From e5ab01823ef2d4777ed62d3a32514fecd393a188 Mon Sep 17 00:00:00 2001 From: Stefan Fritsch Date: Tue, 28 Dec 2010 14:33:45 +0000 Subject: [PATCH] update transforms git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1053357 13f79535-47bb-0310-9956-ffa450edef68 --- docs/manual/env.html.en | 34 ++++++ docs/manual/env.xml.ja | 2 +- docs/manual/env.xml.ko | 2 +- docs/manual/env.xml.tr | 2 +- docs/manual/howto/cgi.html.en | 18 ++- docs/manual/howto/cgi.xml.ja | 2 +- docs/manual/howto/cgi.xml.ko | 2 +- docs/manual/mod/core.html.en | 141 ++++++---------------- docs/manual/mod/core.xml.de | 2 +- docs/manual/mod/core.xml.ja | 2 +- docs/manual/mod/core.xml.tr | 2 +- docs/manual/new_features_2_4.html.en | 11 +- docs/manual/upgrading.html.en | 9 +- docs/manual/upgrading.html.fr | 2 + docs/manual/upgrading.xml.fr | 2 +- docs/manual/upgrading.xml.meta | 2 +- docs/manual/vhosts/details.html.en | 157 +++++-------------------- docs/manual/vhosts/details.xml.fr | 2 +- docs/manual/vhosts/details.xml.ko | 2 +- docs/manual/vhosts/details.xml.tr | 2 +- docs/manual/vhosts/examples.html.en | 42 ++----- docs/manual/vhosts/examples.html.fr | 2 + docs/manual/vhosts/examples.xml.fr | 2 +- docs/manual/vhosts/examples.xml.ja | 2 +- docs/manual/vhosts/examples.xml.ko | 2 +- docs/manual/vhosts/examples.xml.meta | 2 +- docs/manual/vhosts/examples.xml.tr | 2 +- docs/manual/vhosts/index.html.en | 1 - docs/manual/vhosts/index.html.fr | 2 + docs/manual/vhosts/index.xml.de | 2 +- docs/manual/vhosts/index.xml.fr | 2 +- docs/manual/vhosts/index.xml.ja | 2 +- docs/manual/vhosts/index.xml.ko | 2 +- docs/manual/vhosts/index.xml.meta | 2 +- docs/manual/vhosts/index.xml.tr | 2 +- docs/manual/vhosts/ip-based.html.en | 27 +++-- docs/manual/vhosts/ip-based.html.fr | 2 + docs/manual/vhosts/ip-based.xml.fr | 2 +- docs/manual/vhosts/ip-based.xml.ja | 2 +- docs/manual/vhosts/ip-based.xml.ko | 2 +- docs/manual/vhosts/ip-based.xml.meta | 2 +- docs/manual/vhosts/ip-based.xml.tr | 2 +- docs/manual/vhosts/mass.html.en | 1 - docs/manual/vhosts/mass.xml.ko | 2 +- docs/manual/vhosts/mass.xml.tr | 2 +- docs/manual/vhosts/name-based.html.en | 60 ++++------ docs/manual/vhosts/name-based.html.fr | 2 + docs/manual/vhosts/name-based.xml.de | 2 +- docs/manual/vhosts/name-based.xml.fr | 2 +- docs/manual/vhosts/name-based.xml.ja | 2 +- docs/manual/vhosts/name-based.xml.ko | 2 +- docs/manual/vhosts/name-based.xml.meta | 2 +- docs/manual/vhosts/name-based.xml.tr | 2 +- 53 files changed, 222 insertions(+), 363 deletions(-) diff --git a/docs/manual/env.html.en b/docs/manual/env.html.en index 5e575e5cc2..8e8890ead1 100644 --- a/docs/manual/env.html.en +++ b/docs/manual/env.html.en @@ -126,6 +126,13 @@ not be a number. Characters which do not match this restriction will be replaced by an underscore when passed to CGI scripts and SSI pages. + +
  • A special case are HTTP headers which are passed to CGI + scripts and the like via environment variables (see below). + They are converted to uppercase and only dashes are replaced with + underscores; if the header contains any other (invalid) character, + the whole header is silently dropped. See + below for a workaround.
  • The SetEnv directive runs late during request processing meaning that directives such as @@ -382,6 +389,33 @@

    Examples

    +

    Passing broken headers to CGI scripts

    + + +

    Starting with version 2.4, Apache is more strict about how HTTP + headers are converted to environment variables in mod_cgi + and other modules: Previously any invalid characters + in header names were simply translated to underscores. This allowed + for some potential cross-site-scripting attacks via header injection + (see + Unusual Web Bugs, slide 19/20).

    + +

    If you have to support a client which sends broken headers and + which can't be fixed, a simple workaround involving mod_setenvif + and mod_header allows you to still accept + these headers:

    + +
    +# 
    +# The following works around a client sending a broken Accept_Encoding
    +# header.
    +#
    +SetEnvIfNoCase ^Accept.Encoding$ ^(.*)$ fix_accept_encoding=$1
    +RequestHeader set Accept-Encoding %{fix_accept_encoding}e env=fix_accept_encoding
    +
    + + +

    Changing protocol behavior with misbehaving clients

    diff --git a/docs/manual/env.xml.ja b/docs/manual/env.xml.ja index 52cea70a88..26c631f247 100644 --- a/docs/manual/env.xml.ja +++ b/docs/manual/env.xml.ja @@ -1,7 +1,7 @@ - + + + + + + + + - + + diff --git a/docs/manual/vhosts/details.xml.ko b/docs/manual/vhosts/details.xml.ko index 52905b029f..2c142deba8 100644 --- a/docs/manual/vhosts/details.xml.ko +++ b/docs/manual/vhosts/details.xml.ko @@ -1,7 +1,7 @@ - + + + diff --git a/docs/manual/vhosts/examples.xml.ja b/docs/manual/vhosts/examples.xml.ja index 641444f75a..df0a41a381 100644 --- a/docs/manual/vhosts/examples.xml.ja +++ b/docs/manual/vhosts/examples.xml.ja @@ -1,7 +1,7 @@ - + + + + + diff --git a/docs/manual/vhosts/index.xml.ja b/docs/manual/vhosts/index.xml.ja index 85673843e8..4c1367c951 100644 --- a/docs/manual/vhosts/index.xml.ja +++ b/docs/manual/vhosts/index.xml.ja @@ -1,7 +1,7 @@ - + + + + diff --git a/docs/manual/vhosts/ip-based.xml.ja b/docs/manual/vhosts/ip-based.xml.ja index 9d8df1851f..ffd864d104 100644 --- a/docs/manual/vhosts/ip-based.xml.ja +++ b/docs/manual/vhosts/ip-based.xml.ja @@ -1,7 +1,7 @@ - + + + + + + + diff --git a/docs/manual/vhosts/name-based.xml.ja b/docs/manual/vhosts/name-based.xml.ja index cb44129edc..dae592cbc7 100644 --- a/docs/manual/vhosts/name-based.xml.ja +++ b/docs/manual/vhosts/name-based.xml.ja @@ -1,7 +1,7 @@ - + + +