Joe Orton 4a375eff22 Prevent CSRF attacks against the balancer-manager (CVE-2007-6420) ...

* modules/proxy/mod_proxy_balancer.c (balancer_init): New function.
  (balancer_handler): Place a nonce in the form output, and check that
  the submitted form data includes that nonce.
  (ap_proxy_balancer_register_hook): Register the new post_config hook.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@661666 13f79535-47bb-0310-9956-ffa450edef68

2008-05-30 11:49:31 +00:00

..

examples

And move mod_lbmethod_rr.c to that example dir so people

2007-11-14 16:34:31 +00:00

.indent.pro

Add some more apr_ types

2002-01-29 15:27:30 +00:00

ajp_header.c

Make AJP HEAD aware

2007-09-09 16:20:45 +00:00

ajp_header.h

update license header text

2006-07-11 20:33:53 +00:00

ajp_link.c

update license header text

2006-07-11 20:33:53 +00:00

ajp_msg.c

* modules/proxy/ajp_msg.c (ajp_msg_dump, ajp_msg_check_header,

2007-02-22 14:12:14 +00:00

ajp_utils.c

Add CPING/CPONG message size as defined as max inside Apache Tomcat using define.

2006-10-24 08:18:50 +00:00

ajp.h

Use 64K as maximum allowable AJP packet size

2007-12-10 07:35:52 +00:00

CHANGES

Change common but incorrect usage of 'depreciated'

2007-02-08 13:46:14 +00:00

config.m4

Make life happy for people who don't have serf but

2007-11-13 17:16:40 +00:00

fcgi_protocol.h

update license header text

2006-07-11 20:33:53 +00:00

libproxy.exp

…

Makefile.in

update for the latest build system

2001-02-06 10:46:23 +00:00

mod_proxy_ajp.c

* Introduce a flag to decide whether we sent an body to the backend or not.

2008-05-26 15:04:55 +00:00

mod_proxy_ajp.dsp

Embed the .manifest files of all httpd binaries as a post-build

2007-01-11 05:37:20 +00:00

mod_proxy_balancer.c

Prevent CSRF attacks against the balancer-manager (CVE-2007-6420)

2008-05-30 11:49:31 +00:00

mod_proxy_balancer.dsp

Embed the .manifest files of all httpd binaries as a post-build

2007-01-11 05:37:20 +00:00

mod_proxy_connect.c

Remove all references to CORE_PRIVATE.

2008-04-07 10:45:43 +00:00

mod_proxy_connect.dsp

Embed the .manifest files of all httpd binaries as a post-build

2007-01-11 05:37:20 +00:00

mod_proxy_fcgi.c

and make mod_proxy_fcgi also nocanon aware

2008-04-17 16:24:16 +00:00

mod_proxy_fcgi.dsp

Embed the .manifest files of all httpd binaries as a post-build

2007-01-11 05:37:20 +00:00

mod_proxy_ftp.c

mod_proxy_ftp: Fix base for directory listings.

2008-01-12 19:32:24 +00:00

mod_proxy_ftp.dsp

Embed the .manifest files of all httpd binaries as a post-build

2007-01-11 05:37:20 +00:00

mod_proxy_http.c

* Do this later as we might leave the function anyway without the need for this.

2008-05-29 22:23:19 +00:00

mod_proxy_http.dsp

Embed the .manifest files of all httpd binaries as a post-build

2007-01-11 05:37:20 +00:00

mod_proxy.c

Use what we have. This logic belongs here anyway...

2008-04-08 09:25:57 +00:00

mod_proxy.dsp

Embed the .manifest files of all httpd binaries as a post-build

2007-01-11 05:37:20 +00:00

mod_proxy.h

Switch ftp_directory_charset and interpolate_env in proxy_dir_conf,

2008-05-28 20:56:02 +00:00

mod_serf.c

Umm, oops. r595022 shouldn't have ended up in trunk.

2007-11-14 19:52:22 +00:00

NWGNUmakefile

removed obsolete -prefix; minor cosmetic changes.

2007-03-22 13:45:54 +00:00

NWGNUproxy

removed obsolete -prefix; minor cosmetic changes.

2007-03-22 13:45:54 +00:00

NWGNUproxyajp

removed obsolete -prefix; minor cosmetic changes.

2007-03-22 13:45:54 +00:00

NWGNUproxybalancer

removed obsolete -prefix; minor cosmetic changes.

2007-03-22 13:45:54 +00:00

NWGNUproxycon

removed obsolete -prefix; minor cosmetic changes.

2007-03-22 13:45:54 +00:00

NWGNUproxyftp

removed obsolete -prefix; minor cosmetic changes.

2007-03-22 13:45:54 +00:00

NWGNUproxyhtp

removed obsolete -prefix; minor cosmetic changes.

2007-03-22 13:45:54 +00:00

proxy_util.c

Use what we have. This logic belongs here anyway...

2008-04-08 09:25:57 +00:00