https://bz.apache.org/bugzilla/show_bug.cgi?id=66374

--- Comment #8 from Michael Orlitzky <[email protected]> ---
My actual use case didn't involve Error, but ServerAlias. "Error" was just to
obtain a minimal reproducible case. See bug #63146 for another real use case.

And as far as "Error" is concerned... the documentation includes the example,

  # ensure that exactly one of SSL,NOSSL is defined
  <IfDefine SSL>
  <IfDefine NOSSL>
    Error "Both SSL and NOSSL are defined.  Define only one of them."
  </IfDefine>
  </IfDefine>

which already implies that "Error" won't be executed if it's enclosed in a
conditional that evaluates false. I don't think making the same assumption
about <If> is too much of a stretch.

Regardless, the fundamental issue with <If> is that the user's config says one
thing, but apache (quietly) ignores it and loads something else. In my case,
either Error or ServerAlias get executed unconditionally, i.e. apache ignores
the <If> entirely. In bug #63146, both Define statements that were intended to
be mutually exclusive are executed.

I'm sure the technical details are a mess, but silently proceeding with a
runtime config that (given what the user obviously intended) is so completely
counter-intuituve is the worst possible failure mode for such a
misconfiguation.

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to