From: André Malo Referer:
on all requests
which did not return some sort of normal status.
Note that there is no escaping performed on the strings from
- %...r
, %...i
and %...o
. This
- is mainly to comply with the requirements of the Common Log Format.
- This implies that clients can insert control characters into the log,
- so care should be taken when dealing with raw log files.
Note that in versions previous to 2.0.46 no escaping has been performed
+ on the strings from %...r
, %...i
and
+ %...o
. This was mainly to comply with the requirements of
+ the Common Log Format. This implied that clients could insert control
+ characters into the log, so you had to be quite careful when dealing
+ with raw log files.
For security reasons starting with 2.0.46 non-printable and
+ other special characters are escaped mostly by using
+ \xhh
sequences, where hh stands for
+ the hexadecimal representation of the raw byte. Exceptions from this
+ rule are "
and \
which are escaped by prepending
+ a backslash, and all whitespace characters that are written in their
+ C-notation (\n
, \t
etc).
Some commonly used log format strings are:
diff --git a/docs/manual/mod/mod_log_config.xml b/docs/manual/mod/mod_log_config.xml index f8e4c8175c..3eb3cee991 100644 --- a/docs/manual/mod/mod_log_config.xml +++ b/docs/manual/mod/mod_log_config.xml @@ -185,11 +185,20 @@ "%!200,304,302{Referer}i" logsReferer:
on all requests
which did not return some sort of normal status.
- Note that there is no escaping performed on the strings from
- %...r
, %...i
and %...o
. This
- is mainly to comply with the requirements of the Common Log Format.
- This implies that clients can insert control characters into the log,
- so care should be taken when dealing with raw log files.
Note that in versions previous to 2.0.46 no escaping has been performed
+ on the strings from %...r
, %...i
and
+ %...o
. This was mainly to comply with the requirements of
+ the Common Log Format. This implied that clients could insert control
+ characters into the log, so you had to be quite careful when dealing
+ with raw log files.
For security reasons starting with 2.0.46 non-printable and
+ other special characters are escaped mostly by using
+ \xhh
sequences, where hh stands for
+ the hexadecimal representation of the raw byte. Exceptions from this
+ rule are "
and \
which are escaped by prepending
+ a backslash, and all whitespace characters that are written in their
+ C-notation (\n
, \t
etc).
Some commonly used log format strings are: