Merge r1808780 from trunk:

mod_speling/PR 38923: don't embed Referer in link in error page.

Submitted by: niq
Reviewed by: niq, ylavic, elukey

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1808856 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/CHANGES b/CHANGES
index c6b3bcaedb3e850dc91041ee82e0b0643638b621..4ecb2748e33bcedbc79fb3629b67136de20c6172 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -6,6 +6,9 @@ Changes with Apache 2.4.28
      main configuration file (httpd.conf) to register HTTP methods before the
      .htaccess files.  [Yann Ylavic]
 
+  *) mod_speling: Don't embed referer data in a link in error page.
+     PR 38923 [Nick Kew]
+
   *) htdigest: prevent a buffer overflow when a string exceeds the allowed max
      length in a password file.
      [Luca Toscano, Hanno Böck <hanno hboeck de>]

diff --git a/STATUS b/STATUS
index 6aa0a9f5a6a561b9f5ea4e754ed8534009c70c0c..fb3348fed7672c15265fef31ff11f120b016100e 100644 (file)
--- a/STATUS
+++ b/STATUS
@@ -115,10 +115,6 @@ RELEASE SHOWSTOPPERS:
 PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
   [ start all new proposals below, under PATCHES PROPOSED. ]
 
-  *) mod_speling: Don't embed Referer data in link in error page.
-     trunk patch: http://svn.apache.org/r1808780
-     2.4.x: trunk patch applies
-     +1: niq, ylavic, elukey
 
 PATCHES PROPOSED TO BACKPORT FROM TRUNK:
   [ New proposals should be added at the end of the list ]

diff --git a/modules/mappers/mod_speling.c b/modules/mappers/mod_speling.c
index a9f36516e91d5c2c7d93f1c26d3ef4610179f9ca..3e974232551a0117093fbb71d00337162a11840e 100644 (file)
--- a/modules/mappers/mod_speling.c
+++ b/modules/mappers/mod_speling.c
@@ -488,10 +488,10 @@ static int check_speling(request_rec *r)
             if (ref != NULL) {
                 *(const char **)apr_array_push(t) =
                                "Please consider informing the owner of the "
-                               "<a href=\"";
-                *(const char **)apr_array_push(t) = ap_escape_uri(sub_pool, ref);
-                *(const char **)apr_array_push(t) = "\">referring page</a> "
-                               "about the broken link.\n";
+                               "referring page <tt>";
+                *(const char **)apr_array_push(t) = ap_escape_html(sub_pool, ref);
+                *(const char **)apr_array_push(t) =
+                               "</tt> about the broken link.\n";
             }