You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by co...@apache.org on 2023/11/16 19:53:19 UTC
svn commit: r1913855 - in /httpd/httpd/trunk: changes-entries/ldap_status.txt modules/ldap/util_ldap_cache.c
Author: covener
Date: Thu Nov 16 19:53:18 2023
New Revision: 1913855
URL: http://svn.apache.org/viewvc?rev=1913855&view=rev
Log:
mod_ldap: HTML-escape ldap-status handler.
Reported by Chamal De Silva.
Added:
httpd/httpd/trunk/changes-entries/ldap_status.txt
Modified:
httpd/httpd/trunk/modules/ldap/util_ldap_cache.c
Added: httpd/httpd/trunk/changes-entries/ldap_status.txt
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/changes-entries/ldap_status.txt?rev=1913855&view=auto
==============================================================================
--- httpd/httpd/trunk/changes-entries/ldap_status.txt (added)
+++ httpd/httpd/trunk/changes-entries/ldap_status.txt Thu Nov 16 19:53:18 2023
@@ -0,0 +1,2 @@
+ *) mod_ldap: HTML-escape data in the ldap-status handler.
+ [Eric Covener, Chamal De Silva]
Modified: httpd/httpd/trunk/modules/ldap/util_ldap_cache.c
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ldap/util_ldap_cache.c?rev=1913855&r1=1913854&r2=1913855&view=diff
==============================================================================
--- httpd/httpd/trunk/modules/ldap/util_ldap_cache.c (original)
+++ httpd/httpd/trunk/modules/ldap/util_ldap_cache.c Thu Nov 16 19:53:18 2023
@@ -230,8 +230,8 @@ void util_ldap_search_node_display(reque
"<td nowrap>%s</td>"
"<td nowrap>%s</td>"
"</tr>",
- node->username,
- node->dn,
+ ap_escape_html(r->pool, node->username),
+ ap_escape_html(r->pool, node->dn),
date_str);
}
@@ -331,9 +331,9 @@ void util_ldap_compare_node_display(requ
"<td nowrap>%s</td>"
"<td nowrap>%s</td>"
"</tr>",
- node->dn,
- node->attrib,
- node->value,
+ ap_escape_html(r->pool, node->dn),
+ ap_escape_html(r->pool, node->attrib),
+ ap_escape_html(r->pool, node->value),
date_str,
cmp_result,
sub_groups_val,
@@ -391,8 +391,8 @@ void util_ldap_dn_compare_node_display(r
"<td nowrap>%s</td>"
"<td nowrap>%s</td>"
"</tr>",
- node->reqdn,
- node->dn);
+ ap_escape_html(r->pool, node->reqdn),
+ ap_escape_html(r->pool, node->dn));
}