Processed: Re: Bug#252627: apache: environment cleaning not useful

2004-06-04 Thread Debian Bug Tracking System
Processing commands for [EMAIL PROTECTED]:

> severity 252627 wishlist
Bug#252627: apache: environment cleaning not useful
Severity set to `wishlist'.

> tags 252627 wontfix
Bug#252627: apache: environment cleaning not useful
There were no tags set.
Tags added: wontfix

> stop
Stopping processing here.

Please contact me if you need assistance.

Debian bug tracking system administrator
(administrator, Debian Bugs database)




Re: Bug#252627: apache: environment cleaning not useful

2004-06-04 Thread Fabio Massimo Di Nitto
severity 252627 wishlist
tags 252627 wontfix
stop

On Fri, 4 Jun 2004, Richard W.M. Jones wrote:

> Package: apache
> Version: 1.3.29.0.2-4
> Severity: normal
>
> After getting the latest Apache, I found that passing environment
> variables to the server from the command line no longer works.  This
> is the changelog:
>
> - More init scripts cleanup. It shouldn't leak environment information
>   (Closes: #229653, #230991)
>
> Unfortunately this isn't very useful behaviour.  I routinely set
> PGHOST to select development database.  Now there is no useful way to
> pass this from the command line to Apache.  (Adding it to
> /etc/apache/local.conf using SetEnv doesn't work because mod_env runs
> too late).
>
> As another example it makes the PassEnv directive completely useless.
>

Leaking environment information can disclose sensible information about
the server. This bug will not be fixed.

Fabio

-- 
 fajita: step one
 Whatever the problem, step one is always to look in the error log.
 fajita: step two
 When in danger or in doubt, step two is to scream and shout.




Bug#252627: apache: environment cleaning not useful

2004-06-04 Thread Richard W.M. Jones
Package: apache
Version: 1.3.29.0.2-4
Severity: normal

After getting the latest Apache, I found that passing environment
variables to the server from the command line no longer works.  This
is the changelog:

- More init scripts cleanup. It shouldn't leak environment information
  (Closes: #229653, #230991)

Unfortunately this isn't very useful behaviour.  I routinely set
PGHOST to select development database.  Now there is no useful way to
pass this from the command line to Apache.  (Adding it to
/etc/apache/local.conf using SetEnv doesn't work because mod_env runs
too late).

As another example it makes the PassEnv directive completely useless.

-- System Information:
Debian Release: testing/unstable
  APT prefers testing
  APT policy: (650, 'testing')
Architecture: i386 (i686)
Kernel: Linux 2.6.6
Locale: LANG=C, LC_CTYPE=C

Versions of packages apache depends on:
ii  apache-common   1.3.29.0.2-4 Support files for all Apache webse
ii  debconf 1.4.25   Debian configuration management sy
ii  dpkg1.10.21  Package maintenance system for Deb
ii  libc6   2.3.2.ds1-12 GNU C Library: Shared libraries an
ii  libdb4.24.2.52-16Berkeley v4.2 Database Libraries [
ii  libexpat1   1.95.6-8 XML parsing C library - runtime li
ii  libmagic1   4.07-2   File type determination library us
ii  libpam0g0.76-21  Pluggable Authentication Modules l
ii  logrotate   3.6.5-2  Log rotation utility
ii  mime-support3.26-1   MIME files 'mime.types' & 'mailcap
ii  perl5.8.3-3  Larry Wall's Practical Extraction 

-- debconf information:
* apache/enable-suexec: false
* apache/server-name: localhost
* apache/document-root: /var/www
* apache/server-port: 80
* apache/init: true
* apache/server-admin: [EMAIL PROTECTED]