Bug 17464

Summary: Order deny,allow / Deny from all was deprecated in Apache 2.4 and is now a hard error
Product: Koha Reporter: Bob Ewart <bob-ewart>
Component: Installation and upgrade (command-line installer)Assignee: David Cook <dcook>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: normal    
Priority: P5 - low CC: 1joynelson, bob-ewart, dcook, hayleypelham, katrin.fischer, lucas
Version: unspecified   
Hardware: PC   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18216
Change sponsored?: --- Patch complexity: Small patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
20.05.00, 19.11.05, 19.05.10, 18.11.16
Attachments: Bug 17464: Order deny,allow / Deny from all was deprecated in Apache 2.4 and is now a hard error
Bug 17464: Order deny,allow / Deny from all was deprecated in Apache 2.4 and is now a hard error
Bug 17464: Order deny,allow / Deny from all was deprecated in Apache 2.4 and is now a hard error

Description Bob Ewart 2016-10-18 21:11:00 UTC
The Allow, Deny and Order directives were deprecated in Apache 2.4 and are no longer recognized.

Order deny,allow
Deny from all

Should be:
Require all denied

lines 36/37 and 169/170 in koha-httpd.conf should be changed

This is in Koha compiled from source and appears in most of the versions I've tried.

Also add:
<Directory '/usr/share/koha'>
  Require all granted
</Directory>
or you will get an 'access forbidden' error

If using plugins also add:
<Directory '/var/lib/koha'>
  Require all granted
</Directory>
Comment 1 Katrin Fischer 2020-01-11 15:49:07 UTC
I still can find to "Deny from all" doing a git grep on the current codebase.
Comment 2 Katrin Fischer 2020-01-11 21:38:08 UTC
*** Bug 18883 has been marked as a duplicate of this bug. ***
Comment 3 David Cook 2020-01-13 06:01:12 UTC
Still a problem in 2020. I was just setting up Koha 19.11 from source and etc/koha-httpd.conf is still set up for Apache 2.2.

(I may as well take a minute to write a patch for this now.)
Comment 4 David Cook 2020-01-13 06:11:26 UTC
Created attachment 97294 [details] [review]
Bug 17464: Order deny,allow / Deny from all was deprecated in Apache 2.4 and is now a hard error

Patch change Apache access control from 2.2 to 2.4 directives.

Test plan:
0. Apply patch
1. Build Koha from source
2. Copy or symlink koha-dev/etc/koha-httpd.conf into your relevant
Apache directory.
3. Reload Apache
4. Note a lack of syntax errors regarding the "Order" directive
Comment 5 David Cook 2020-01-13 06:12:13 UTC
Note that I'm only fixing the existing access control issue. I haven't added a patch regarding potentially missing Directory directives.
Comment 6 Bernardo Gonzalez Kriegel 2020-02-27 00:15:17 UTC
Created attachment 99679 [details] [review]
Bug 17464: Order deny,allow / Deny from all was deprecated in Apache 2.4 and is now a hard error

Patch change Apache access control from 2.2 to 2.4 directives.

Test plan:
0. Apply patch
1. Build Koha from source
2. Copy or symlink koha-dev/etc/koha-httpd.conf into your relevant
Apache directory.
3. Reload Apache
4. Note a lack of syntax errors regarding the "Order" directive

Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
Old syntax still valid with mod_access_compat, but not for long.
Works, no errors.
Comment 7 Katrin Fischer 2020-02-29 21:44:07 UTC
Created attachment 99839 [details] [review]
Bug 17464: Order deny,allow / Deny from all was deprecated in Apache 2.4 and is now a hard error

Patch change Apache access control from 2.2 to 2.4 directives.

Test plan:
0. Apply patch
1. Build Koha from source
2. Copy or symlink koha-dev/etc/koha-httpd.conf into your relevant
Apache directory.
3. Reload Apache
4. Note a lack of syntax errors regarding the "Order" directive

Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
Old syntax still valid with mod_access_compat, but not for long.
Works, no errors.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 8 Katrin Fischer 2020-02-29 21:45:05 UTC
And another one (bug) bites the dust...

Verified by reading the patch and checking with my notes from strugglng with Apache2 back then.
Comment 9 Martin Renvoize 2020-03-02 09:47:12 UTC
Nice work everyone!

Pushed to master for 20.05
Comment 10 Joy Nelson 2020-04-01 20:44:30 UTC
Pushed to 19.11.x branch for 19.11.05
Comment 11 Lucas Gass 2020-04-08 22:12:15 UTC
backported to 19.05.x for 19.05.10
Comment 12 Hayley Pelham 2020-04-14 21:46:58 UTC
Backported to 18.11.x for 18.11.16