William A. Rowe Jr 4992fc660a SECURITY: CVE-2013-5704 (cve.mitre.org) ...

core: HTTP trailers could be used to replace HTTP headers
late during request processing, potentially undoing or
otherwise confusing modules that examined or modified
request headers earlier.  Adds "MergeTrailers" directive to restore
legacy behavior.

Submitted by: Edward Lu, Yann Ylavic, Joe Orton, Eric Covener
Backports: r1610814
Reviewed by: covener, wrowe, ylavic



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1619884 13f79535-47bb-0310-9956-ffa450edef68

2014-08-22 18:18:08 +00:00

..

mpm

Merge r1610652 from trunk:

2014-07-15 11:17:49 +00:00

.indent.pro

Apache 1.3.9 baseline for the Apache 2.0 repository.

1999-08-24 06:46:03 +00:00

buildmark.c

update license header text

2006-07-11 20:33:53 +00:00

config.c

Merge r1496709,r1601995 from trunk:

2014-07-12 18:19:16 +00:00

config.m4

Add server directory to INCLUDES.

2011-01-17 10:45:54 +00:00

connection.c

Merge r1572905, r1595305, r1597182, r1586827, r1534892, r1563193, r1597639 from trunk:

2014-06-17 12:06:05 +00:00

core_filters.c

Merge r1530793 from trunk:

2013-10-10 14:32:59 +00:00

core.c

SECURITY: CVE-2013-5704 (cve.mitre.org)

2014-08-22 18:18:08 +00:00

eoc_bucket.c

update license header text

2006-07-11 20:33:53 +00:00

eor_bucket.c

Change the eor bucket to use a pre-cleanup to run the log transaction hook.

2010-06-14 19:07:02 +00:00

error_bucket.c

Merge r1337344, r1378178, r1397636, r1398025, r1398040, r1398481, r1407004, r1407006, r1407088, r1407528 from trunk:

2012-12-03 16:33:42 +00:00

gen_test_char.c

Merge r1384913, r1399687, r1419719, r1419755, r1416278, r1330189 from trunk:

2013-01-28 13:13:18 +00:00

gen_test_char.dsp

Remove all /machine:I386 references, these are getting in the way

2006-04-27 05:30:39 +00:00

listen.c

Merge r1407459, r1407460, r1419781, r1418524, r1401448, r1405407, r1405973, r1419726, r1418769, r1417197 from trunk:

2012-12-12 14:19:54 +00:00

log.c

* easy proposals to synch 2.4.x and trunk

2013-12-26 18:08:28 +00:00

main.c

Merge 1328345, add CHANGES entry:

2012-04-28 22:56:20 +00:00

Makefile.in

remove... now in apr 1.5

2013-10-02 12:20:14 +00:00

mpm_common.c

Merge r1546835, r1546836 from trunk:

2014-04-18 15:25:21 +00:00

mpm_unix.c

Merge r1542379 from trunk:

2014-02-20 19:38:49 +00:00

NWGNUmakefile

Use var for prelude so its possible to change it at one place.

2011-03-18 03:09:27 +00:00

protocol.c

SECURITY: CVE-2013-5704 (cve.mitre.org)

2014-08-22 18:18:08 +00:00

provider.c

Merge r1337344, r1378178, r1397636, r1398025, r1398040, r1398481, r1407004, r1407006, r1407088, r1407528 from trunk:

2012-12-03 16:33:42 +00:00

request.c

Merge r1554300, r1554301, r1554994, r1555266 from trunk:

2014-01-05 16:14:26 +00:00

scoreboard.c

Merge 1610491 from trunk:

2014-07-14 19:55:04 +00:00

util_cfgtree.c

Remove all references to CORE_PRIVATE.

2008-04-07 10:45:43 +00:00

util_charset.c

update license header text

2006-07-11 20:33:53 +00:00

util_cookies.c

Clean up size_t abuse, part 2. ap_malloc/calloc/realloc are explicitly

2012-01-06 18:15:28 +00:00

util_debug.c

Introduce ap_(get|set)_core_module_config() functions/macros and use them

2011-06-06 21:26:56 +00:00

util_ebcdic.c

* easy proposals to synch 2.4.x and trunk

2013-12-26 18:08:28 +00:00

util_expr_eval.c

Merge r1546730, r1583008, r1571369, r1552130, r1578760, r1592615, r1592632, r1595321, r1550302, r1550307, r1585435 from trunk:

2014-06-03 12:14:22 +00:00

util_expr_parse.c

remove mistakenly commited patches...

2012-01-23 11:58:30 +00:00

util_expr_parse.h

remove mistakenly commited patches...

2012-01-23 11:58:30 +00:00

util_expr_parse.y

Merge r1204087, 1204090:

2011-11-21 22:24:12 +00:00

util_expr_private.h

Improve error message by removing 'unexpected T_ERROR' in one case.

2011-10-10 20:41:26 +00:00

util_expr_scan.c

Update autogenerated code. Now generated with bison 2.5 instead of 2.4.1

2011-10-10 20:44:40 +00:00

util_expr_scan.l

Do proper length checks in the expression scanner. This allows to remove the

2011-08-13 09:59:43 +00:00

util_fcgi.c

Follow up to r1526598: add missing util_fcgi source files.

2013-09-26 17:54:24 +00:00

util_filter.c

Merge r1458456 from trunk:

2013-04-15 12:37:59 +00:00

util_md5.c

Merge r1422549, r1422712 from trunk:

2013-01-28 13:09:39 +00:00

util_mutex.c

Revert r1373105, the merging of incompatible DefaultRuntimeDir

2012-08-14 23:59:24 +00:00

util_pcre.c

Merge r1554300, r1554301, r1554994, r1555266 from trunk:

2014-01-05 16:14:26 +00:00

util_regex.c

Merge r1557317, r1556911, r1556914, r1555259, r1556912, r1556937, r1559351, r1463046 from trunk:

2014-01-28 18:11:59 +00:00

util_script.c

Easy votes: sync 2.4 and trunk

2013-09-14 14:12:54 +00:00

util_time.c

Add ErrorLogFormat directive for configuring the error log format, including

2010-09-05 15:44:19 +00:00

util_xml.c

Backport r1209766, r1210252, r1210284:

2011-12-05 00:08:01 +00:00

util.c

Merge r1487528, r1563379, r1563381, r1565711 from trunk:

2014-02-19 12:43:58 +00:00

vhost.c

Wildcard name-based vhosts printed twice in apachectl -S

2013-10-03 18:31:22 +00:00