Menu

#2906 incorrect handling of multiple Require directives

open
5
2007-09-11
2007-09-11
Anonymous
No

When apache has several Require lines in a section it's enough that one of these lines match for the user to be authorized.

The following will authorize the user SumeUser or any user in group 5 or 6. However, when editing the directive from webmin the first Require line will be removed.

<Location /stats>
Require user SomeUser
Require Group 5 6
</Location>

Similarly it's possible to have several users on multiple lines in the configuration, but Webmin will only use the last line:

<Location /stats>
Require user User1 User2
Require user User3 User4
Require user User5 User6
</Location>

will be turned into

<Location /stats>
Require user User5 User6
</Location>

by Webmin.

Discussion


Log in to post a comment.

Auth0 Logo