comparison src/http/ngx_http_core_module.c @ 8038:711737177b77

Multiple WWW-Authenticate headers with "satisfy any;". If a module adds multiple WWW-Authenticate headers (ticket #485) to the response, linked in r->headers_out.www_authenticate, all headers are now cleared if another module later allows access. This change is a nop for standard modules, since the only access module which can add multiple WWW-Authenticate headers is the auth request module, and it is checked after other standard access modules. Though this might affect some third party access modules. Note that if a 3rd party module adds a single WWW-Authenticate header and not yet modified to set the header's next pointer to NULL, attempt to clear such a header with this change will result in a segmentation fault.
author Maxim Dounin <mdounin@mdounin.ru>
date Mon, 30 May 2022 21:25:56 +0300
parents d26db4f82d7d
children 4cc2bfeff46c 8d0753760546
comparison
equal deleted inserted replaced
8037:8272c823a7d0 8038:711737177b77
1086 1086
1087 ngx_int_t 1087 ngx_int_t
1088 ngx_http_core_access_phase(ngx_http_request_t *r, ngx_http_phase_handler_t *ph) 1088 ngx_http_core_access_phase(ngx_http_request_t *r, ngx_http_phase_handler_t *ph)
1089 { 1089 {
1090 ngx_int_t rc; 1090 ngx_int_t rc;
1091 ngx_table_elt_t *h;
1091 ngx_http_core_loc_conf_t *clcf; 1092 ngx_http_core_loc_conf_t *clcf;
1092 1093
1093 if (r != r->main) { 1094 if (r != r->main) {
1094 r->phase_handler = ph->next; 1095 r->phase_handler = ph->next;
1095 return NGX_AGAIN; 1096 return NGX_AGAIN;
1120 1121
1121 } else { 1122 } else {
1122 if (rc == NGX_OK) { 1123 if (rc == NGX_OK) {
1123 r->access_code = 0; 1124 r->access_code = 0;
1124 1125
1125 if (r->headers_out.www_authenticate) { 1126 for (h = r->headers_out.www_authenticate; h; h = h->next) {
1126 r->headers_out.www_authenticate->hash = 0; 1127 h->hash = 0;
1127 } 1128 }
1128 1129
1129 r->phase_handler = ph->next; 1130 r->phase_handler = ph->next;
1130 return NGX_AGAIN; 1131 return NGX_AGAIN;
1131 } 1132 }