Re: svn commit: r1526666 - in /httpd/httpd/trunk: CHANGES docs/log-message-tags/next-number server/mpm/winnt/child.c server/mpm/winnt/mpm_winnt.c server/mpm/winnt/mpm_winnt.h

2013-09-27 Thread Ivan Zhakov
On 27 September 2013 00:08, wrote: > Author: trawick > Date: Thu Sep 26 20:08:33 2013 > New Revision: 152 > > URL: http://svn.apache.org/r152 > Log: > WinNT MPM: Exit the child if the parent process crashes or is terminated. > > Submitted by: Oracle, via trawick > > The original modificat

Re: [PATCH 49220] mod_fcgid - restrict arbitrary command execution from .htaccess files

2013-09-27 Thread Jeff Trawick
On Fri, Sep 20, 2013 at 4:31 PM, Benjamin Coddington wrote: > Hello everyone, > > We're looking at moving our shared hosting execution behind mod_fcgid and > suexec, but we need to continue to allow our users .htaccess 'Files' > overrides. The current mod_fcgid allows users to execute arbitrary >

Re: [PATCH 55593] Add "SSLServerInfoFile" directive

2013-09-27 Thread Kaspar Brand
On 26.09.2013 23:59, Trevor Perrin wrote: > It doesn't work with filenames relative to the Apache root. The patch > I submitted uses ssl_engine_config.c:ssl_cmd_check_file() to map > relative to absolute filenames. I'm not sure how you'd do that with > SSLOpenSSLConfCmd? It could probably be han

Re: [PATCH 49220] mod_fcgid - restrict arbitrary command execution from .htaccess files

2013-09-27 Thread Benjamin Coddington
On Sep 27, 2013, at 8:41 AM, Jeff Trawick wrote: > On Fri, Sep 20, 2013 at 4:31 PM, Benjamin Coddington wrote: > >> Hello everyone, >> >> We're looking at moving our shared hosting execution behind mod_fcgid and >> suexec, but we need to continue to allow our users .htaccess 'Files' >> override

Re: [PATCH 49220] mod_fcgid - restrict arbitrary command execution from .htaccess files

2013-09-27 Thread Benjamin Coddington
On Sep 27, 2013, at 1:50 PM, Benjamin Coddington wrote: > since I'll now need to generate a large number of > AllowOverrideList configurations in order to implement this across our > hosting - which requires I walk our modules to find all the directives in > FileInfo and explicitly allow them to

Re: [PATCH 55593] Add "SSLServerInfoFile" directive

2013-09-27 Thread Trevor Perrin
On Fri, Sep 27, 2013 at 9:16 AM, Kaspar Brand wrote: > On 26.09.2013 23:59, Trevor Perrin wrote: >> It doesn't work with filenames relative to the Apache root. The patch >> I submitted uses ssl_engine_config.c:ssl_cmd_check_file() to map >> relative to absolute filenames. I'm not sure how you'd