From 7c35c7a83638bad558f284fb76b392e53b48be4c Mon Sep 17 00:00:00 2001 From: Jim Jagielski Date: Tue, 20 Nov 2007 15:15:05 +0000 Subject: [PATCH] latest docco xform updates git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@596716 13f79535-47bb-0310-9956-ffa450edef68 --- docs/manual/env.html.en | 13 + docs/manual/env.xml.ja | 2 +- docs/manual/env.xml.ko | 2 +- docs/manual/mod/directives.html.en | 3 + docs/manual/mod/mod_authnz_ldap.html.en | 149 ++++- docs/manual/mod/mod_ldap.html.en | 3 + docs/manual/mod/quickreference.html.en | 810 ++++++++++++------------ 7 files changed, 573 insertions(+), 409 deletions(-) diff --git a/docs/manual/env.html.en b/docs/manual/env.html.en index 15c35b38b5..207c01816a 100644 --- a/docs/manual/env.html.en +++ b/docs/manual/env.html.en @@ -324,6 +324,19 @@ set for the redirection text, and these broken browsers will then correctly use that of the destination page.

+
+

Security note

+ +

Sending error pages without a specified character set may + allow a cross-site-scripting attack for existing browsers (MSIE) + which do not follow the HTTP/1.1 specification and attempt to + "guess" the character set from the content. Such browsers can + be easily fooled into using the UTF-7 character set, and UTF-7 + content from input data (such as the request-URI) will not be + escaped by the usual escaping mechanisms designed to prevent + cross-site-scripting attacks.

+
+

force-proxy-request-1.0, proxy-nokeepalive, proxy-sendchunked, proxy-sendcl

diff --git a/docs/manual/env.xml.ja b/docs/manual/env.xml.ja index c4357528af..7ef0630b03 100644 --- a/docs/manual/env.xml.ja +++ b/docs/manual/env.xml.ja @@ -1,7 +1,7 @@ - + +