www/apache
1
0
Fork 0
mirror of https://github.com/apache/httpd.git synced 2025-08-08 15:02:10 +03:00
Code Activity

PR47765: ProxyPass and ProxyPassReverse should not be accepted in

Browse Source 
Directory or Files sections.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1031758 13f79535-47bb-0310-9956-ffa450edef68
This commit is contained in:
Eric Covener
2010-11-05 20:03:02 +00:00
parent 4a7e62c83c
commit b73db43c7a
2 changed files with 15 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
CHANGES
View File

@@ -6,6 +6,9 @@ Changes with Apache 2.3.9
Fix a denial of service attack against mod_reqtimeout. Fix a denial of service attack against mod_reqtimeout.
[Stefan Fritsch] [Stefan Fritsch]
*) mod_proxy: Don't allow ProxyPass or ProxyPassReverse in
<Directory> or <Files>. PR47765 [Eric Covener]
*) prefork/worker/event MPMS: default value (when no directive is present) *) prefork/worker/event MPMS: default value (when no directive is present)
of MaxConnectionsPerChild/MaxRequestsPerChild is changed to 0 from 10000 of MaxConnectionsPerChild/MaxRequestsPerChild is changed to 0 from 10000
to match default configuration and manual. PR47782 [Eric Covener] to match default configuration and manual. PR47782 [Eric Covener]

12
modules/proxy/mod_proxy.c
View File

@@ -1337,6 +1337,12 @@ static const char *
int i; int i;
int use_regex = is_regex; int use_regex = is_regex;
unsigned int flags = 0; unsigned int flags = 0;
const char *err;
err = ap_check_cmd_context(cmd, NOT_IN_DIRECTORY|NOT_IN_FILES);
if (err) {
return err;
}
while (*arg) { while (*arg) {
word = ap_getword_conf(cmd->pool, &arg); word = ap_getword_conf(cmd->pool, &arg);
@@ -1490,6 +1496,12 @@ static const char * add_pass_reverse(cmd_parms *cmd, void *dconf, const char *f,
const char *fake; const char *fake;
const char *real; const char *real;
const char *interp; const char *interp;
const char *err;
err = ap_check_cmd_context(cmd, NOT_IN_DIRECTORY|NOT_IN_FILES);
if (err) {
return err;
}
if (cmd->path == NULL) { if (cmd->path == NULL) {
if (r == NULL || !strcasecmp(r, "interpolate")) { if (r == NULL || !strcasecmp(r, "interpolate")) {