possible XSS for a site where untrusted users can upload files to
a location with MultiViews enabled. [Niels Heinen <heinenn google.com>]
+ *) ab: Fix read failure when targeting SSL server. [Jeff Trawick]
+
*) The following now respect DefaultRuntimeDir/DEFAULT_REL_RUNTIMEDIR:
- mod_auth_digest: shared memory file
[Jeff Trawick]
2.4.x patch: trunk patch works
+1: rjung, humbedooh, trawick (needs CHANGES entry)
- * ab fixes:
- o When -B is specified, search for a host address in the same
- family as the specified outbound interface.
- o Fix read failure when targeting SSL server.
- trunk patches: http://svn.apache.org/viewvc?view=revision&revision=1364133
- http://svn.apache.org/viewvc?view=revision&revision=1371791
- 2.4.x patch: trunk patches work
- +1: trawick, rjung, jim
-
* httpd.conf.in: remove DNT header field from MSIE 10.0 requests because
the browser is deliberately violating the standard under development.
trunk patch: http://svn.apache.org/viewvc?rev=1371878&view=rev
good++;
close_connection(c);
}
+ else if (scode == SSL_ERROR_SYSCALL
+ && status == 0
+ && c->read != 0) {
+ /* connection closed, but in violation of the protocol, after
+ * some data has already been read; this commonly happens, so
+ * let the length check catch any response errors
+ */
+ good++;
+ close_connection(c);
+ }
else if (scode != SSL_ERROR_WANT_WRITE
&& scode != SSL_ERROR_WANT_READ) {
/* some fatal error: */
c->read = 0;
- BIO_printf(bio_err, "SSL read failed - closing connection\n");
+ BIO_printf(bio_err, "SSL read failed (%d) - closing connection\n", scode);
ERR_print_errors(bio_err);
close_connection(c);
}
}
/* This too */
- if ((rv = apr_sockaddr_info_get(&destsa, connecthost, APR_UNSPEC, connectport, 0, cntxt))
+ if ((rv = apr_sockaddr_info_get(&destsa, connecthost,
+ myhost ? mysa->family : APR_UNSPEC,
+ connectport, 0, cntxt))
!= APR_SUCCESS) {
char buf[120];
apr_snprintf(buf, sizeof(buf),