https://bz.apache.org/bugzilla/show_bug.cgi?id=60946
--- Comment #4 from Jacob Champion <[email protected]> --- Yeah, this is a case where the design seems conceptually sound but the end user experience is not. I am agreed that we should not, from an architectural perspective, allow access to a resource if there are no modules positively indicating that authorization is granted. But from a user perspective, I'd argue that many people intend for Require not env disallowed to *be* a positive declaration: "Allow anyone who isn't explicitly disallowed." We should let users express this in a way that doesn't require five lines of boolean logic. (Well, I suppose we do, but it's not nearly as easy to parse: Require expr "-z %{reqenv:disallowed}" It's not intuitive that this check, which is effectively checking for the absence of something, is considered positive authorization, but `Require not` isn't.) <idle thoughts> Does part of the confusion stem from the fact that we are <RequireAny> by default instead of <RequireAll>? Switching that alone might make some things more intuitive. </idle thoughts> -- You are receiving this mail because: You are the assignee for the bug. --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
