Received: (qmail 26503 invoked by uid 501); 7 Jun 2001 20:39:59 -0000
Message-Id: <20010607203959.26502.qmail@apache.org>
Date: 7 Jun 2001 20:39:59 -0000
From: Jani Nurminen <jnurmine-apache@mail.lut.fi>
Reply-To: jnurmine-apache@mail.lut.fi
To: submit@bugz.apache.org
Subject: Using a slash "/" inside a comment "#" in the end of "Allow from" line breaks the .htaccess file
X-Send-Pr-Version: 3.110

>Number:         7836
>Category:       mod_access
>Synopsis:       Using a slash "/" inside a comment "#" in the end of "Allow from" line breaks the .htaccess file
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    apache
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   apache
>Arrival-Date:   Thu Jun 07 13:50:02 PDT 2001
>Closed-Date:    Thu Jun 07 14:14:20 PDT 2001
>Last-Modified:  Thu Jun 07 14:14:20 PDT 2001
>Originator:     jnurmine-apache@mail.lut.fi
>Release:        1.3.19
>Organization:
>Environment:
Linux [omitted] 2.4.4 #1 Tue May 22 22:34:50 EEST 2001 i686 unknown

Apache 1.3.19 installed from Debian packages:

ii  apache         1.3.19-1       Versatile, high-performance HTTP server
ii  apache-common  1.3.19-1       Support files for all Apache webservers
ii  apache-doc     1.3.19-1       Apache webserver docs
>Description:
If you use a slash "/" inside a comment "#" in a .htaccess file in the "Allow from" lines the .htaccess file is parsed wrong.

Ie. having this kind of line in .htaccess file:

Allow from foo.bar.baz.fi         # foo/homeaddress

(the content of comment is not important, the precense of slash is)

causes the following into error log, and the client is denied with a 500 error.

[Mon Jun  4 19:44:08 2001] [alert] [client xxx.xx.xxx.xxx] /www/htdocs/foo/.htaccess: syntax error in network portion of network/netmask 

Thus the precense of slash even in comments is mistaken for network/netmask format. Without the slash the comments work OK (although I don't know if they are allowed there as such in the first place...).
>How-To-Repeat:
See full description.
>Fix:
Change the line parser to ignore anything following a hash "#" or something. 
>Release-Note:
>Audit-Trail:
State-Changed-From-To: open-closed
State-Changed-By: marc
State-Changed-When: Thu Jun  7 14:14:18 PDT 2001
State-Changed-Why:
In general, end of line comments are never allowed in directives.
In some directives, the "#" character is a valid non-comment
charachter.  So the problem here is just that you are trying
to put comments where they aren't allowed.  

There is another PR open on the issue of detecting and erroring
out more gracefully when users make such mistakes.
>Unformatted:
 [In order for any reply to be added to the PR database, you need]
 [to include <apbugs@Apache.Org> in the Cc line and make sure the]
 [subject line starts with the report component and number, with ]
 [or without any 'Re:' prefixes (such as "general/1098:" or      ]
 ["Re: general/1098:").  If the subject doesn't match this       ]
 [pattern, your message will be misfiled and ignored.  The       ]
 ["apbugs" address is not added to the Cc line of messages from  ]
 [the database automatically because of the potential for mail   ]
 [loops.  If you do not include this Cc, your reply may be ig-   ]
 [nored unless you are responding to an explicit request from a  ]
 [developer.  Reply only with text; DO NOT SEND ATTACHMENTS!     ]