[Bug 63688] Balancer Manager: problem with CSRF protection

[bu...@apache.org]

https://bz.apache.org/bugzilla/show_bug.cgi?id=63688

--- Comment #2 from Horst <hp...@localhorst.org> ---
hi all,

mybe i found a kind of same problem. in my configuration i used
the balancer manager behind a proxy

 -------------
|Bastian Host |
|Apache Proxy | -----------> LB Apache Balancer Manger
 -------------

and i struggle in the problem with an update from Ubuntu 18.04
which i described in the following bug report

https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/1842701

on localhost with lynx i figure out error log entrys with every
submit and no update from the load data etc.

:~# tail -f /var/log/apache2/management_error.log
[Wed Sep 04 12:28:58.249737 2019] [proxy_balancer:error] [pid 14669:tid
140254497400576] [client 127.0.0.1:42844] AH10187: ignoring params in
balancer-manager cross-site access
[Wed Sep 04 12:29:09.585221 2019] [proxy_balancer:error] [pid 14669:tid
140254623291136] [client 127.0.0.1:42848] AH10187: ignoring params in
balancer-manager cross-site access


i can reproduce this within debian 10

:~# apt-get install apache2

:~# dpkg -l | grep apache2
ii  apache2          2.4.38-3+deb10u1
ii  apache2-bin      2.4.38-3+deb10u1
ii  apache2-data     2.4.38-3+deb10u1
ii  apache2-utils    2.4.38-3+deb10u1

i download the prior version from the module and compile that version

http://svn.apache.org/repos/asf/httpd/httpd/tags/2.4.40/modules/proxy/mod_proxy_balancer.c

:~# apxs2 -c -i mod_proxy_balancer.c

:~# systemctl restart apache2

:~# lynx 127.0.0.1:81/balancer-manager
:~# elinks 127.0.0.1:81/balancer-manager
Browser: http://192.168.56.211:81/balancer-manager

i can use the balancer manager as expected without any error log entry

i compiled also that version from
https://svn.apache.org/viewvc?view=revision&revision=1865749
but with no luck.

regards horst

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org