Bug 59636 - UserDir is not accepting more than one directory location
Summary: UserDir is not accepting more than one directory location
Status: NEW
Alias: None
Product: Apache httpd-2
Classification: Unclassified
Component: mod_userdir (show other bugs)
Version: 2.4.6
Hardware: PC Linux
: P1 minor (vote)
Target Milestone: ---
Assignee: Apache HTTPD Bugs Mailing List
URL:
Keywords: FixedInTrunk
Depends on:
Blocks:
 
Reported: 2016-05-26 18:37 UTC by mhruscak
Modified: 2018-07-09 20:16 UTC (History)
0 users



Attachments
userdir.conf (283.75 KB, image/png)
2016-05-26 18:37 UTC, mhruscak
Details

Note You need to log in before you can comment on or make changes to this bug.
Description mhruscak 2016-05-26 18:37:35 UTC
Created attachment 33894 [details]
userdir.conf

Manual https://httpd.apache.org/docs/2.4/howto/public_html.html section "Setting the file path with UserDir" is described option about multiple directories, which can be add.
In my case, if there is 2 directories set, only first is accepted.

UserDir /home/*/bla public_html -first working, second is ignored

I have retested it using switching order to
UserDir public_html /home/*/bla -first working, second is ignored

Same behaviour using completely different dir, e.g. /virtual/user1/new_dir/index.html

OS Fedora 21
httpd installed directly using yum
selinux in permissive mode
both directories and home dir set to 711 perms
firefox without cache
used 2 different file names(index.html and ind.html)
Comment 1 Christophe JAILLET 2018-05-26 12:25:46 UTC
Confirmed.

Fixed in r1832306.

Previously we were checking only in the first *existing* directory, which is clearly not what is said in the doc.

> UserDir "public_html" "/usr/web" "http://www.example.com/"
>
> With a request for http://www.example.com/~bob/one/two.html, will try to find
> the page at ~bob/public_html/one/two.html first, then /usr/web/bob/one/two.html,
> and finally it will send a redirect to http://www.example.com/bob/one/two.html.
Comment 2 Luca Toscano 2018-07-08 16:12:52 UTC
Christophe, should we propose this for a 2.4.x backport?
Comment 3 Christophe JAILLET 2018-07-09 20:16:00 UTC
r1832306 does not seem to be complete enough.

If we go through the 'apr_uid_homepath_get' branch, and if it does NOT return SUCCESS, then filename would still be NULL, and we would certainly segfault in the apr_strcat call.

This should be reworded a bit before a backport proposal.