From: Paul Querna <pquerna@apache.org>
Date: Sat, 1 Apr 2006 06:48:43 +0000 (+0000)
Subject: Merge r382147 from trunk:
X-Git-Tag: 2.2.1~16
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=8125ead0179d0cde5946e22a5fff1afc43d5b4e9;p=thirdparty%2Fapache%2Fhttpd.git

Merge r382147 from trunk:
  APR_FILEPATH_NOTABOVEROOT was undefined with a left-hand NULL
  or empty path.  The SECUREROOTPATH and NOTABSOLUTE tests were
  sufficient for this application.  Adjusts for a bug in earlier
  versions of APR with this undefined value.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@390606 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/STATUS b/STATUS
index 206e11f218d..a759aebdee0 100644
--- a/STATUS
+++ b/STATUS
@@ -83,14 +83,6 @@ PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
          Trunk version of patch works
       +1: rpluem, jim, pquerna
 
-    * mod_include:  APR_FILEPATH_NOTABOVEROOT was undefined with
-      a left-hand NULL or empty path.  The SECUREROOTPATH and 
-      NOTABSOLUTE tests are sufficient for this application.  
-      Adjust for this bug in earlier versions of APR that mishandled
-      the NOTABOVEROOT flag with an empty left hand value.
-        http://svn.apache.org/viewcvs?rev=382147&view=rev
-      +1: wrowe, bnicholes, pquerna
-
 PATCHES PROPOSED TO BACKPORT FROM TRUNK:
 
     * mod_dbd: When threaded, create a private pool in child_init
diff --git a/modules/filters/mod_include.c b/modules/filters/mod_include.c
index 757bad3c9b2..c28fb82f779 100644
--- a/modules/filters/mod_include.c
+++ b/modules/filters/mod_include.c
@@ -1539,7 +1539,6 @@ static int find_file(request_rec *r, const char *directive, const char *tag,
 
         /* be safe; only files in this directory or below allowed */
         rv = apr_filepath_merge(&newpath, NULL, tag_val,
-                                APR_FILEPATH_NOTABOVEROOT |
                                 APR_FILEPATH_SECUREROOTTEST |
                                 APR_FILEPATH_NOTABSOLUTE, r->pool);
 
@@ -1655,7 +1654,6 @@ static apr_status_t handle_include(include_ctx_t *ctx, ap_filter_t *f,
 
             /* be safe; only files in this directory or below allowed */
             rv = apr_filepath_merge(&newpath, NULL, parsed_string,
-                                    APR_FILEPATH_NOTABOVEROOT |
                                     APR_FILEPATH_SECUREROOTTEST |
                                     APR_FILEPATH_NOTABSOLUTE, ctx->dpool);