httpd-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Jean-Michel Vourgère" <>
Subject htdigest -c
Date Sun, 05 Feb 2012 13:52:41 GMT

I was helping triaging apache2 bugs reports in Debian and found that one:

> Running "htdigest -c <file> <domain> <user>" provides inconsistent
> results, sometimes removing entries for this or another <user> and
> othertimes doubling up entries for <user>. I suggest that invoking the
> command in this way with the -c flag should cause the programme to bail
> out if the file <file> already exists.

First, there really is a bug with -c parameter, which behaviour is inconsistent.

Man page says:
-c     Create  the  passwdfile.  If  passwdfile  already  exists, it is
              deleted first.

This is a regression introduced 11 years ago:

file was truncated fopen("w") and now it is no more, since we use
apr_file_open(APR_WRITE | APR_CREATE)

It is missing APR_TRUNCATE

You can reproduce with
$ htdigest -c ~/toto realm nirgal # file created
$ htdigest ~/toto realm nirgal2 # second entry added
$ htdigest -c ~/toto realm nirgal # file should be truncated. It's not.
$ wc -l ~/toto
3 /home/nirgal/toto

Patch is available at:;filename=564722.diff;att=1;bug=564722

However, bug repported suggest -c should fail if file exists.

It makes sense to forbid file truncation of existing file, but it is opposition to man description,
to htpasswd -c behavior, and it might break a few scripts.

What is your feeling about that wish?

View raw message