Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: neutral (nike.apache.org: local policy)
Date: Fri, 16 Mar 2012 13:50:23 +0000
From: Nick Kew <nick@webthing.com>
To: dev@httpd.apache.org
Subject: Re: printing r->filename for access denied errors
Message-ID: <20120316135023.39c14f7b@baldur>
In-Reply-To: 
 <CALK=YjP5ZBX=wti6rG-+ZYJb4WarmWFz9pq1iVWvm2fd-LfzWw@mail.gmail.com>
References: 
 <CALK=YjP5ZBX=wti6rG-+ZYJb4WarmWFz9pq1iVWvm2fd-LfzWw@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit

On Fri, 16 Mar 2012 07:54:37 -0400
Eric Covener <covener@gmail.com> wrote:

> Seems like IRC users are often confused that permission denied errors
> include the URI only and not the filesystem path.
> 
> (They're convinced it's failing because httpd is looking in the wrong
> place for /index.html, or they think we forgot to add a documentroot,
> or have no idea where /foo/bar/baz is supposed to be in the
> filesystem)
> 
> Is there any harm in adding it?  This is the rv from a stat in the
> directory walk.

Yes, there is harm.  Exposing filesystem information will bring
in a flood of vulnerability reports.  Remember the kerfuffle we
had about inodes appearing in etags?

Maybe exposing it at loglevel debug would be a compromise?

-- 
Nick Kew