[Bug 70099] AllowOverride Directive mis leading about effect of “AllowOverride Opti ons=…”

[email protected] Thu, 04 Jun 2026 14:49:19 +0000

Newsgroups	gmane.comp.apache.documentation
Message-ID	<[email protected]/bugzilla/>

https://bz.apache.org/bugzilla/show_bug.cgi?id=3D70099

Rich Bowen <[email protected]> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |NEW

--- Comment #1 from Rich Bowen <[email protected]> ---
Confirmed. The reporter is correct - the subtlety this note describes is a
genuine security gotcha: an admin may believe AllowOverride Options=3DIndex=
es
prevents .htaccess from affecting other options, when in fact absolute-synt=
ax
Options (without +/- prefixes) replaces the entire inherited set, implicitly
disabling options like FollowSymLinks or ExecCGI.

Working on a patch that rewrites the note as a warning with a concrete exam=
ple.
Will commit after I've tested the example a little better.

--=20
You are receiving this mail because:
You are the assignee for the bug.=