Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: error (athena.apache.org: local policy)
X_CMAE_Category: 0,0 Undefined,Undefined
X-CNFS-Analysis: v=2.1 cv=ANp1G3FL c=1 sm=0 tr=0
 a=GS/m0tZvCSHFipQJINqAXA==:117 a=_qQbbi1-GVgA:10 a=yac4uheJ8tYA:10
 a=YNqtyO0l_hcA:10 a=LaogzpLLAAAA:8 a=tt10PT6k82wA:10 a=r77TgQKjGQsHNAKrUKIA:9
 a=9iDbn-4jx3cA:10 a=cKsnjEOsciEA:10 a=pGLkceISAAAA:8 a=RwBXvwYpEXWc21B2ItYA:9
 a=wPNLvfGTeEIA:10 a=qRLRV94jhhO5spIK4hcA:9 a=9asrU_Ss6eA-Ru-n:21
 a=_W_S_7VecoQA:10
X-CM-Score: 0
X-Scanned-by: Cloudmark Authority Engine
Authentication-Results: smtp02.rcn.cmh.synacor.com
 smtp.mail=mi+thun@aldan.algebra.com; spf=neutral; sender-id=neutral
Authentication-Results: smtp02.rcn.cmh.synacor.com
 header.from=mi+thun@aldan.algebra.com; sender-id=neutral
Authentication-Results: smtp02.rcn.cmh.synacor.com smtp.user=anat;
 auth=pass (PLAIN)
Received-SPF: neutral (smtp02.rcn.cmh.synacor.com: 96.242.221.197 is neither
 permitted nor denied by domain of aldan.algebra.com)
Received: from [96.242.221.197] ([96.242.221.197:50652] helo=[192.168.1.8])
	by smtp.rcn.com (envelope-from <mi+thun@aldan.algebra.com>)
	(ecelerity 2.2.3.49 r(42060/42061)) with ESMTPA
	id 46/35-14489-DF56DF15; Sat, 03 Aug 2013 16:20:13 -0400
Message-ID: <51FD65FD.9010205@aldan.algebra.com>
Date: Sat, 03 Aug 2013 16:20:13 -0400
From: "Mikhail T." <mi+thun@aldan.algebra.com>
User-Agent: Mozilla/5.0 (X11; FreeBSD amd64;
 rv:17.0) Gecko/20130209 Thunderbird/17.0.2
MIME-Version: 1.0
To: dev@httpd.apache.org
Subject: Re: Resolved (sort of): Struggling with AuthMerging
References: <51F849AB.8050900@aldan.algebra.com>
 <51FB11A8.6010108@aldan.algebra.com>
 <CADkdwvSVb8gortpuWeKEc9s+jeg5_k4Aom7-qd8EczG8f6=k8Q@mail.gmail.com>
 <51FB1F4C.8080005@aldan.algebra.com>
 <CADkdwvRme0QObKdQVCjF+_h7St+CG8zDHhpnLXjup2V=KpQazQ@mail.gmail.com>
 <51FC77F9.7060108@aldan.algebra.com>
 <CADkdwvSWkAe_QmOdhgVUSPrBe66eNMdokHNwARoG56xtLt80-A@mail.gmail.com>
 <51FD40C3.9070606@aldan.algebra.com>
 <CALK=YjPxFy=KQahgrUnsVTQyjzx48+xtghfF2js5kR2b9PeBPg@mail.gmail.com>
 <51FD4D43.1020401@aldan.algebra.com>
 <CALK=YjO8XjwtL3sgv9+2afy=P2fktdGyWdONdCORhzy8YhkYsQ@mail.gmail.com>
In-Reply-To: 
 <CALK=YjO8XjwtL3sgv9+2afy=P2fktdGyWdONdCORhzy8YhkYsQ@mail.gmail.com>
Content-Type: multipart/alternative;
 boundary="------------000400080004070603050001"
X-Virus-Checked: Checked by ClamAV on apache.org

This is a multi-part message in MIME format.
--------------000400080004070603050001
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

03.08.2013 15:19, Eric Covener ???????(??):
> I didn't interpret his response that way. Those are modules that will
> create subrequests/internal redirects to new URIs that could have
> separate authz applied to them from the original URI --  you can't
> assume the server is any less interested in performing authz on them.
Ben's examples -- given in

CADkdwvRme0QObKdQVCjF+_h7St+CG8zDHhpnLXjup2V=KpQazQ@mail.gmail.com

-- were mod_autoindex and mod_dav_svn. Both -- as far as I understood --
used additional authz-checks when generating the /body/ of the response.
Not to decide, whether to authorize the request itself, but to decide,
what exactly to send back after the authorization already succeeded.

> The server can't tell the difference between that and
> your mod_actions internal redirect to a new URI -- they need to be
> checked.
Then, perhaps, there should be a way for me to tell the server, that
such a decision can be made for a particular Location (or Directory, or
vhost).

Yours,

    -mi


--------------000400080004070603050001
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

<html>
  <head>
    <meta content="text/html; charset=ISO-8859-1"
      http-equiv="Content-Type">
  </head>
  <body text="#000000" bgcolor="#FFFFFF">
    <div class="moz-cite-prefix">03.08.2013 15:19, Eric Covener
      &#1085;&#1072;&#1087;&#1080;&#1089;&#1072;&#1074;(&#1083;&#1072;):<br>
    </div>
    <blockquote
cite="mid:CALK=YjO8XjwtL3sgv9+2afy=P2fktdGyWdONdCORhzy8YhkYsQ@mail.gmail.com"
      type="cite">
      <pre wrap="">I didn't interpret his response that way. Those are modules that will
create subrequests/internal redirects to new URIs that could have
separate authz applied to them from the original URI --  you can't
assume the server is any less interested in performing authz on them.</pre>
    </blockquote>
    Ben's examples -- given in <br>
    <pre><a class="moz-txt-link-abbreviated" href="mailto:CADkdwvRme0QObKdQVCjF+_h7St+CG8zDHhpnLXjup2V=KpQazQ@mail.gmail.com">CADkdwvRme0QObKdQVCjF+_h7St+CG8zDHhpnLXjup2V=KpQazQ@mail.gmail.com</a></pre>
    -- were mod_autoindex and mod_dav_svn. Both -- as far as I
    understood -- used additional authz-checks when generating the <i>body</i>
    of the response. Not to decide, whether to authorize the request
    itself, but to decide, what exactly to send back after the
    authorization already succeeded.<br>
    <br>
    <blockquote type="cite">
      <pre wrap="">The server can't tell the difference between that and
your mod_actions internal redirect to a new URI -- they need to be
checked.
</pre>
    </blockquote>
    Then, perhaps, there should be a way for me to tell the server, that
    such a decision can be made for a particular Location (or Directory,
    or vhost).<br>
    <br>
    Yours,<br>
    <blockquote>-mi<br>
    </blockquote>
  </body>
</html>

--------------000400080004070603050001--