Klaus Demo nginx / be909c3
Merge of r4473: Core: protection from cycles with named locations and post_action. Now redirects to named locations are counted against normal uri changes limit, and post_action respects this limit as well. As a result at least the following (bad) configurations no longer trigger infinite cycles: 1. Post action which recursively triggers post action: location / { post_action /index.html; } 2. Post action pointing to nonexistent named location: location / { post_action @nonexistent; } 3. Recursive error page for 500 (Internal Server Error) pointing to a nonexistent named location: location / { recursive_error_pages on; error_page 500 @nonexistent; return 500; } Maxim Dounin 8 years ago
2 changed file(s) with 14 addition(s) and 0 deletion(s). Raw diff Collapse all Expand all
25232523 ngx_http_core_main_conf_t *cmcf;
25242524
25252525 r->main->count++;
2526 r->uri_changes--;
2527
2528 if (r->uri_changes == 0) {
2529 ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
2530 "rewrite or internal redirection cycle "
2531 "while redirect to named location \"%V\"", name);
2532
2533 ngx_http_finalize_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);
2534 return NGX_DONE;
2535 }
25262536
25272537 cscf = ngx_http_get_module_srv_conf(r, ngx_http_core_module);
25282538
28972897 return NGX_DECLINED;
28982898 }
28992899
2900 if (r->post_action && r->uri_changes == 0) {
2901 return NGX_DECLINED;
2902 }
2903
29002904 ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
29012905 "post action: \"%V\"", &clcf->post_action);
29022906