Skip to content

Commit c93f7a7

Browse files
rbowenrbowen
committed
docs: Rewrite AllowOverride Options= warning
The existing note about implicit disabling of Options was difficult to parse. Rewrite as a type="warning" note with: - Clear statement that the restriction controls enabling, not disabling - Explanation of absolute vs relative (+/-) Options syntax - Concrete example showing how inherited options get implicitly disabled BZ#70099 git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1934979 13f79535-47bb-0310-9956-ffa450edef68
1 parent 1319058 commit c93f7a7

1 file changed

Lines changed: 29 additions & 8 deletions

File tree

‎docs/manual/mod/core.xml‎

Lines changed: 29 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -479,14 +479,35 @@ NoDecode option available in 2.3.12 and later.</compatibility>
479479
followed by a comma-separated list, without spaces, of options that
480480
may be set using the <directive module="core">Options</directive> directive.
481481

482-
<note><title>Implicit disabling of Options</title>
483-
<p>Even though the list of options that may be used in .htaccess files
484-
can be limited with this directive, as long as any <directive
485-
module="core">Options</directive> directive is allowed any
486-
other inherited option can be disabled by using the non-relative
487-
syntax. In other words, this mechanism cannot force a specific option
488-
to remain <em>set</em> while allowing any others to be set.
489-
</p></note>
482+
<note type="warning"><title>Implicit disabling of Options</title>
483+
<p>This restriction only controls which options a
484+
<code>.htaccess</code> file may <em>enable</em>. It does not
485+
prevent inherited options from being <em>disabled</em>.</p>
486+
487+
<p>When a <directive module="core">Options</directive> directive
488+
in <code>.htaccess</code> uses absolute syntax (without
489+
<code>+</code> or <code>-</code> prefixes), it <em>replaces</em>
490+
the entire inherited option set. Any previously active options
491+
not listed are implicitly turned off&mdash;even options that are
492+
not in the <code>AllowOverride</code> permitted list.</p>
493+
494+
<p>For example, if the server configuration sets:</p>
495+
<highlight language="config">
496+
Options Indexes FollowSymLinks ExecCGI
497+
AllowOverride Options=Indexes
498+
</highlight>
499+
<p>and a <code>.htaccess</code> file contains:</p>
500+
<highlight language="config">
501+
Options Indexes
502+
</highlight>
503+
<p>then <code>FollowSymLinks</code> and <code>ExecCGI</code> are
504+
implicitly disabled for that directory, even though the
505+
<code>AllowOverride</code> line only permits setting
506+
<code>Indexes</code>.</p>
507+
508+
<p>In short, this mechanism cannot force a specific option to
509+
remain <em>set</em> while allowing any others to be set.</p>
510+
</note>
490511

491512
<highlight language="config">
492513
AllowOverride Options=Indexes,MultiViews

0 commit comments

Comments
 (0)