From: Rich Bowen Date: Tue, 28 Apr 2026 13:45:45 +0000 (+0000) Subject: Remove reference to a conference presentation from 2007 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=2dbcaef48ff7bf9b638e933cd5dcdc60056a258f;p=thirdparty%2Fapache%2Fhttpd.git Remove reference to a conference presentation from 2007 git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1933421 13f79535-47bb-0310-9956-ffa450edef68 --- diff --git a/docs/manual/env.xml b/docs/manual/env.xml index e8218b23d3..6eeaef42ee 100644 --- a/docs/manual/env.xml +++ b/docs/manual/env.xml @@ -513,9 +513,7 @@ headers are converted to environment variables in mod_cgi and other modules: Previously any invalid characters in header names were simply translated to underscores. This allowed - for some potential cross-site-scripting attacks via header injection - (see - Unusual Web Bugs, slide 19/20).

+ for some potential cross-site-scripting attacks via header injection.

If you have to support a client which sends broken headers and which can't be fixed, a simple workaround involving mod_setenvif