Return-Path: 
 <users-return-71035-apmail-httpd-users-archive=httpd.apache.org@httpd.apache.org>
Delivered-To: apmail-httpd-users-archive@www.apache.org
Received: (qmail 9389 invoked from network); 15 Mar 2007 13:35:35 -0000
Received: from hermes.apache.org (HELO mail.apache.org) (140.211.11.2)
  by minotaur.apache.org with SMTP; 15 Mar 2007 13:35:35 -0000
Received: (qmail 95061 invoked by uid 500); 15 Mar 2007 13:35:32 -0000
Delivered-To: apmail-httpd-users-archive@httpd.apache.org
Received: (qmail 95038 invoked by uid 500); 15 Mar 2007 13:35:31 -0000
Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
list-help: <mailto:users-help@httpd.apache.org>
list-unsubscribe: <mailto:users-unsubscribe@httpd.apache.org>
List-Post: <mailto:users@httpd.apache.org>
List-Id: <users.httpd.apache.org>
Delivered-To: mailing list users@httpd.apache.org
Received: (qmail 95027 invoked by uid 99); 15 Mar 2007 13:35:31 -0000
Received: from herse.apache.org (HELO herse.apache.org) (140.211.11.133)
    by apache.org (qpsmtpd/0.29) with ESMTP; Thu, 15 Mar 2007 06:35:31 -0700
X-ASF-Spam-Status: No, hits=-0.0 required=10.0
	tests=SPF_PASS
X-Spam-Check-By: apache.org
Received-SPF: pass (herse.apache.org: domain of jslive@gmail.com designates
 66.249.92.172 as permitted sender)
Received: from [66.249.92.172] (HELO ug-out-1314.google.com) (66.249.92.172)
    by apache.org (qpsmtpd/0.29) with ESMTP; Thu, 15 Mar 2007 06:35:21 -0700
Received: by ug-out-1314.google.com with SMTP id 75so320326ugb
        for <users@httpd.apache.org>; Thu, 15 Mar 2007 06:34:58 -0700 (PDT)
DKIM-Signature: a=rsa-sha1; c=relaxed/relaxed;
        d=gmail.com; s=beta;
        h=domainkey-signature:received:received:message-id:date:from:sender:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references:x-google-sender-auth;
        b=aRJAnJjWKrAonksxiO/5TkSMGx/Q4epx5LBKC/GjJueV9iP2eg0BehnA2ZGFj/g3Uvp5KzMgdQni8Uq3MdrklVTXnfHG2l1oaI4PmRPxVlmS+S3EJWd1i1picLAkOO2Dwyes0o+Oo2mK0swxenx5Fp3FRl26D2ZUHeqKGPBEL2E=
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=beta;
        h=received:message-id:date:from:sender:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references:x-google-sender-auth;
        b=k7jSo+SzNgjGLPRKEAu/gp2OutN8gmKbW8a/DnpfJanCIcncxqMzXHPR8jAZ2Qig2gSTiwqPm+PnGzjAWYGbxM06Ouy/jV0gO6RYLQjl102c/VTW4zsx7NXrwi+IcSH0T5wkAIoJ7ynkhMUWfw1ANiGqtYat6LVBvGRYQuWmxk8=
Received: by 10.114.110.1 with SMTP id i1mr224121wac.1173965683476;
        Thu, 15 Mar 2007 06:34:43 -0700 (PDT)
Received: by 10.140.25.5 with HTTP; Thu, 15 Mar 2007 06:34:43 -0700 (PDT)
Message-ID: <e498c1660703150634n6c78daa8gba0250d11328be70@mail.gmail.com>
Date: Thu, 15 Mar 2007 09:34:43 -0400
From: "Joshua Slive" <joshua@slive.ca>
Sender: jslive@gmail.com
To: users@httpd.apache.org
In-Reply-To: <45F91459.2080803@e-tera.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <45F91459.2080803@e-tera.com>
X-Google-Sender-Auth: 086dac20b3f9284f
X-Virus-Checked: Checked by ClamAV on apache.org
Subject: Re: [users@httpd] no listing of protected directory

On 3/15/07, Laetitia Bourasseau <laetitia.bourasseau@e-tera.com> wrote:
> Hello
>
> I try to list the content of a VirtualHost (with the directive Options
> Indexes) on apache 2.0.52 (on centos 4) but only some subdirectories
> appear.
>
> All the subdirectories that have a <Directory > directive inside the
> <Vitualhost > in httpd.conf are not listed.
> Some have a <Directory > section to enable a basic authentification on
> those folders.
> So only the files which are not protected do appear on
> the listing.... and I want ALL the files and folders on the listing !
>
> The behaviour was not the same on apache 1.3.27 : all the directories
> were listed.
> A lot of users (on google...) seem to have the same problem, but i have not
> found a valuable solution.
>
> Is it a bug or a new feature in v 2.0.52 ?

Hmmm... My hint on the bug database wasn't enough?

It is a security feature designed to prevent the disclosure of
protected resources.

It can be turned off in recent versions (2.0.52 probably doesn't
count) using the IndexOptions directive: specifically the
ShowForbidden option.

Joshua.

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org