Bug 17464 - Order deny,allow / Deny from all was deprecated in Apache 2.4 and is now a hard error
Summary: Order deny,allow / Deny from all was deprecated in Apache 2.4 and is now a ha...
Status: Pushed to oldoldstable
Alias: None
Product: Koha
Classification: Unclassified
Component: Installation and upgrade (command-line installer) (show other bugs)
Version: unspecified
Hardware: PC All
: P5 - low normal (vote)
Assignee: David Cook
QA Contact: Testopia
URL:
Keywords:
: 18883 (view as bug list)
Depends on:
Blocks:
 
Reported: 2016-10-18 21:11 UTC by Bob Ewart
Modified: 2020-04-14 21:46 UTC (History)
6 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Who signed the patch off:
Text to go in the release notes:
Version(s) released in:
20.05.00, 19.11.05, 19.05.10, 18.11.16


Attachments
Bug 17464: Order deny,allow / Deny from all was deprecated in Apache 2.4 and is now a hard error (1.24 KB, patch)
2020-01-13 06:11 UTC, David Cook
Details | Diff | Splinter Review
Bug 17464: Order deny,allow / Deny from all was deprecated in Apache 2.4 and is now a hard error (1.38 KB, patch)
2020-02-27 00:15 UTC, Bernardo Gonzalez Kriegel
Details | Diff | Splinter Review
Bug 17464: Order deny,allow / Deny from all was deprecated in Apache 2.4 and is now a hard error (1.44 KB, patch)
2020-02-29 21:44 UTC, Katrin Fischer
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Bob Ewart 2016-10-18 21:11:00 UTC
The Allow, Deny and Order directives were deprecated in Apache 2.4 and are no longer recognized.

Order deny,allow
Deny from all

Should be:
Require all denied

lines 36/37 and 169/170 in koha-httpd.conf should be changed

This is in Koha compiled from source and appears in most of the versions I've tried.

Also add:
<Directory '/usr/share/koha'>
  Require all granted
</Directory>
or you will get an 'access forbidden' error

If using plugins also add:
<Directory '/var/lib/koha'>
  Require all granted
</Directory>
Comment 1 Katrin Fischer 2020-01-11 15:49:07 UTC
I still can find to "Deny from all" doing a git grep on the current codebase.
Comment 2 Katrin Fischer 2020-01-11 21:38:08 UTC
*** Bug 18883 has been marked as a duplicate of this bug. ***
Comment 3 David Cook 2020-01-13 06:01:12 UTC
Still a problem in 2020. I was just setting up Koha 19.11 from source and etc/koha-httpd.conf is still set up for Apache 2.2.

(I may as well take a minute to write a patch for this now.)
Comment 4 David Cook 2020-01-13 06:11:26 UTC
Created attachment 97294 [details] [review]
Bug 17464: Order deny,allow / Deny from all was deprecated in Apache 2.4 and is now a hard error

Patch change Apache access control from 2.2 to 2.4 directives.

Test plan:
0. Apply patch
1. Build Koha from source
2. Copy or symlink koha-dev/etc/koha-httpd.conf into your relevant
Apache directory.
3. Reload Apache
4. Note a lack of syntax errors regarding the "Order" directive
Comment 5 David Cook 2020-01-13 06:12:13 UTC
Note that I'm only fixing the existing access control issue. I haven't added a patch regarding potentially missing Directory directives.
Comment 6 Bernardo Gonzalez Kriegel 2020-02-27 00:15:17 UTC
Created attachment 99679 [details] [review]
Bug 17464: Order deny,allow / Deny from all was deprecated in Apache 2.4 and is now a hard error

Patch change Apache access control from 2.2 to 2.4 directives.

Test plan:
0. Apply patch
1. Build Koha from source
2. Copy or symlink koha-dev/etc/koha-httpd.conf into your relevant
Apache directory.
3. Reload Apache
4. Note a lack of syntax errors regarding the "Order" directive

Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
Old syntax still valid with mod_access_compat, but not for long.
Works, no errors.
Comment 7 Katrin Fischer 2020-02-29 21:44:07 UTC
Created attachment 99839 [details] [review]
Bug 17464: Order deny,allow / Deny from all was deprecated in Apache 2.4 and is now a hard error

Patch change Apache access control from 2.2 to 2.4 directives.

Test plan:
0. Apply patch
1. Build Koha from source
2. Copy or symlink koha-dev/etc/koha-httpd.conf into your relevant
Apache directory.
3. Reload Apache
4. Note a lack of syntax errors regarding the "Order" directive

Signed-off-by: Bernardo Gonzalez Kriegel <bgkriegel@gmail.com>
Old syntax still valid with mod_access_compat, but not for long.
Works, no errors.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 8 Katrin Fischer 2020-02-29 21:45:05 UTC
And another one (bug) bites the dust...

Verified by reading the patch and checking with my notes from strugglng with Apache2 back then.
Comment 9 Martin Renvoize 2020-03-02 09:47:12 UTC
Nice work everyone!

Pushed to master for 20.05
Comment 10 Joy Nelson 2020-04-01 20:44:30 UTC
Pushed to 19.11.x branch for 19.11.05
Comment 11 Lucas Gass 2020-04-08 22:12:15 UTC
backported to 19.05.x for 19.05.10
Comment 12 Hayley Mapley 2020-04-14 21:46:58 UTC
Backported to 18.11.x for 18.11.16