[Bug 45187] Long File name requests gives FORBIDDEN response

[b***@apache.org]

https://bz.apache.org/bugzilla/show_bug.cgi?id=45187

--- Comment #25 from ernesto <***@gmail.com> ---
I think you need to try Long Path Tool on this situation. I hope that it helps.

[b***@apache.org]

https://bz.apache.org/bugzilla/show_bug.cgi?id=45187

--- Comment #26 from Taksh <***@gmail.com> ---
I am facing the same issue.

Apache logs :

[2016-01-25T18:48:31.5980+05:30] [OHS] [ERROR:32] [OHS-9999] [core.c]
[client_id: 10.87.152.136] [host_id: WCUATINFRA] [host_addr: 10.87.206.108]
[tid: 10024] [user: oracle] [ecid: 000001blLQC4mnVLu2d9iX01K02Y00001s] [rid: 0]
[VirtualHost: main] (86)File name too long: Cannot map POST
/CSSPortal/resourceproxy/~.portletId~3D~252Foracle~252Fadf~252Fportlet~252FWSRP~252Fap~252FLoginPortlet_7aab73f3_013f_1000_8001_0a4d30708e34~26clientId~3D1315943251~26resourceId~3Dwsrp-url~25253D~252526wsrp-resourceID~25253D_wlp-nullResId~252526wsrp-preferOperation~25253Dtrue~252526wsrp-requiresRewrite~25253D~252526wsrp-resourceState~25253DeJyLL07OL0i1zc1PSQ0GsVLUiooKbNXSc-KTEnNsAbM4C0U~252526wsrp-resourceCacheability~25253Dpage~252526wsrp-navigationalValues~25253D~252526oracle~2525253Arunnable-attribs~25253Doracle.portlet.newNavigationalContextScope~2525253Dtrue~25252526oracle.portlet.request.context.string.currentPagePath~2525253D~252525252Foracle~252525252Fwebcenter~252525252Fportalapp~252525252Fpages~252525252FCSSLogin.jspx~25252526oracle.adf.portlet.Stretched~2525253Dtrue~25252526oracle.portlet.request.context.string.currentPageName~2525253DCSSLogin.jspx~26baseUrl~3Dhttps~253A~252F~252Fmyvodafonesit.vodafone.in~252FCSSPortal~252Ffaces~252Foracle~252Fwebcenter~252Fportalapp~252Fp
ages~252FCSSLogin.jspx~253F_adf.ctrl-state~253D8ihv1i5j6_4~2526_afrLoop~253D121736612963976677~26locale~3Den~26checksum~3D40bc02cce3ffe09b2544145448ed393856a2b5e8/_wlp-nullResId
HTTP/1.1 to file, referer:
https://myvodafonesit.vodafone.in/CSSPortal/adfportlet?_adfp_request_id=748695f0-d211-4047-a29a-7aa0418e7cbc&_adfp_icr=1


Browser log :

"NetworkError: 403 Forbidden -
https://myvodafonesit.vodafone.in/CSSPortal/resourceproxy/~.portletId~3D~252Foracle~252Fadf~252Fportlet~252FWSRP~252Fap~252FLoginPortlet_7aab73f3_013f_1000_8001_0a4d30708e34~26clientId~3D1315943251~26resourceId~3Dwsrp-url~25253D~252526wsrp-resourceID~25253D_wlp-nullResId~252526wsrp-preferOperation~25253Dtrue~252526wsrp-requiresRewrite~25253D~252526wsrp-resourceState~25253DeJyLL07OL0i1zc1PSQ0GsVLUiooKbNXSc-KTEnNsAbM4C0U~252526wsrp-resourceCacheability~25253Dpage~252526wsrp-navigationalValues~25253D~252526oracle~2525253Arunnable-attribs~25253Doracle.portlet.newNavigationalContextScope~2525253Dtrue~25252526oracle.portlet.request.context.string.currentPagePath~2525253D~252525252Foracle~252525252Fwebcenter~252525252Fportalapp~252525252Fpages~252525252FCSSLogin.jspx~25252526oracle.adf.portlet.Stretched~2525253Dtrue~25252526oracle.portlet.request.context.string.currentPageName~2525253DCSSLogin.jspx~26baseUrl~3Dhttps~253A~252F~252Fmyvodafonesit.vodafone.in~252FCSSPortal~252Ffaces~252Foracle~
252Fwebcenter~252Fportalapp~252Fpages~252FCSSLogin.jspx~253F_adf.ctrl-state~253D8ihv1i5j6_4~2526_afrLoop~253D121736612963976677~26locale~3Den~26checksum~3D40bc02cce3ffe09b2544145448ed393856a2b5e8/_wlp-nullResId"

[b***@apache.org]

https://bz.apache.org/bugzilla/show_bug.cgi?id=45187

--- Comment #27 from ***@gmail.com ---
You can also checkout long path tool, it's an automated software for this type
of errors

[b***@apache.org]

https://bz.apache.org/bugzilla/show_bug.cgi?id=45187

Szőgyényi Gábor <***@freemail.hu> changed:

What |Removed |Added
----------------------------------------------------------------------------
CC| |***@freemail.hu

[b***@apache.org]

https://bz.apache.org/bugzilla/show_bug.cgi?id=45187

--- Comment #28 from liona jackson <***@rediffmail.com> ---
I have recently used a program called Long Path Tool & i am so happy with the
results that this particular program does. I have more than 50 GB of duplicate
files in my computer and i was going crazy with the hard disk space that was
being consumed and thanks to the "Long Path Tool" where i don't need to search
each & every file to delete. Long Path Tool did the job for me within a very
short period of time. So no need to google each problem to remove duplicate &
unwanted files, just grab the program called Long Path Tool.

[b***@apache.org]

https://bz.apache.org/bugzilla/show_bug.cgi?id=45187

--- Comment #29 from liona jackson <***@rediffmail.com> ---
In other words same situation was for me before but when i installed Long Path
Tool, my computer was organized easily and i got relaxed from everyday files
and junk.

[b***@apache.org]

https://bz.apache.org/bugzilla/show_bug.cgi?id=45187

William A. Rowe Jr. <***@apache.org> changed:

What |Removed |Added
----------------------------------------------------------------------------
Resolution|--- |LATER
Status|NEW |RESOLVED
Keywords| |MassUpdate

--- Comment #30 from William A. Rowe Jr. <***@apache.org> ---
Please help us to refine our list of open and current defects; this is a mass
update of old and inactive Bugzilla reports which reflect user error, already
resolved defects, and still-existing defects in httpd.

As repeatedly announced, the Apache HTTP Server Project has discontinued all
development and patch review of the 2.2.x series of releases. The final release
2.2.34 was published in July 2017, and no further evaluation of bug reports or
security risks will be considered or published for 2.2.x releases. All reports
older than 2.4.x have been updated to status RESOLVED/LATER; no further action
is expected unless the report still applies to a current version of httpd.

If your report represented a question or confusion about how to use an httpd
feature, an unexpected server behavior, problems building or installing httpd,
or working with an external component (a third party module, browser etc.) we
ask you to start by bringing your question to the User Support and Discussion
mailing list, see [https://httpd.apache.org/lists.html#http-users] for details.
Include a link to this Bugzilla report for completeness with your question.

If your report was clearly a defect in httpd or a feature request, we ask that
you retest using a modern httpd release (2.4.33 or later) released in the past
year. If it can be reproduced, please reopen this bug and change the Version
field above to the httpd version you have reconfirmed with.

Your help in identifying defects or enhancements still applicable to the
current httpd server software release is greatly appreciated.

[b***@apache.org]

https://bz.apache.org/bugzilla/show_bug.cgi?id=45187

Roman Garcia <***@gmail.com> changed:

What |Removed |Added
----------------------------------------------------------------------------
Version|2.2.4 |2.4.7
Status|RESOLVED |REOPENED
Resolution|LATER |---

--- Comment #31 from Roman Garcia <***@gmail.com> ---
Revalidated this bug against HTTPD 2.4.7. Still there.

How to reproduce:
- Download sources for HTTPD 2.4.7
- Install build dependencies
- Configure, Make, Install
- Apachectl start
- On a browser, fetch the following URL:
http://localhost/estoesunademodeloquenopuedepasarporquesiunoponeuestoesunademodeloquenopuedepasarporquesiunoponeuestoesunademodeloquenopuedepasarporquesiunoponeuestoesunademodeloquenopuedepasarporquesiunoponeuestoesunademodeloquenopuedepasarporquesiunoponeu257chars0123456
- You get NOT FOUND
- Now fetch the following URL (1 more character on the url):
http://localhost/estoesunademodeloquenopuedepasarporquesiunoponeuestoesunademodeloquenopuedepasarporquesiunoponeuestoesunademodeloquenopuedepasarporquesiunoponeuestoesunademodeloquenopuedepasarporquesiunoponeuestoesunademodeloquenopuedepasarporquesiunoponeu257chars01234567
- You get FORBIDDEN!

[b***@apache.org]

https://bz.apache.org/bugzilla/show_bug.cgi?id=45187

--- Comment #32 from Luca Toscano <***@gmail.com> ---
Hi Roman,

have you tried to modify
http://httpd.apache.org/docs/2.4/mod/core.html#limitrequestline ?

[William A Rowe Jr]

In response to #32, Luca, this behavior is understood and clarified in the
above
comments; it is an open question how to respond to APR_ENAMETOOLONG.
Will treating this as a not-found case introduce security risks? That's the
question.

Post by b***@apache.org
https://bz.apache.org/bugzilla/show_bug.cgi?id=45187
Hi Roman,
have you tried to modify
http://httpd.apache.org/docs/2.4/mod/core.html#limitrequestline ?
--
You are the assignee for the bug.
---------------------------------------------------------------------