10 @@
 Changes with Apache 2.3.0
 [ When backported to 2.2.x, remove entry from this file ]
 
+
+  *) core: Do not allow Options ALL if not all options are allowed to be
+     overwritten. PR 44262 [Michał Grzędzicki <lazy iq.pl>]
+
   *) ap_cache_cacheable_headers_out() will (now) always
      merge an error heaeders _before_ clearing them and _before_
      merging in the actual entity headers and doing normal

diff --git a/server/core.c b/server/core.c
index 3542d8abf57856b7d012ce1f502e014674656853..955a8fe76edac0b6078ef292fad7805bf3d8ca26 100644 (file)
--- a/server/core.c
+++ b/server/core.c
@@ -1434,7 +1434,7 @@ static const char *set_options(cmd_parms *cmd, void *d_, const char *l)
             return apr_pstrcat(cmd->pool, "Illegal option ", w, NULL);
         }
 
-        if (!(cmd->override_opts & opt) && opt != OPT_NONE) {
+        if ( (cmd->override_opts & opt) != opt ) {
             return apr_pstrcat(cmd->pool, "Option ", w, " not allowed here", NULL);
         }
         else if (action == '-') {