You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by tr...@apache.org on 2007/12/15 14:27:56 UTC
svn commit: r604425 - in /httpd/httpd/branches/2.0.x: CHANGES STATUS
modules/http/http_protocol.c
Author: trawick
Date: Sat Dec 15 05:27:55 2007
New Revision: 604425
URL: http://svn.apache.org/viewvc?rev=604425&view=rev
Log:
merge r600645 from trunk:
http_protocol: Escape request method in 413 error reporting.
Determined to be not generally exploitable, but a flaw in any case.
PR 44014
Submitted by: Victor Stinner <victor.stinner inl.fr>
Reviewed by: wrowe, rpluem, trawick
Modified:
httpd/httpd/branches/2.0.x/CHANGES
httpd/httpd/branches/2.0.x/STATUS
httpd/httpd/branches/2.0.x/modules/http/http_protocol.c
Modified: httpd/httpd/branches/2.0.x/CHANGES
URL: http://svn.apache.org/viewvc/httpd/httpd/branches/2.0.x/CHANGES?rev=604425&r1=604424&r2=604425&view=diff
==============================================================================
--- httpd/httpd/branches/2.0.x/CHANGES [utf-8] (original)
+++ httpd/httpd/branches/2.0.x/CHANGES [utf-8] Sat Dec 15 05:27:55 2007
@@ -1,6 +1,10 @@
-*- coding: utf-8 -*-
Changes with Apache 2.0.62
+ *) http_protocol: Escape request method in 413 error reporting.
+ Determined to be not generally exploitable, but a flaw in any case.
+ PR 44014 [Victor Stinner <victor.stinner inl.fr>]
+
*) SECURITY: CVE-2007-5000 (cve.mitre.org)
mod_imagemap: Fix a cross-site scripting issue. Reported by JPCERT.
[Joe Orton]
Modified: httpd/httpd/branches/2.0.x/STATUS
URL: http://svn.apache.org/viewvc/httpd/httpd/branches/2.0.x/STATUS?rev=604425&r1=604424&r2=604425&view=diff
==============================================================================
--- httpd/httpd/branches/2.0.x/STATUS (original)
+++ httpd/httpd/branches/2.0.x/STATUS Sat Dec 15 05:27:55 2007
@@ -129,12 +129,6 @@
PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
[ start all new proposals below, under PATCHES PROPOSED. ]
- * http_protocol: Escape request method in 413 error reporting.
- Determined to be not generally exploitable, but a flaw in any case.
- PR 44014 [Victor Stinner <victor.stinner inl.fr>]
- http://svn.apache.org/viewvc?view=rev&rev=600645
- +1: wrowe, rpluem, trawick
-
* http_protocol: Escape request method in 405 error reporting.
Trunk:
http://svn.apache.org/viewvc?view=rev&revision=603346
Modified: httpd/httpd/branches/2.0.x/modules/http/http_protocol.c
URL: http://svn.apache.org/viewvc/httpd/httpd/branches/2.0.x/modules/http/http_protocol.c?rev=604425&r1=604424&r2=604425&view=diff
==============================================================================
--- httpd/httpd/branches/2.0.x/modules/http/http_protocol.c (original)
+++ httpd/httpd/branches/2.0.x/modules/http/http_protocol.c Sat Dec 15 05:27:55 2007
@@ -2200,7 +2200,7 @@
case HTTP_LENGTH_REQUIRED:
s1 = apr_pstrcat(p,
"<p>A request of the requested method ",
- r->method,
+ ap_escape_html(r->pool, r->method),
" requires a valid Content-length.<br />\n",
NULL);
return(add_optional_notes(r, s1, "error-notes", "</p>\n"));
@@ -2247,7 +2247,7 @@
"The requested resource<br />",
ap_escape_html(r->pool, r->uri), "<br />\n",
"does not allow request data with ",
- r->method,
+ ap_escape_html(r->pool, r->method),
" requests, or the amount of data provided in\n"
"the request exceeds the capacity limit.\n",
NULL));