From nobody@hyperreal.com  Fri Apr 18 02:39:37 1997
Received: (from nobody@localhost)
          by hyperreal.com (8.8.4/8.8.4)
	  id CAA26589; Fri, 18 Apr 1997 02:39:37 -0700 (PDT)
Message-Id: <199704180939.CAA26589@hyperreal.com>
Date: Fri, 18 Apr 1997 02:39:37 -0700 (PDT)
From: Andrew Duffy <andrew.duffy%egypt.otn.eurocopter.de@eurocopter.de>
Reply-To: andrew.duffy%egypt.otn.eurocopter.de@eurocopter.de
To: apbugs@hyperreal.com
Subject: Proxy access protection does not work fully
X-Send-Pr-Version: 3.2

>Number:         414
>Category:       mod_access
>Synopsis:       Proxy access protection does not work fully
>Confidential:   no
>Severity:       critical
>Priority:       medium
>Responsible:    apache
>State:          closed
>Class:          sw-bug
>Submitter-Id:   apache
>Arrival-Date:   Fri Apr 18 02:40:01 1997
>Last-Modified:  Sun Apr 20 12:08:45 PDT 1997
>Originator:     andrew.duffy%egypt.otn.eurocopter.de@eurocopter.de
>Organization:
>Release:        1.2b8
>Environment:
SunOS egypt 5.5.1 Generic_103640-06 sun4u sparc SUNW,Ultra-1
Compiled with gcc version 2.7.0
>Description:
Proxy access protection only works if the requested URL ends with a "/".

i.e. A request for http://www.somewhere.com/index.html will succeed.
>How-To-Repeat:
Configure proxy protection as follows:

<Limit GET>
order deny,allow
deny from all
allow from machine-a machine-b
</Limit>
</Directory>

Use machine-c and access http://www.somewhere.com/index.html via the proxy.
>Fix:
Not yet, sorry
>Audit-Trail:
State-Changed-From-To: open-closed
State-Changed-By: chuck
State-Changed-When: Sun Apr 20 12:08:44 PDT 1997
State-Changed-Why:
Use a <Files> block instead of a <Directory> block to
restrict access to proxy. Docs are being updated to
reflect this.
>Unformatted: