Index: httpd-2.2.34/modules/aaa/mod_auth_digest.c
===================================================================
--- httpd-2.2.34.orig/modules/aaa/mod_auth_digest.c	2019-04-02 14:45:01.740617051 +0200
+++ httpd-2.2.34/modules/aaa/mod_auth_digest.c	2019-04-02 15:12:18.668990256 +0200
@@ -99,7 +99,6 @@ typedef struct digest_config_struct {
     int          check_nc;
     const char  *algorithm;
     char        *uri_list;
-    const char  *ha1;
 } digest_config_rec;
 
 
@@ -161,6 +160,7 @@ typedef struct digest_header_struct {
     const char           *raw_request_uri;
     apr_uri_t            *psd_request_uri;
     int                   needed_auth;
+    const char           *ha1;
     client_entry         *client;
 } digest_header_rec;
 
@@ -1180,11 +1180,10 @@ static client_entry *gen_client(const re
  * version of apache.
  */
 static const char *get_userpw_hash(const request_rec *r,
-                                   const digest_header_rec *resp,
-                                   const digest_config_rec *conf)
+                                   const digest_header_rec *resp)
 {
     return ap_md5(r->pool,
-             (unsigned char *) apr_pstrcat(r->pool, conf->ha1, ":", resp->nonce,
+             (unsigned char *) apr_pstrcat(r->pool, resp->ha1, ":", resp->nonce,
                                            ":", resp->cnonce, NULL));
 }
 
@@ -1197,7 +1196,6 @@ static const char *get_userpw_hash(const
  */
 static const char *get_session_HA1(const request_rec *r,
                                    digest_header_rec *resp,
-                                   const digest_config_rec *conf,
                                    int generate)
 {
     const char *ha1 = NULL;
@@ -1215,7 +1213,7 @@ static const char *get_session_HA1(const
         resp->client = gen_client(r);
     }
     if (resp->client) {
-        ha1 = get_userpw_hash(r, resp, conf);
+        ha1 = get_userpw_hash(r, resp);
         if (ha1) {
             memcpy(resp->client->ha1, ha1, sizeof(resp->client->ha1));
         }
@@ -1358,7 +1356,7 @@ static void note_digest_auth_failure(req
  */
 
 static authn_status get_hash(request_rec *r, const char *user,
-                             digest_config_rec *conf)
+                             digest_config_rec *conf, const char **rethash)
 {
     authn_status auth_result;
     char *password;
@@ -1409,7 +1407,7 @@ static authn_status get_hash(request_rec
     } while (current_provider);
 
     if (auth_result == AUTH_USER_FOUND) {
-        conf->ha1 = password;
+        *rethash = password;
     }
 
     return auth_result;
@@ -1516,32 +1514,31 @@ static int check_nonce(request_rec *r, d
 
 /* RFC-2069 */
 static const char *old_digest(const request_rec *r,
-                              const digest_header_rec *resp, const char *ha1)
+                              const digest_header_rec *resp)
 {
     const char *ha2;
 
     ha2 = ap_md5(r->pool, (unsigned char *)apr_pstrcat(r->pool, resp->method, ":",
                                                        resp->uri, NULL));
     return ap_md5(r->pool,
-                  (unsigned char *)apr_pstrcat(r->pool, ha1, ":", resp->nonce,
+                  (unsigned char *)apr_pstrcat(r->pool, resp->ha1, ":", resp->nonce,
                                               ":", ha2, NULL));
 }
 
 /* RFC-2617 */
 static const char *new_digest(const request_rec *r,
-                              digest_header_rec *resp,
-                              const digest_config_rec *conf)
+                              digest_header_rec *resp)
 {
     const char *ha1, *ha2, *a2;
 
     if (resp->algorithm && !strcasecmp(resp->algorithm, "MD5-sess")) {
-        ha1 = get_session_HA1(r, resp, conf, 1);
+        ha1 = get_session_HA1(r, resp, 1);
         if (!ha1) {
             return NULL;
         }
     }
     else {
-        ha1 = conf->ha1;
+        ha1 = resp->ha1;
     }
 
     if (resp->message_qop && !strcasecmp(resp->message_qop, "auth-int")) {
@@ -1562,7 +1559,6 @@ static const char *new_digest(const requ
                                                NULL));
 }
 
-
 static void copy_uri_components(apr_uri_t *dst,
                                 apr_uri_t *src, request_rec *r) {
     if (src->scheme && src->scheme[0] != '\0') {
@@ -1800,7 +1796,7 @@ static int authenticate_digest_user(requ
         return HTTP_UNAUTHORIZED;
     }
 
-    return_code = get_hash(r, r->user, conf);
+    return_code = get_hash(r, r->user, conf, &resp->ha1);
 
     if (return_code == AUTH_USER_NOT_FOUND) {
         ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
@@ -1830,7 +1826,7 @@ static int authenticate_digest_user(requ
 
     if (resp->message_qop == NULL) {
         /* old (rfc-2069) style digest */
-        if (strcmp(resp->digest, old_digest(r, resp, conf->ha1))) {
+        if (strcmp(resp->digest, old_digest(r, resp))) {
             ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
                           "Digest: user %s: password mismatch: %s", r->user,
                           r->uri);
@@ -1858,7 +1854,7 @@ static int authenticate_digest_user(requ
             return HTTP_UNAUTHORIZED;
         }
 
-        exp_digest = new_digest(r, resp, conf);
+        exp_digest = new_digest(r, resp);
         if (!exp_digest) {
             /* we failed to allocate a client struct */
             return HTTP_INTERNAL_SERVER_ERROR;
@@ -1948,7 +1944,7 @@ static int add_auth_info(request_rec *r)
                        NULL));
         digest =
             ap_md5(r->pool,
-                   (unsigned char *)apr_pstrcat(r->pool, conf->ha1, ":",
+                   (unsigned char *)apr_pstrcat(r->pool, resp->ha1, ":",
                                                resp->nonce, ":",
                                                r->method, ":",
                                                date, ":",
@@ -1999,7 +1995,7 @@ static int add_auth_info(request_rec *r)
         /* calculate rspauth attribute
          */
         if (resp->algorithm && !strcasecmp(resp->algorithm, "MD5-sess")) {
-            ha1 = get_session_HA1(r, resp, conf, 0);
+            ha1 = get_session_HA1(r, resp, 0);
             if (!ha1) {
                 ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
                               "Digest: internal error: couldn't find session "
@@ -2008,7 +2004,7 @@ static int add_auth_info(request_rec *r)
             }
         }
         else {
-            ha1 = conf->ha1;
+            ha1 = resp->ha1;
         }
 
         if (resp->message_qop && !strcasecmp(resp->message_qop, "auth-int")) {
