diff options
author | Dirk Meyer <dinoex@FreeBSD.org> | 2005-12-14 15:52:42 +0000 |
---|---|---|
committer | Dirk Meyer <dinoex@FreeBSD.org> | 2005-12-14 15:52:42 +0000 |
commit | aa5199c9496a5e0bb112c826bb531d05fe8e4413 (patch) | |
tree | 877fc49ec3a692df849117510ea6ed554f84c765 /www/apache13-modssl/files | |
parent | 8e6bc5f1ef00a01eea3cde398deea10437ef9ae7 (diff) | |
download | ports-aa5199c9496a5e0bb112c826bb531d05fe8e4413.tar.gz ports-aa5199c9496a5e0bb112c826bb531d05fe8e4413.zip |
Notes
Diffstat (limited to 'www/apache13-modssl/files')
-rw-r--r-- | www/apache13-modssl/files/patch-secfix-CAN-2005-3352 | 35 |
1 files changed, 35 insertions, 0 deletions
diff --git a/www/apache13-modssl/files/patch-secfix-CAN-2005-3352 b/www/apache13-modssl/files/patch-secfix-CAN-2005-3352 new file mode 100644 index 000000000000..8febc0e58935 --- /dev/null +++ b/www/apache13-modssl/files/patch-secfix-CAN-2005-3352 @@ -0,0 +1,35 @@ +--- src/main/util.c (original) ++++ src/main/util.c Mon Dec 12 08:36:54 2005 +@@ -1722,6 +1722,8 @@ + j += 3; + else if (s[i] == '&') + j += 4; ++ else if (s[i] == '"') ++ j += 5; + + if (j == 0) + return ap_pstrndup(p, s, i); +@@ -1739,6 +1741,10 @@ + else if (s[i] == '&') { + memcpy(&x[j], "&", 5); + j += 4; ++ } ++ else if (s[i] == '"') { ++ memcpy(&x[j], """, 6); ++ j += 5; + } + else + x[j] = s[i]; + +--- src/modules/standard/mod_imap.c (original) ++++ src/modules/standard/mod_imap.c Mon Dec 12 08:36:54 2005 +@@ -328,7 +328,7 @@ + if (!strcasecmp(value, "referer")) { + referer = ap_table_get(r->headers_in, "Referer"); + if (referer && *referer) { +- return ap_pstrdup(r->pool, referer); ++ return ap_escape_html(r->pool, referer); + } + else { + /* XXX: This used to do *value = '\0'; ... which is totally bogus + |