diff options
| -rw-r--r-- | CHANGES | 11 | ||||
| -rw-r--r-- | STATUS | 5 | ||||
| -rw-r--r-- | docs/manual/mod/mod_authz_user.xml | 35 | ||||
| -rw-r--r-- | modules/aaa/mod_authz_user.c | 35 |
4 files changed, 75 insertions, 11 deletions
@@ -2,16 +2,19 @@ Changes with Apache 2.4.8 - *) mod_authnz_host: Support the expression parser within the require + *) mod_authz_user: Support the expression parser within the require directives. [Graham Leggett] - *) mod_authnz_groupfile: Support the expression parser within the require + *) mod_authz_host: Support the expression parser within the require directives. [Graham Leggett] - *) mod_authnz_dbm: Support the expression parser within the require + *) mod_authz_groupfile: Support the expression parser within the require directives. [Graham Leggett] - *) mod_authnz_dbd: Support the expression parser within the require + *) mod_authz_dbm: Support the expression parser within the require + directives. [Graham Leggett] + + *) mod_authz_dbd: Support the expression parser within the require directives. [Graham Leggett] *) mod_authnz_ldap: Support the expression parser within the require @@ -98,11 +98,6 @@ RELEASE SHOWSTOPPERS: PATCHES ACCEPTED TO BACKPORT FROM TRUNK: [ start all new proposals below, under PATCHES PROPOSED. ] - * mod_authz_user: Support the expression parser within the require directives. - trunk patch: http://svn.apache.org/r1554195 - 2.4.x patch: trunk works (modulo CHANGES and log-message-tags) - +1: minfrin, jim, covener - * core: Support named groups and backreferences within the LocationMatch, DirectoryMatch, FilesMatch and ProxyMatch directives. trunk patch: http://svn.apache.org/r1554300 diff --git a/docs/manual/mod/mod_authz_user.xml b/docs/manual/mod/mod_authz_user.xml index fea8c72d9b..86711f4c7d 100644 --- a/docs/manual/mod/mod_authz_user.xml +++ b/docs/manual/mod/mod_authz_user.xml @@ -39,4 +39,39 @@ </summary> <seealso><directive module="mod_authz_core">Require</directive></seealso> +<section id="requiredirectives"><title>The Require Directives</title> + + <p>Apache's <directive module="mod_authz_core">Require</directive> + directives are used during the authorization phase to ensure that + a user is allowed to access a resource. mod_authz_user extends the + authorization types with <code>user</code> and <code>valid-user</code>. + </p> + + <p>Since v2.5.0, <a href="../expr.html">expressions</a> are supported + within the user require directives.</p> + +<section id="requser"><title>Require user</title> + + <p>This directive specifies a list of users that are allowed to gain + access.</p> + + <highlight language="config"> + Require user john paul george ringo + </highlight> + +</section> + +<section id="reqvaliduser"><title>Require valid-user</title> + + <p>When this directive is specified, any successfully authenticated + user will be allowed to gain access.</p> + + <highlight language="config"> + Require valid-user + </highlight> + +</section> + +</section> + </modulesynopsis> diff --git a/modules/aaa/mod_authz_user.c b/modules/aaa/mod_authz_user.c index e4af7946a4..0f45395ed8 100644 --- a/modules/aaa/mod_authz_user.c +++ b/modules/aaa/mod_authz_user.c @@ -49,13 +49,25 @@ static authz_status user_check_authorization(request_rec *r, const char *require_args, const void *parsed_require_args) { + const char *err = NULL; + const ap_expr_info_t *expr = parsed_require_args; + const char *require; + const char *t, *w; if (!r->user) { return AUTHZ_DENIED_NO_USER; } - t = require_args; + require = ap_expr_str_exec(r, expr, &err); + if (err) { + ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02594) + "authz_user authorize: require user: Can't " + "evaluate require expression: %s", err); + return AUTHZ_DENIED; + } + + t = require; while ((w = ap_getword_conf(r->pool, &t)) && w[0]) { if (!strcmp(r->user, w)) { return AUTHZ_GRANTED; @@ -81,10 +93,29 @@ static authz_status validuser_check_authorization(request_rec *r, return AUTHZ_GRANTED; } +static const char *user_parse_config(cmd_parms *cmd, const char *require_line, + const void **parsed_require_line) +{ + const char *expr_err = NULL; + ap_expr_info_t *expr = apr_pcalloc(cmd->pool, sizeof(*expr)); + + expr = ap_expr_parse_cmd(cmd, require_line, AP_EXPR_FLAG_STRING_RESULT, + &expr_err, NULL); + + if (expr_err) + return apr_pstrcat(cmd->temp_pool, + "Cannot parse expression in require line: ", + expr_err, NULL); + + *parsed_require_line = expr; + + return NULL; +} + static const authz_provider authz_user_provider = { &user_check_authorization, - NULL, + &user_parse_config, }; static const authz_provider authz_validuser_provider = { |