367071 - [SECURITY] mod_perl <Directory> block doesn't let .htaccess work, and doesn't include the blacklists for files that shouldn't be downloaded

Status: RESOLVED FIXED

(Bugzilla :: Installation & Upgrading, defect)

Description

[Dave Miller [:justdave]]

I can retrieve localconfig from the web, 'nuff said.

Comment 1

[Dave Miller [:justdave]]

I added "AllowOverride All" to the <Directory> block in mod_perl.pl on b.m.o to let the existing .htaccess file work.  This may be more permissions that it needs and the only reason I'm not providing a patch right now, since we need to figure out what the appropriate permissions are here.

Comment 2

[Frédéric Buclin]

Wouldn't "AllowOverride Limit" work? That's what we have in /etc/httpd/conf/httpd.conf.

Comment 3

[Dave Miller [:justdave]]

in the docs you mean?  Guess it would.

We could also block all these files directly in the <Directory> block that mod_perl.pl generates instead of depending on .htaccess at all.

Comment 4

[Dave Miller [:justdave]]

Attachment: Use Limit

Here's the Limit version, basically what I did on b.m.o except change All to Limit.

Comment 5

[Frédéric Buclin]

(In reply to comment #3)
> in the docs you mean?  Guess it would.

http://www.bugzilla.org/docs/tip/html/configuration.html#http

Docs say so, and that's also what I have in my own httpd.conf.

Comment 6

[Max Kanat-Alexander]

Comment on attachment 251585 [details] [diff] [review]
Use Limit

Yeah, this is correct. I'm surprised that I missed that. It was working on landfill because the AllowOverride is set on /var/www/html/.

Comment 7

[Max Kanat-Alexander]

We should leave this in the approval queue until the release, since it's a real security bug.

Comment 8

[Frédéric Buclin]

Not only it's a security bug, but it's a pretty critical one as you can steal the login and password to access the DB. We should release asap.

Comment 9

[Joel Peshkin]

Sounds like a good reason to make sure people run testserver.pl when they upgrade.

Comment 10

[Dave Miller [:justdave]]

Checking in mod_perl.pl;
/cvsroot/mozilla/webtools/bugzilla/mod_perl.pl,v  <--  mod_perl.pl
new revision: 1.4; previous revision: 1.3
done

Comment 11

[Max Kanat-Alexander]

Security advisory posted, unlocking bug.