SSI Broken in Apache 2.4.x when Basic Auth is used
Description
Environment
CentOS 6.4 OpenSSL 1.0.1e
clones
Activity
Scott Cantor December 2, 2013 at 5:06 PM
Closing on release.
Scott Cantor November 20, 2013 at 9:04 PM
This is the same issue as in the indexing case. The message implicates the same hole in the code that ran assuming the post-read hook would have run. All the hooks now guard themselves and force-create a per-request structure and attendant objects if Apache doesn't do the right things internally.
Scott Cantor June 27, 2013 at 5:02 PM
Feel free to send them to me direct, or in Dropbox or what have you.
I've tested every which way in the past with no problems, so I think I need the exact case to spend more time on it.
gibsonb@imsweb.com June 27, 2013 at 4:59 PM
Okay the setup is like this:
documentroot is /web/website/htdocs/
The file affected is at /web/website/htdocs/folder/index.html (my developers do not use the .shtml extension for some reason I get around this by using the XBitHack Full statement on sites where they intend to use SSI)
If they try to include a file at say /web/website/htdocs/otherfolder/footer.html it will generate an error like this:
shib_auth_checker found no per-request structure, referer: http://www.website.com/
unable to include "/footer.html" in parsed file /web/website/htdocs/folder/index.html, subrequest setup returned 500, referer: http://www.website.com/
I did run a trace but this was the only thing useful as you suggested.
If you would like non-redacted configs I could provide them, but would rather not put them in an open forum.
<VirtualHost website:80>
ServerName www.website.com
ShibCompatValidUser On
XBitHack Full
DocumentRoot /web/website/htdocs
<Directory /web/website/htdocs>
Options FollowSymlinks Includes
AllowOverride All
Include /web/configs/.htaccess
</Directory>
</VirtualHost>
Scott Cantor June 27, 2013 at 4:47 PM
Please attach complete examples of the configuration affected. A trace probably won't tell me anything, but won't hurt. Apache does no logging of the SSI mechanism, so I get nothing about what it's doing internally.
When using Basic Auth on a non shibboleth enabled web site, Server Side Includes no longer function. I attempted to mitigate this by using ShibDisable On in the directories that are affected, however that does not seem to fix these sites.
I will upload a trace of an affected web server.