-*- coding: utf-8 -*-
-<<<<<<< .working
Changes with Apache 2.4.3
*) SECURITY: CVE-2012-2687 (cve.mitre.org)
possible XSS for a site where untrusted users can upload files to
a location with MultiViews enabled. [Niels Heinen <heinenn google.com>]
+ *) mod_setenvif: Compile some global regex only once during startup.
+ This should save some memory, especially with .htaccess.
+ [Stefan Fritsch]
+
*) core: Add the port number to the vhost's name in the scoreboard.
[Stefan Fritsch]
PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
[ start all new proposals below, under PATCHES PROPOSED. ]
- * mod_setenvif: Compile the regex used by is_header_regex() only once
- during startup This should save some memory, especially with .htaccess
- trunk patch: http://svn.apache.org/viewvc?view=revision&revision=1343099
- 2.4.x patch: trunk patch works
- +1: rjung, jim, sf
PATCHES PROPOSED TO BACKPORT FROM TRUNK:
[ New proposals should be added at the end of the list ]
#define ICASE_MAGIC ((void *)(&setenvif_module))
#define SEI_MAGIC_HEIRLOOM "setenvif-phase-flag"
+static ap_regex_t *is_header_regex_regex;
+
static int is_header_regex(apr_pool_t *p, const char* name)
{
/* If a Header name contains characters other than:
* -,_,[A-Z\, [a-z] and [0-9].
* assume the header name is a regular expression.
*/
- ap_regex_t *preg = ap_pregcomp(p, "^[-A-Za-z0-9_]*$",
- (AP_REG_EXTENDED | AP_REG_NOSUB ));
- ap_assert(preg != NULL);
-
- if (ap_regexec(preg, name, 0, NULL, 0)) {
+ if (ap_regexec(is_header_regex_regex, name, 0, NULL, 0)) {
return 1;
}
{
ap_hook_header_parser(match_headers, NULL, NULL, APR_HOOK_MIDDLE);
ap_hook_post_read_request(match_headers, NULL, NULL, APR_HOOK_MIDDLE);
+
+ is_header_regex_regex = ap_pregcomp(p, "^[-A-Za-z0-9_]*$",
+ (AP_REG_EXTENDED | AP_REG_NOSUB ));
+ ap_assert(is_header_regex_regex != NULL);
}
AP_DECLARE_MODULE(setenvif) =