* modules/ssl/ssl_engine_kernel.c (ssl_hook_UserCheck): Check username

  does not contain a colon before constructing Authorization header
  for FakeBasicAuth mode. (Also constify 'user' variable.)

PR: 52644

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1815592 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/CHANGES b/CHANGES
index e335b2d89c0fb2f9bf50e7894198442ffbef6661..1f6774e9e226a149f3bf3716f7fb335660583d59 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,6 +1,9 @@
                                                          -*- coding: utf-8 -*-
 Changes with Apache 2.5.1
 
+  *) mod_ssl: Fail with 403 if the username for FakeBasicAuth mode
+     includes a colon character.  PR 52644.  [Joe Orton]
+
   *) mod_md: v1.0.3, fixed various bugs in persisting job properties, so that status is 
      persisted accross child process changes and staging is reset on reloads. Changed 
      MDCertificateAgreement url checks. As long as the CA reports that the account has 

diff --git a/modules/ssl/ssl_engine_kernel.c b/modules/ssl/ssl_engine_kernel.c
index d9b5bf9f041887cbfca2fa23aa234a8fb48e2fa2..220232e5902a2961488f6eeefc798f5343839109 100644 (file)
--- a/modules/ssl/ssl_engine_kernel.c
+++ b/modules/ssl/ssl_engine_kernel.c
@@ -1181,8 +1181,7 @@ int ssl_hook_UserCheck(request_rec *r)
     SSLConnRec *sslconn = myConnConfig(r->connection);
     SSLSrvConfigRec *sc = mySrvConfig(r->server);
     SSLDirConfigRec *dc = myDirConfig(r);
-    char *user;
-    const char *auth_line, *username, *password;
+    const char *user, *auth_line, *username, *password;
 
     /*
      * Additionally forbid access (again)
@@ -1258,7 +1257,14 @@ int ssl_hook_UserCheck(request_rec *r)
         }
     }
     else {
-        user = (char *)sslconn->client_dn;
+        user = sslconn->client_dn;
+    }
+
+    if (ap_strchr_c(user, ':') != NULL) {
+        ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10096)
+                      "Cannot use FakeBasicAuth for username "
+                      "containing a colon: %s", user);
+        return HTTP_FORBIDDEN;
     }
 
     /*