| 821 | } |
| 822 | |
| 823 | static int authorize_user_core(request_rec *r, int after_authn) |
| 824 | { |
| 825 | authz_core_dir_conf *conf; |
| 826 | authz_status auth_result; |
| 827 | |
| 828 | conf = ap_get_module_config(r->per_dir_config, &authz_core_module); |
| 829 | |
| 830 | if (!conf->section) { |
| 831 | if (ap_auth_type(r)) { |
| 832 | /* there's an AuthType configured, but no authorization |
| 833 | * directives applied to support it |
| 834 | */ |
| 835 | |
| 836 | ap_log_rerror(APLOG_MARK, APLOG_ERR, APR_SUCCESS, r, APLOGNO(01627) |
| 837 | "AuthType configured with no corresponding " |
| 838 | "authorization directives"); |
| 839 | |
| 840 | return HTTP_INTERNAL_SERVER_ERROR; |
| 841 | } |
| 842 | |
| 843 | ap_log_rerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, r, APLOGNO(01628) |
| 844 | "authorization result: granted (no directives)"); |
| 845 | |
| 846 | return OK; |
| 847 | } |
| 848 | |
| 849 | auth_result = apply_authz_sections(r, conf->section, AUTHZ_LOGIC_AND); |
| 850 | |
| 851 | if (auth_result == AUTHZ_GRANTED) { |
| 852 | return OK; |
| 853 | } |
| 854 | else if (auth_result == AUTHZ_DENIED_NO_USER) { |
| 855 | if (after_authn) { |
| 856 | ap_log_rerror(APLOG_MARK, APLOG_ERR, APR_SUCCESS, r, APLOGNO(01629) |
| 857 | "authorization failure (no authenticated user): %s", |
| 858 | r->uri); |
| 859 | /* |
| 860 | * If we're returning 401 to an authenticated user, tell them to |
| 861 | * try again. If unauthenticated, note_auth_failure has already |
| 862 | * been called during auth. |
| 863 | */ |
| 864 | if (r->user) |
| 865 | ap_note_auth_failure(r); |
| 866 | |
| 867 | return HTTP_UNAUTHORIZED; |
| 868 | } |
| 869 | else { |
| 870 | /* |
| 871 | * We need a user before we can decide what to do. |
| 872 | * Get out of the way and proceed with authentication. |
| 873 | */ |
| 874 | return DECLINED; |
| 875 | } |
| 876 | } |
| 877 | else if (auth_result == AUTHZ_DENIED || auth_result == AUTHZ_NEUTRAL) { |
| 878 | if (!after_authn || ap_auth_type(r) == NULL) { |
| 879 | ap_log_rerror(APLOG_MARK, APLOG_ERR, APR_SUCCESS, r, APLOGNO(01630) |
| 880 | "client denied by server configuration: %s%s", |
no test coverage detected