mod_evasive icon indicating copy to clipboard operation
mod_evasive copied to clipboard

mod_evasive24.c: DEPRECATED direct use of ap_hook_access_checker

Open bohnelang opened this issue 7 months ago • 0 comments

On https://httpd.apache.org/docs/trunk/developer/new_api_2_4.html ist is mentiones, that ap_hook_access_checker is depricated:

http_request (changed)

    New auth_internal API and auth_provider API
    New EOR bucket type
    New function ap_process_async_request
    New flags AP_AUTH_INTERNAL_PER_CONF and AP_AUTH_INTERNAL_PER_URI
    New access_checker_ex hook to apply additional access control and/or bypass authentication.
    New functions ap_hook_check_access_ex, ap_hook_check_access, ap_hook_check_authn, ap_hook_check_authz which accept AP_AUTH_INTERNAL_PER_* flags
    DEPRECATED direct use of ap_hook_access_checker, access_checker_ex, ap_hook_check_user_id, ap_hook_auth_checker

When possible, registering all access control hooks (including authentication and authorization hooks) using AP_AUTH_INTERNAL_PER_CONF is recommended. If all modules' access control hooks are registered with this flag, then whenever the server handles an internal sub-request that matches the same set of access control configuration directives as the initial request (which is the common case), it can avoid invoking the access control hooks another time.

If your module requires the old behavior and must perform access control checks on every sub-request with a different URI from the initial request, even if that URI matches the same set of access control configuration directives, then use AP_AUTH_INTERNAL_PER_URI.

Thus I guess the code should be migrated to the 2.4 api - maybe like this:

static void register_hooks(apr_pool_t *p) {
    //ap_hook_access_checker(access_checker, NULL, NULL, APR_HOOK_FIRST-5);
    ap_hook_check_access(access_checker, NULL, NULL, APR_HOOK_REALLY_FIRST, AP_AUTH_INTERNAL_PER_CONF );
    apr_pool_cleanup_register(p, NULL, apr_pool_cleanup_null, destroy_config);
};

APR_HOOK_REALLY_FIRST is defined as -10 and would be understandabe than APR_HOOK_FIRST-5 (0-5=-5) .

bohnelang avatar Jun 02 '25 10:06 bohnelang