]> git.ipfire.org Git - thirdparty/apache/httpd.git/commitdiff
projects / thirdparty / apache / httpd.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: ee35985)
Fix CVE-2007-5000:
authorWilliam A. Rowe Jr <wrowe@apache.org>
Wed, 12 Dec 2007 19:38:26 +0000 (19:38 +0000)
committerWilliam A. Rowe Jr <wrowe@apache.org>
Wed, 12 Dec 2007 19:38:26 +0000 (19:38 +0000)
* modules/mappers/mod_imagemap.c (menu_header): Fix
  cross-site-scripting issue by escaping the URI, and ensure that a
  charset parameter is sent in the content-type to prevent
  autodetection by broken browsers.

Reported by: JPCERT

Backports: r603282
Submitted by: jorton
Reviewed by: rpluem, trawick, wrowe

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@603711 13f79535-47bb-0310-9956-ffa450edef68

CHANGES patch | blob | blame | history
STATUS patch | blob | blame | history
modules/mappers/mod_imagemap.c patch | blob | blame | history

diff --git a/CHANGES b/CHANGES
index 260a89ec6f3a13dba2b92efe71e379f159f7e3a2..07e96909e1513c04c7cba8fc68e61f43345b2720 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,6 +1,10 @@
                                                         -*- coding: utf-8 -*-
 Changes with Apache 2.2.7
 
+  *) SECURITY: CVE-2007-5000 (cve.mitre.org)
+     mod_imagemap: Fix a cross-site scripting issue.  Reported by JPCERT.
+     [Joe Orton]  
+
   *) core: Fix broken chunk filtering that causes all non blocking reads to be
      converted into blocking reads.  PR 19954, 41056.
      [Jean-Frederic Clere, Jim Jagielski]
diff --git a/STATUS b/STATUS
index 50299e0355ceffbf15c106738b4634fb57848c4e..0de4642e30ad6d226f94ba3662aa641a63c14464 100644 (file)
--- a/STATUS
+++ b/STATUS
@@ -85,13 +85,6 @@ PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
      2.2.x version of the patch works
      +1 mturk, fuankg, rpluem
 
-   * SECURITY: mod_imagemap: fix XSS issue (CVE-2007-2500)
-      Trunk version of patch:
-        http://svn.apache.org/viewvc?rev=603282&view=rev
-     Backport version for 2.2.x of patch:
-        Trunk version of patch works (will add CHANGES entry too)
-     +1: jorton, rpluem, trawick
-
 PATCHES PROPOSED TO BACKPORT FROM TRUNK:
   [ New proposals should be added at the end of the list ]
 
diff --git a/modules/mappers/mod_imagemap.c b/modules/mappers/mod_imagemap.c
index f4dce5ff20e65e32c724d57c6d02eaa54f96e9fd..f6741d35b4ed01f74392edc8f5d609835815e229 100644 (file)
--- a/modules/mappers/mod_imagemap.c
+++ b/modules/mappers/mod_imagemap.c
@@ -479,13 +479,16 @@ static int imap_reply(request_rec *r, char *redirect)
 
 static void menu_header(request_rec *r, char *menu)
 {
-    ap_set_content_type(r, "text/html");
+    ap_set_content_type(r, "text/html; charset=ISO-8859-1");
 
-    ap_rvputs(r, DOCTYPE_HTML_3_2, "<html><head>\n<title>Menu for ", r->uri,
-           "</title>\n</head><body>\n", NULL);
+    ap_rvputs(r, DOCTYPE_HTML_3_2, "<html><head>\n<title>Menu for ", 
+              ap_escape_html(r->pool, r->uri),
+              "</title>\n</head><body>\n", NULL);
 
     if (!strcasecmp(menu, "formatted")) {
-        ap_rvputs(r, "<h1>Menu for ", r->uri, "</h1>\n<hr />\n\n", NULL);
+        ap_rvputs(r, "<h1>Menu for ", 
+                  ap_escape_html(r->pool, r->uri),
+                  "</h1>\n<hr />\n\n", NULL);
     }
 
     return;
Mirror of https://github.com/apache/httpd.git