1138463 - mod_perl.pl does not allow Apache 2.4 "Require" directives

Status: RESOLVED DUPLICATE of bug 1223790

(Bugzilla :: Installation & Upgrading, defect)

Description

[David Lawrence [:dkl]]

I have also confirmed this that i get a ISE using the default master .htaccess file when running mod_perl. Interestingly, it does not fail if running under mod_cgi.

-> cat /etc/redhat-release 
CentOS Linux release 7.0.1406 (Core) 

-> rpm -q httpd
httpd-2.4.6-19.el7.centos.x86_64

-> rpm -q mod_perl
mod_perl-2.0.8-10.20140624svn1602105.el7.x86_64

If I make the change outlined below, the site works as expected.

-- Comment copied from 1133690 --

Oddly enough 2.4.6 seems to be ok with it in httpd.conf but not in .htaccess.

# httpd -v
Server version: Apache/2.4.6 (CentOS)
Server built:   Jan 12 2015 13:22:31

# ./testserver.pl http://localhost/bugs
TEST-OK Webserver is running under group id in $webservergroup.
TEST-FAILED Fetch of images/padlock.png failed
Your web server could not fetch http://localhost/bugs/images/padlock.png.
Check your web server configuration and try again.

# tail error_log
[Mon Mar 02 11:06:36.891578 2015] [core:alert] [pid 32596] [client 127.0.0.1:18522] /opt/bugzilla5/.htaccess: Require not allowed here

# sed -i 's/2\.4/2\.5/' .htaccess
# ./testserver.pl http://localhost/bugs
TEST-OK Webserver is running under group id in $webservergroup.
TEST-OK Got padlock picture.
TEST-OK Webserver is executing CGIs via mod_cgi.
TEST-OK Webserver is preventing fetch of http://localhost/bugs/localconfig.

Comment 1

[Frédéric Buclin]

(In reply to David Lawrence [:dkl] from comment #0)
> If I make the change outlined below, the site works as expected.

This is not surprising. You are using the 2.2 syntax in that case.

Comment 2

[David Lawrence [:dkl]]

Assigning. Thanks for looking at this.

Comment 3

[Frédéric Buclin]

Per this email from January 2015 http://mail-archives.apache.org/mod_mbox/perl-modperl/201501.mbox/%3CCADED=[e-mail]%3E mod_perl 2.0.8 doesn't support Apache 2.4 yet. So it looks like this is not a Bugzilla bug.

Comment 4

[David Lawrence [:dkl]]

(In reply to Frédéric Buclin from comment #3)
> Per this email from January 2015
> http://mail-archives.apache.org/mod_mbox/perl-modperl/201501.mbox/
> %3CCADED=[e-mail]%3E
> mod_perl 2.0.8 doesn't support Apache 2.4 yet. So it looks like this is not
> a Bugzilla bug.

Whether it will show up in a RHEL/Centos update eventually is another matter.

dkl

Comment 5

[Frédéric Buclin]

I can still reproduce this error with mod_perl 2.0.9-dev. I reported this problem upstream:

http://mail-archives.apache.org/mod_mbox/perl-modperl/201503.mbox/%3C54FA23D9.2000301%40gmail.com%3E

Comment 6

[Frédéric Buclin]

Attachment: patch, v1

This fixes the problem for me. If mod_perl is present, use the old directives.

Comment 7

[David Lawrence [:dkl]]

Comment on attachment 8574165 [details] [diff] [review]
patch, v1

Review of attachment 8574165 [details] [diff] [review]:
-----------------------------------------------------------------

r=dkl

Comment 8

[Frédéric Buclin]

To ssh://[e-mail]/bugzilla/bugzilla.git
   64ad8e3..b70bdeb  master -> master

To ssh://[e-mail]/bugzilla/bugzilla.git
   154e70f..91e0780  5.0 -> 5.0

To ssh://[e-mail]/bugzilla/bugzilla.git
   00466e7..f0c2b6b  4.4 -> 4.4

Comment 9

[sander.lepik]

Frédéric, are you sure this is the correct fix? I'm getting an error:

/var/www/bugzilla/.htaccess: Invalid command 'Deny', perhaps misspelled or defined by a module not included in the server configuration

This is CentOS 7 with Apache 2.4 and mod_perl 2.0.8

If I comment out the weird logic then the error goes away.

This is what I have and this is how it works:
<FilesMatch (\.pm|\.pl|\.tmpl|localconfig.*)$>
  <IfModule mod_version.c>
    <IfVersion < 2.4>
      Deny from all
    </IfVersion>
    <IfVersion >= 2.4>
      <IfModule mod_perl.c>
#        Deny from all
      </IfModule>
      <IfModule !mod_perl.c>
        Require all denied
      </IfModule>
    </IfVersion>
  </IfModule>
  <IfModule !mod_version.c>
    Deny from all
  </IfModule>
</FilesMatch>

Comment 10

[Frédéric Buclin]

(In reply to sander.lepik from comment #9)
> Frédéric, are you sure this is the correct fix?

I hope so. :)


> This is CentOS 7 with Apache 2.4 and mod_perl 2.0.8

mod_perl 2.0.8 is known to not support Apache 2.4. Does CentOS 7 offers an update to mod_perl 2.0.9?

>     <IfVersion >= 2.4>
>       <IfModule mod_perl.c>
> #        Deny from all
>       </IfModule>

With this line removed, you simply have no rules left, which is why you don't see any error anymore. This also means that your configuration file is now accessible to everyone, including your DB login + password and your secret key!

Comment 11

[sander.lepik]

Yeah, I know, it was just for testing. And I don't think that there will be 2.0.9 for mod_perl, Red Hat is known to not upgrade versions in stable releases.

Are there alternatives for mod_perl on Apache? This would solve my problem too but I'm not sure how to configure it.

Comment 12

[Frédéric Buclin]

(In reply to sander.lepik from comment #11)
> Are there alternatives for mod_perl on Apache? This would solve my problem
> too but I'm not sure how to configure it.

If the load on your Bugzilla installation is not too large, you can simple remove mod_perl.

Comment 13

[sander.lepik]

Ok, removed.. Thanks! :)

Comment 14

[Frédéric Buclin]

This fix is actually incorrect! It causes trouble if mod_access_compat is not enabled. The problem is not that mod_perl doesn't understand the Apache 2.4 syntax. The problem is that we forgot to fix mod_perl.pl to allow to override AuthConfig, see bug 1223790.

I'm backing out this patch from all branches per my discussion with dkl per email and on IRC:

To ssh://[e-mail]/bugzilla/bugzilla.git
   7027d79..b94ffcb  master -> master

To ssh://[e-mail]/bugzilla/bugzilla.git
   3dbd99b..9177ade  5.0 -> 5.0

To ssh://[e-mail]/bugzilla/bugzilla.git
   fab04c6..6c236bc  4.4 -> 4.4