From 60723ea40ce14a9efe7391657b79c24c4ea9f86d Mon Sep 17 00:00:00 2001 From: Eric Covener Date: Tue, 5 May 2020 11:44:59 +0000 Subject: [PATCH] clarify, context is still CGI only. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1877394 13f79535-47bb-0310-9956-ffa450edef68 --- docs/manual/new_features_2_4.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/manual/new_features_2_4.xml b/docs/manual/new_features_2_4.xml index 57de00a77e4..30e3a1bfbc6 100644 --- a/docs/manual/new_features_2_4.xml +++ b/docs/manual/new_features_2_4.xml @@ -282,8 +282,8 @@ mod_isapi, ...
Translation of headers to environment variables is more strict than before to mitigate some possible cross-site-scripting attacks via header - injection. Headers containing invalid characters (including underscores) - are now silently dropped. Environment Variables + injection. Header names containing invalid characters (including underscores) + are no longer converted to environment variables. Environment Variables in Apache has some pointers on how to work around broken legacy clients which require such headers. (This affects all modules which use these environment variables.)
-- 2.47.3