Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: pass (nike.apache.org: domain of ben@reser.org designates
 50.197.89.41 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <51FB1F4C.8080005@aldan.algebra.com>
References: <51F849AB.8050900@aldan.algebra.com>
	<51FB11A8.6010108@aldan.algebra.com>
	<CADkdwvSVb8gortpuWeKEc9s+jeg5_k4Aom7-qd8EczG8f6=k8Q@mail.gmail.com>
	<51FB1F4C.8080005@aldan.algebra.com>
Date: Fri, 2 Aug 2013 17:17:40 -0700
Message-ID: 
 <CADkdwvRme0QObKdQVCjF+_h7St+CG8zDHhpnLXjup2V=KpQazQ@mail.gmail.com>
Subject: Re: Resolved (sort of): Struggling with AuthMerging
From: Ben Reser <ben@reser.org>
To: dev <dev@httpd.apache.org>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Thu, Aug 1, 2013 at 7:54 PM, Mikhail T. <mi+thun@aldan.algebra.com> wrot=
e:
> 01.08.2013 22:47, Ben Reser =D0=BD=D0=B0=D0=BF=D0=B8=D1=81=D0=B0=D0=B2(=
=D0=BB=D0=B0):
>> That's not a bug at all.  In some cases it may be necessary for
>> authorization to run for sub-requests.
>
> Could you give an example or two? Thanks,

Sure.

mod_autoindex automatically provides a directory listing of files
under a path.  However, by default it doesn't display any paths that
you don't have access to, e.g. .htaccess.  It does this by issuing
subrequests for those other paths so that authz can run on them.
(This behavior could be changed with IndexOptions ShowForbidden).

mod_dav_svn.  Numerous commands in SVN impact other paths than the URI
(e.g. `svn list` which is similar to the autoindex case above,
commiting a copy or move which touch two paths one of which is on in
the URI but rather in the headers).  mod_dav_svn issues sub requests
for these other paths to find out if the actions are allowed on them.
Because of the performance impact of this mod_dav_svn has the
SVNPathAuthz directive to change this behavior.  One of the possible
values is short_circuit which causes mod_dav_svn to talk directly to
mod_authz_svn rather than doing a subrequest.  You might ask why don't
we just do this by default?  The reason being is if there are other
authorization limits placed from other modules then they would no
longer respected.