Bug 33078 - Mixing "+" and non-"+" options in <Directory> result in strange behavour
Summary: Mixing "+" and non-"+" options in <Directory> result in strange behavour
Alias: None
Product: Apache httpd-2
Classification: Unclassified
Component: Runtime Config (show other bugs)
Version: 2.0.52
Hardware: PC Linux
: P2 minor (vote)
Target Milestone: ---
Assignee: Apache HTTPD Bugs Mailing List
Keywords: PatchAvailable
Depends on:
Reported: 2005-01-13 09:34 UTC by Davide Bianchi
Modified: 2010-12-28 10:57 UTC (History)
1 user (show)

Reject option combinations that (at best) don't make much sense. (2.50 KB, patch)
2008-04-02 03:00 UTC, Sönke Tesch
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Davide Bianchi 2005-01-13 09:34:17 UTC
If you mix "+" and non-"+" options in a <Directory> block most of the time the
'+' options are ignored. Example:

<Directory "/some/dir">
     Options +Indexes FollowSymLinks

Will result in only the 'FollowSymLinks' option to be used.
I think that the problem lay in the code that process the options.
The solution is pretty simple: never mix the options.
However, the config test doesn't report any problem with this configuration.
Comment 1 Paul Querna 2005-06-03 01:11:29 UTC
We really need beter documentation on how _evil_ this behavoir is!
Comment 2 Rich Bowen 2005-10-31 12:22:17 UTC
Well, yes, we could just document this. This seems like a little bit of a
cop-out. My preference would be that if someone mixes +/- and bare word options,
we fail configtest and make them go fix it. I'll do the documentation bit, but I
don't believe that fixes it.
Comment 3 Rich Bowen 2005-11-03 02:46:23 UTC
I have "fixed this in documentation" for the Options directive. However, I
really don't believe that this fixes it, particularly since several Linux
distros ship with this very broken syntax in their default config files. We need
to throw a configtest error for this, IMHO.
Comment 4 Joshua Slive 2007-07-31 12:05:52 UTC
Docs fixed, suggestion of a runtime warning goes to a different category.
Comment 5 Sönke Tesch 2008-04-02 03:00:13 UTC
Created attachment 21764 [details]
Reject option combinations that (at best) don't make much sense.

Attached patch enforces the following:

- Either merge-options or non-merge-options may be used, i.e. you cannot mix '+a' or '-a' with 'a' options anymore. The result in these cases has always been undefined and probably cannot be defined anyway.
Exception: 'All -a' or 'None +a' (but not '+a None', see below), in order to conveniently 'set all options except this'.

- Options All and None may not be used as mergers, i.e. reject +All, -All, +None, -None. There's no use in these options, '+a +b +All' is 'All', '+a +b -All' is 'None', and who would want to add or remove just nothing?

- All and None must be the first option given. 'a b All' is equal to 'All', and 'Indexes None' has at best an undefined result, it might be 'Indexes' as well as 'None' (and, by implementation, is 'None').
Comment 6 Joshua Slive 2008-04-02 07:45:30 UTC
I like the idea, but this can never go into 2.2, since I'm sure there are many people relying on the bizarre misbehaviors of Options on current sites.

I'd suggest just changing the error messages to warnings and tacking on "Proceeding with undefined results." or something like that. Otherwise, I don't have a problem with a patch like this going into 2.next.
Comment 7 Dan Poirier 2009-05-22 08:20:18 UTC
It seems like a good idea to at least make this change in trunk.  People will have to update their configs when they move to the next release anyway, and it will head off problems.
Comment 9 Igor Galić 2010-12-28 10:57:07 UTC