mirror of
https://github.com/apache/httpd.git
synced 2026-10-23 22:49:01 +03:00
cache_strqtok() did not end a token at a comma or whitespace unless an argument followed, so "private, no-store" was read as one token and the response was stored. Stop at any non-token character, after the '=' test. This is a trunk-only regression from r1856507, which rewrote the tokenizer as a state machine and dropped the T_HTTP_TOKEN_STOP check in the token state that r1856493 and r1856500 still had. PR: 70028 GitHub: closes #821 git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1939267 13f79535-47bb-0310-9956-ffa450edef68