You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@httpd.apache.org by Martin Kraemer <Ma...@mch.sni.de> on 2000/02/16 17:33:50 UTC

Security fixes in mod_speling

Here's another candidate for HTML spoofing. mod_speling would happily
print whatever HTTP_REFERER contained, and would also display
REQUEST_URI unescaped.

I was going to commit it, but the /home/cvs/ directory on locus
has no x-bit, so someone else will have to do it (or change the
permissions). Also, I seem to get no response on my mails from the
new-httpd list.

    Martin
-- 
  <Ma...@MchP.Siemens.De>      |       Fujitsu Siemens
       <ma...@apache.org>              |   81730  Munich,  Germany
((See you at ApacheCon 2000 in Orlanda, Florida, March 8-10, 2000!))
		   <URL:http://ApacheCon.Com/>