]> git.ipfire.org Git - thirdparty/apache/httpd.git/commitdiff
projects / thirdparty / apache / httpd.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: 08845c1)
http://svn.apache.org/viewvc?rev=606693&view=rev
authorJim Jagielski <jim@apache.org>
Wed, 2 Jan 2008 19:29:59 +0000 (19:29 +0000)
committerJim Jagielski <jim@apache.org>
Wed, 2 Jan 2008 19:29:59 +0000 (19:29 +0000)
     http://svn.apache.org/viewvc?rev=607276&view=rev

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@608194 13f79535-47bb-0310-9956-ffa450edef68

CHANGES patch | blob | blame | history
STATUS patch | blob | blame | history
modules/dav/main/mod_dav.c patch | blob | blame | history
modules/experimental/util_ldap.c patch | blob | blame | history
modules/generators/mod_info.c patch | blob | blame | history
modules/proxy/proxy_ftp.c patch | blob | blame | history

diff --git a/CHANGES b/CHANGES
index 7dd99a6ccf25b8d16cd845e5cb6e5839bbf760f3..e55a69a17ad4fcb26116107a7ac4aefa938f2c34 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -17,6 +17,11 @@ Changes with Apache 2.0.62
      shutdown of the server when the MaxClients is higher then 257,
      in a more responsive manner [Mladen Turk, William Rowe]
 
+  *) Add explicit charset to the output of various modules to work around
+     possible cross-site scripting flaws affecting web browsers that do not
+     derive the response character set as required by  RFC2616.  One of these
+     reported by SecurityReason [Joe Orton]
+
   *) http_protocol: Escape request method in 405 error reporting.
      This has no security impact since the browser cannot be tricked
      into sending arbitrary method strings.  [Jeff Trawick]
diff --git a/STATUS b/STATUS
index 7b05229cfcbd056a01a5a183e7f8e1fa7ae32c8b..1f2d0da30a426c7184f7c83bec2ba87f967d0d90 100644 (file)
--- a/STATUS
+++ b/STATUS
@@ -113,16 +113,6 @@ CURRENT RELEASE NOTES:
 RELEASE SHOWSTOPPERS:
 
 
- * Various modules: Add explicit charset to the output of various modules to
-   work around possible cross-site scripting flaws affecting web browsers that
-   do not derive the response character set as required by RFC2616.
-    Trunk version of patch:
-       http://svn.apache.org/viewvc?rev=606693&view=rev
-       http://svn.apache.org/viewvc?rev=607276&view=rev
-    Backport version for 2.0.x of patch:
-       http://people.apache.org/~rpluem/patches/utf7_fix_2.0.x.diff
-    +1: rpluem, wrowe, jim
-
 PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
   [ start all new proposals below, under PATCHES PROPOSED. ]
 
diff --git a/modules/dav/main/mod_dav.c b/modules/dav/main/mod_dav.c
index 8740c17454223204631396344837b25abff81943..3d3b47bb608020c221ab7c095f7b5366db24e126 100644 (file)
--- a/modules/dav/main/mod_dav.c
+++ b/modules/dav/main/mod_dav.c
@@ -317,7 +317,7 @@ static int dav_error_response(request_rec *r, int status, const char *body)
     /* ### I really don't think this is needed; gotta test */
     r->status_line = ap_get_status_line(status);
 
-    ap_set_content_type(r, "text/html");
+    ap_set_content_type(r, "text/html; charset=ISO-8859-1");
 
     /* begin the response now... */
     ap_rvputs(r,
diff --git a/modules/experimental/util_ldap.c b/modules/experimental/util_ldap.c
index a55256d887923e50bc3e88428182f0d28162d581..adaccb3242078e55a273a352bdb015e9c1c5c50a 100644 (file)
--- a/modules/experimental/util_ldap.c
+++ b/modules/experimental/util_ldap.c
@@ -139,7 +139,7 @@ int util_ldap_handler(request_rec *r)
         return DECLINED;
     }
 
-    r->content_type = "text/html";
+    r->content_type = "text/html; charset=ISO-8859-1";
     if (r->header_only)
         return OK;
 
diff --git a/modules/generators/mod_info.c b/modules/generators/mod_info.c
index a6973ddb7a9bcff56c510a4b453dd440b1c28784..eb72844232ef6828bba454baa9e6ef05e46f5d20 100644 (file)
--- a/modules/generators/mod_info.c
+++ b/modules/generators/mod_info.c
@@ -318,7 +318,7 @@ static int display_info(request_rec *r)
     if (r->method_number != M_GET)
        return DECLINED;
 
-    ap_set_content_type(r, "text/html");
+    ap_set_content_type(r, "text/html; charset=ISO-8859-1");
 
     ap_rputs(DOCTYPE_HTML_3_2
             "<html><head><title>Server Information</title></head>\n", r);
diff --git a/modules/proxy/proxy_ftp.c b/modules/proxy/proxy_ftp.c
index c02f0f48e1bcad7f689d1d2b4a76008a3ef7a299..3cf6d31fbb5129f9969955d925b8c66a0a4b4ade 100644 (file)
--- a/modules/proxy/proxy_ftp.c
+++ b/modules/proxy/proxy_ftp.c
@@ -1702,7 +1702,7 @@ int ap_proxy_ftp_handler(request_rec *r, proxy_server_conf *conf,
 
     /* set content-type */
     if (dirlisting) {
-        ap_set_content_type(r, "text/html");
+        ap_set_content_type(r, "text/html; charset=ISO-8859-1");
     }
     else {
         if (r->content_type) {
Mirror of https://github.com/apache/httpd.git