2846acd7a8
- Completely shut up rc.d script when no profiles are enabled
(add add support to disable profiles) [2]
- Fix CVE-2008-2939 for mod_proxy_ftp
(XSS attacks when using wildcards in the path of the FTP URL)
- Add "apache22_fib" to start apache22 prefixed by
"setfib -F ${apache22_fib}", so apache can use an alternate
network view (not carefully tested yet)
- Revert previous patch to "fix" missing rc.d scripts. It
actually breaks profiles.
- Bump PORTREVISION
PR: ports/126670 [1],
ports/116627 [2]
Submitted by: Joseph S. Atkinson [1],
Eygene Ryabinkin [2]
Security: CVE-2008-2939
Special thanks to: pgollucci@
11 lines
554 B
Text
11 lines
554 B
Text
--- modules/proxy/mod_proxy_ftp.c 2008/08/05 19:00:05 682869
|
|
+++ modules/proxy/mod_proxy_ftp.c 2008/08/05 19:01:50 682870
|
|
@@ -383,6 +383,7 @@
|
|
c->bucket_alloc));
|
|
}
|
|
if (wildcard != NULL) {
|
|
+ wildcard = ap_escape_html(p, wildcard);
|
|
APR_BRIGADE_INSERT_TAIL(out, apr_bucket_pool_create(wildcard,
|
|
strlen(wildcard), p,
|
|
c->bucket_alloc));
|
|
|