ngx_cache_purge: fix 404 on non-PURGE requests when "if" block is present

When nginx processes an "if" directive inside a location block, it creates
an anonymous child location and calls merge_loc_conf to propagate the
parent's configuration into it.  At that point clcf->handler is already
set to ngx_http_cache_purge_access_handler by the parent merge pass.
The child merge re-entered the proxy.enable (or fastcgi/scgi/uwsgi)
branch, saved ngx_http_cache_purge_access_handler into original_handler,
then set clcf->handler to ngx_http_cache_purge_access_handler again.
On any non-PURGE request that triggered the "if" block, access_handler
called original_handler(r), which called access_handler again, producing
a 404 instead of forwarding to the upstream handler.

Fix: in each of the four protocol branches in merge_loc_conf, check
whether clcf->handler is already our own access handler before recording
it as original_handler.  If it is, the merge is being called for an
anonymous "if" child location; inherit original_handler from the parent
conf instead.  This preserves the pointer to the real upstream handler
(e.g. ngx_http_proxy_handler) across the child merge and ensures that
non-PURGE requests entering the "if" branch are forwarded correctly.

The bug is present in v3.0.0 and later.  v2.x is not affected because
it used a different handler installation strategy.

Issues: #63

Author: denji

ngx_cache_purge_module.c

@@ -3353,10 +3353,14 @@ ngx_http_cache_purge_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child)
     ngx_http_cache_purge_merge_conf(&conf->fastcgi, &prev->fastcgi);
 
     if (conf->fastcgi.enable) {
-        conf->conf             = &conf->fastcgi;
-        conf->handler          = ngx_http_fastcgi_cache_purge_handler;
-        conf->original_handler = clcf->handler;  /* may be NULL */
-        clcf->handler          = ngx_http_cache_purge_access_handler;
+        conf->conf    = &conf->fastcgi;
+        conf->handler = ngx_http_fastcgi_cache_purge_handler;
+        if (clcf->handler != ngx_http_cache_purge_access_handler) {
+            conf->original_handler = clcf->handler;
+            clcf->handler          = ngx_http_cache_purge_access_handler;
+        } else {
+            conf->original_handler = prev->original_handler;
+        }
         return NGX_CONF_OK;
     }
 # endif
@@ -3365,16 +3369,14 @@ ngx_http_cache_purge_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child)
     ngx_http_cache_purge_merge_conf(&conf->proxy, &prev->proxy);
 
     if (conf->proxy.enable) {
-        /*
-         * Install the purge access-handler even when clcf->handler is
-         * NULL (i.e. when proxy_cache is configured without proxy_pass).
-         * original_handler may legitimately be NULL here; the access
-         * handler guards against dereferencing it below.
-         */
-        conf->conf             = &conf->proxy;
-        conf->handler          = ngx_http_proxy_cache_purge_handler;
-        conf->original_handler = clcf->handler;  /* may be NULL */
-        clcf->handler          = ngx_http_cache_purge_access_handler;
+        conf->conf    = &conf->proxy;
+        conf->handler = ngx_http_proxy_cache_purge_handler;
+        if (clcf->handler != ngx_http_cache_purge_access_handler) {
+            conf->original_handler = clcf->handler;
+            clcf->handler          = ngx_http_cache_purge_access_handler;
+        } else {
+            conf->original_handler = prev->original_handler;
+        }
         return NGX_CONF_OK;
     }
 # endif
@@ -3383,10 +3385,14 @@ ngx_http_cache_purge_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child)
     ngx_http_cache_purge_merge_conf(&conf->scgi, &prev->scgi);
 
     if (conf->scgi.enable) {
-        conf->conf             = &conf->scgi;
-        conf->handler          = ngx_http_scgi_cache_purge_handler;
-        conf->original_handler = clcf->handler;  /* may be NULL */
-        clcf->handler          = ngx_http_cache_purge_access_handler;
+        conf->conf    = &conf->scgi;
+        conf->handler = ngx_http_scgi_cache_purge_handler;
+        if (clcf->handler != ngx_http_cache_purge_access_handler) {
+            conf->original_handler = clcf->handler;
+            clcf->handler          = ngx_http_cache_purge_access_handler;
+        } else {
+            conf->original_handler = prev->original_handler;
+        }
         return NGX_CONF_OK;
     }
 # endif
@@ -3395,10 +3401,14 @@ ngx_http_cache_purge_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child)
     ngx_http_cache_purge_merge_conf(&conf->uwsgi, &prev->uwsgi);
 
     if (conf->uwsgi.enable) {
-        conf->conf             = &conf->uwsgi;
-        conf->handler          = ngx_http_uwsgi_cache_purge_handler;
-        conf->original_handler = clcf->handler;  /* may be NULL */
-        clcf->handler          = ngx_http_cache_purge_access_handler;
+        conf->conf    = &conf->uwsgi;
+        conf->handler = ngx_http_uwsgi_cache_purge_handler;
+        if (clcf->handler != ngx_http_cache_purge_access_handler) {
+            conf->original_handler = clcf->handler;
+            clcf->handler          = ngx_http_cache_purge_access_handler;
+        } else {
+            conf->original_handler = prev->original_handler;
+        }
         return NGX_CONF_OK;
     }
 # endif