- add a security warning, and tweak the example, in light of CVE-2011-3368

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1179266 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/docs/manual/rewrite/flags.xml b/docs/manual/rewrite/flags.xml
index d2e19e5351ace50b758e1f8c94b76f9d87da82d8..946701de4e4c8770c03317bceb7a0004d3782015 100644 (file)
--- a/docs/manual/rewrite/flags.xml
+++ b/docs/manual/rewrite/flags.xml
@@ -482,7 +482,7 @@ example, if you wanted all image requests to be handled by a back-end
 image server, you might do something like the following:</p>
 
 <example>
-RewriteRule (.*)\.(jpg|gif|png) http://images.example.com$1.$2 [P]
+RewriteRule /(.*)\.(jpg|gif|png) http://images.example.com/$1.$2 [P]
 </example>
 
 <p>Use of the [P] flag implies [L] - that is, the request is immediately
@@ -498,6 +498,15 @@ more powerful implementation of the <directive
 module="mod_proxy">ProxyPass</directive> directive,
 to map remote content into the namespace of the local server.</p>
 
+<note type="warning">
+<title>Security Warning</title>
+<p>Take care when constructing the target URL of the rule, considering
+the security impact from allowing the client influence over the set of
+URLs to which your server will act as a proxy.  Ensure that the scheme
+and hostname part of the URL is either fixed, or does not allow the
+client undue influence.</p>
+</note>
+
 <p>Note: <module>mod_proxy</module> must be enabled in order
 to use this flag.</p>