From: Rich Bowen <rbowen@apache.org>
Date: Thu, 4 Jun 2026 15:22:55 +0000 (+0000)
Subject: docs: Rewrite AllowOverride Options= warning
X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=c93f7a71e231a06244fd4df770f7cbe04bda4b08;p=thirdparty%2Fapache%2Fhttpd.git

docs: Rewrite AllowOverride Options= warning

The existing note about implicit disabling of Options was difficult
to parse. Rewrite as a type="warning" note with:
- Clear statement that the restriction controls enabling, not disabling
- Explanation of absolute vs relative (+/-) Options syntax
- Concrete example showing how inherited options get implicitly disabled

BZ#70099


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1934979 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/docs/manual/mod/core.xml b/docs/manual/mod/core.xml
index 307620e709..74c922a259 100644
--- a/docs/manual/mod/core.xml
+++ b/docs/manual/mod/core.xml
@@ -479,14 +479,35 @@ NoDecode option available in 2.3.12 and later.</compatibility>
       followed by a comma-separated list, without spaces, of options that
       may be set using the <directive module="core">Options</directive> directive.
 
-      <note><title>Implicit disabling of Options</title>
-      <p>Even though the list of options that may be used in .htaccess files
-         can be limited with this directive, as long as any <directive
-         module="core">Options</directive> directive is allowed any
-         other inherited option can be disabled by using the non-relative
-         syntax.  In other words, this mechanism cannot force a specific option
-         to remain <em>set</em> while allowing any others to be set.
-      </p></note>
+      <note type="warning"><title>Implicit disabling of Options</title>
+      <p>This restriction only controls which options a
+         <code>.htaccess</code> file may <em>enable</em>. It does not
+         prevent inherited options from being <em>disabled</em>.</p>
+
+      <p>When a <directive module="core">Options</directive> directive
+         in <code>.htaccess</code> uses absolute syntax (without
+         <code>+</code> or <code>-</code> prefixes), it <em>replaces</em>
+         the entire inherited option set. Any previously active options
+         not listed are implicitly turned off&mdash;even options that are
+         not in the <code>AllowOverride</code> permitted list.</p>
+
+      <p>For example, if the server configuration sets:</p>
+      <highlight language="config">
+Options Indexes FollowSymLinks ExecCGI
+AllowOverride Options=Indexes
+      </highlight>
+      <p>and a <code>.htaccess</code> file contains:</p>
+      <highlight language="config">
+Options Indexes
+      </highlight>
+      <p>then <code>FollowSymLinks</code> and <code>ExecCGI</code> are
+         implicitly disabled for that directory, even though the
+         <code>AllowOverride</code> line only permits setting
+         <code>Indexes</code>.</p>
+
+      <p>In short, this mechanism cannot force a specific option to
+         remain <em>set</em> while allowing any others to be set.</p>
+      </note>
 
       <highlight language="config">
       AllowOverride Options=Indexes,MultiViews