This patch adds a <LimitExcept method ...> sectioning directive that allows
the user to assign authentication control to any HTTP method that
is *not* given in the argument list; i.e., the logical negation
of the <Limit> directive.  This is particularly useful for controlling
access on methods unknown to the Apache core, but perhaps known by
some module or CGI script. [Roy Fielding, Tony Finch]

Index: htdocs/manual/mod/core.html
===================================================================
RCS file: /home/cvs/apache-1.3/htdocs/manual/mod/core.html,v
retrieving revision 1.144
diff -u -r1.144 core.html
--- core.html	1999/02/06 11:00:57	1.144
+++ core.html	1999/02/09 20:16:18
@@ -49,6 +49,7 @@
 <LI><A HREF="#keepalive">KeepAlive</A>
 <LI><A HREF="#keepalivetimeout">KeepAliveTimeout</A>
 <LI><A HREF="#limit">&lt;Limit&gt;</A>
+<LI><A HREF="#limitexcept">&lt;LimitExcept&gt;</A>
 <LI><A HREF="#limitrequestbody">LimitRequestBody</A>
 <LI><A HREF="#limitrequestfields">LimitRequestFields</A>
 <LI><A HREF="#limitrequestfieldsize">LimitRequestFieldsize</A>
@@ -659,7 +660,8 @@
 
 The directory sections typically occur in the access.conf file, but they
 may appear in any configuration file. &lt;Directory&gt; directives cannot
-nest, and cannot appear in a <A HREF="#limit">&lt;Limit&gt;</A> section.
+nest, and cannot appear in a <A HREF="#limit">&lt;Limit&gt;</A> or
+<A HREF="#limitexcept">&lt;LimitExcept&gt;</A> section.
 <P>
 
 <STRONG>See also</STRONG>: <A HREF="../sections.html">How Directory,
@@ -1337,6 +1339,35 @@
 If GET is used it will also restrict HEAD requests.
 <STRONG>If you wish to limit all methods, do not include any
 &lt;Limit&gt; directive at all.</STRONG>
+
+<P><HR>
+
+<H2><A NAME="limitexcept">&lt;LimitExcept&gt; directive</A></H2>
+<!--%plaintext &lt;?INDEX {\tt LimitExcept} section directive&gt; -->
+<A
+ HREF="directive-dict.html#Syntax"
+ REL="Help"
+><STRONG>Syntax:</STRONG></A>
+ &lt;LimitExcept <EM>method method</EM> ... &gt; ... &lt;/LimitExcept&gt;<BR>
+<A
+ HREF="directive-dict.html#Context"
+ REL="Help"
+><STRONG>Context:</STRONG></A> any<BR>
+<A
+ HREF="directive-dict.html#Status"
+ REL="Help"
+><STRONG>Status:</STRONG></A> core<BR>
+<A
+ HREF="directive-dict.html#Compatibility"
+ REL="Help"
+><STRONG>Compatibility:</STRONG></A> Available in Apache 1.3.5 and later<P>
+
+&lt;LimitExcept&gt; and &lt;/LimitExcept&gt; are used to enclose a group of
+access control directives which will then apply to any HTTP access method
+<STRONG>not</STRONG> listed in the arguments; i.e., it is the opposite of a
+<A HREF="#limit">&lt;Limit&gt;</A> section and can be used to control both
+standard and nonstandard/unrecognized methods. See the documentation for 
+<A HREF="#limit">&lt;Limit&gt;</A> for more details.
 
 <P><HR>
 
Index: htdocs/manual/mod/directives.html
===================================================================
RCS file: /home/cvs/apache-1.3/htdocs/manual/mod/directives.html,v
retrieving revision 1.54
diff -u -r1.54 directives.html
--- directives.html	1999/02/06 11:00:57	1.54
+++ directives.html	1999/02/09 20:16:18
@@ -123,6 +123,7 @@
 <LI><A HREF="core.html#keepalivetimeout">KeepAliveTimeout</A>
 <LI><A HREF="mod_negotiation.html#languagepriority">LanguagePriority</A>
 <LI><A HREF="core.html#limit">&lt;Limit&gt;</A>
+<LI><A HREF="core.html#limitexcept">&lt;LimitExcept&gt;</A>
 <LI><A HREF="core.html#limitrequestbody">LimitRequestBody</A>
 <LI><A HREF="core.html#limitrequestfields">LimitRequestFields</A>
 <LI><A HREF="core.html#limitrequestfieldsize">LimitRequestFieldsize</A>
Index: src/main/http_core.c
===================================================================
RCS file: /home/cvs/apache-1.3/src/main/http_core.c,v
retrieving revision 1.248
diff -u -r1.248 http_core.c
--- http_core.c	1999/02/06 03:02:11	1.248
+++ http_core.c	1999/02/09 20:16:22
@@ -1241,6 +1241,7 @@
 						  const char *arg)
 {
     const char *limited_methods = ap_getword(cmd->pool, &arg, '>');
+    void *tog = cmd->cmd->cmd_data;
     int limited = 0;
   
     const char *err = ap_check_cmd_context(cmd, NOT_IN_LIMIT);
@@ -1249,7 +1250,7 @@
     }
 
     /* XXX: NB: Currently, we have no way of checking
-     * whether <Limit> sections are closed properly.
+     * whether <Limit> or <LimitExcept> sections are closed properly.
      * (If we would add a srm_command_loop() here we might...)
      */
     
@@ -1257,26 +1258,31 @@
         char *method = ap_getword_conf(cmd->pool, &limited_methods);
         int  methnum = ap_method_number_of(method);
 
-        if (methnum == M_TRACE) {
+        if (methnum == M_TRACE && !tog) {
             return "TRACE cannot be controlled by <Limit>";
         }
         else if (methnum == M_INVALID) {
-            return ap_pstrcat(cmd->pool, "unknown method \"",
-                              method, "\" in <Limit>", NULL);
+            return ap_pstrcat(cmd->pool, "unknown method \"", method,
+                              "\" in <Limit", tog ? "Except>" : ">", NULL);
         }
         else {
             limited |= (1 << methnum);
         }
     }
 
-    cmd->limited = limited;
+    /* Killing two features with one function,
+     * if (tog == NULL) <Limit>, else <LimitExcept>
+     */
+    cmd->limited = tog ? ~limited : limited;
     return NULL;
 }
 
 static const char *endlimit_section(cmd_parms *cmd, void *dummy, void *dummy2)
 {
+    void *tog = cmd->cmd->cmd_data;
+
     if (cmd->limited == -1) {
-        return "</Limit> unexpected";
+        return tog ? "</LimitExcept> unexpected" : "</Limit> unexpected";
     }
     
     cmd->limited = -1;
@@ -2675,6 +2681,11 @@
   "authentication directives when accessed using specified HTTP methods" },
 { "</Limit>", endlimit_section, NULL, OR_ALL, NO_ARGS,
   "Marks end of <Limit>" },
+{ "<LimitExcept", ap_limit_section, (void*)1, OR_ALL, RAW_ARGS,
+  "Container for authentication directives to be applied when any HTTP "
+  "method other than those specified is used to access the resource" },
+{ "</LimitExcept>", endlimit_section, (void*)1, OR_ALL, NO_ARGS,
+  "Marks end of <LimitExcept>" },
 { "<IfModule", start_ifmod, NULL, OR_ALL, TAKE1,
   "Container for directives based on existance of specified modules" },
 { end_ifmodule_section, end_ifmod, NULL, OR_ALL, NO_ARGS,