Repository navigation
mod_autoindex: Don't clamp a pre-1970 last-modified date when sorting. - #1028
Open
arturobernalg wants to merge 1 commit into
Open
arturobernalg wants to merge 1 commit into
arturobernalg wants to merge 1 commit into
Conversation
make_autoindex_entry() clamped any negative apr_time_t mtime to 0 when the listing's sort key was K_LAST_MOD, so a file or directory actually modified before 1970 was displayed as 1970-01-01 in a listing sorted by date (?C=M) -- while the same entry in the default, unsorted order (which doesn't hit that code path) already showed its real date. The clamp dates back to the 1999 import of the Apache 1.3 codebase, from an era before apr_time_t's signed 64-bit microseconds-since-epoch could reliably represent dates before 1970. The module's own sentinel for "no mtime available" is the literal value -1 (checked with `lm != -1` at both call sites that format it for display), not "any negative value", so clamping every negative value here only corrupts genuine pre-1970 timestamps; it was never needed to guard the sentinel. Reproduced on a real build: a file with mtime touch -d 1958-01-01 showed "1958-01-01" in the default listing and "1970-01-01" once sorted with ?C=M. After removing the clamp, both orderings show the real 1958 date. PR 66182
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
make_autoindex_entry() clamped any negative apr_time_t mtime to 0 when the listing's sort key was K_LAST_MOD, so a file or directory actually modified before 1970 was displayed as 1970-01-01 in a listing sorted by date (?C=M) -- while the same entry in the default, unsorted order (which doesn't hit that code path) already showed its real date.
The clamp dates back to the 1999 import of the Apache 1.3 codebase, from an era before apr_time_t's signed 64-bit microseconds-since-epoch could reliably represent dates before 1970. The module's own sentinel for "no mtime available" is the literal value -1 (checked with
lm != -1at both call sites that format it for display), not "any negative value", so clamping every negative value here only corrupts genuine pre-1970 timestamps; it was never needed to guard the sentinel.Reproduced on a real build: a file with mtime
touch -d 1958-01-01showed "1958-01-01" in the default listing and "1970-01-01" once sorted with ?C=M. After removing the clamp, both orderings show the real 1958 date. Confirmed RED (clamp present) and GREEN (clamp removed) with the new regression test, run against a real server.PR 66182
[x] This PR does not report or address a security vulnerability (see SECURITY.md and https://www.apache.org/security/#reporting-a-vulnerability).
[x] Code follows the httpd style guide.
[x] New log messages (level debug or higher) use an empty APLOGNO() tag (not applicable -- no new log messages).
[x] If the change is user-visible, a changes-entries/*.txt file is included.
[x] Test cases based on pyhttpd are included where appropriate (test/modules/generators/test_002_autoindex.py, extended with a new RED/GREEN-verified regression test).