Commit abb963f5 authored by Jim Jagielski's avatar Jim Jagielski
Browse files

Merge r1693963 from trunk: 

Allow cookies set by mod_rewrite to contain ':' by accepting
';' as an alternate separator.  PR47241. 

Submitted By: <bugzilla schermesser com>, covener
Committed By: covener



Submitted by: covener
Reviewed/backported by: jim


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1701409 13f79535-47bb-0310-9956-ffa450edef68
parent 0b69ede0

CHANGES

+4 −0
Original line number Diff line number Diff line
@@ -2,6 +2,10 @@ 


Changes with Apache 2.4.17



  *) mod_rewrite:  Allow cookies set by mod_rewrite to contain ':' by accepting

     ';' as an alternate separator.  PR47241. 

     [<bugzilla schermesser com>, Eric Covener]



  *) apxs: Add HTTPD_VERSION and HTTPD_MMN to the variables available with 

     apxs -q. PR58202. [Daniel Shahaf <danielsh apache.org>]

STATUS

+0 −6
Original line number Diff line number Diff line
@@ -109,12 +109,6 @@ RELEASE SHOWSTOPPERS: 
PATCHES ACCEPTED TO BACKPORT FROM TRUNK:

  [ start all new proposals below, under PATCHES PROPOSED. ]



  *) mod_rewrite: Allow cookies to include ':' by using an alternate separator.

     PR47241.

     trunk: http://svn.apache.org/r1693963

     2.4.x: trunk works modulo CHANGES

     +1: covener, ylavic, jim



  *) mod_session_dbd: fix lifetime of Request notes.

     trunk: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/session/mod_session_dbd.c?r1=1679181&r2=1687087&view=patch

     2.4.x: trunk patch applies.

docs/manual/rewrite/flags.xml

+9 −0
Original line number Diff line number Diff line
@@ -124,6 +124,15 @@ follows:</p> 
[CO=NAME:VALUE:DOMAIN:lifetime:path:secure:httponly]

</example>



<p>If a literal ':' character is needed in any of the cookie fields, an 

alternate syntax is available.  To opt-in to the alternate syntax, the cookie 

"Name" should be preceded with a ';' character, and field separators should be

specified as ';'.</p>



<example>

[CO=;NAME;VALUE:MOREVALUE;DOMAIN;lifetime;path;secure;httponly]

</example>



<p>You must declare a name, a value, and a domain for the cookie to be set.</p>



<dl>

modules/mappers/mod_rewrite.c

+15 −7
Original line number Diff line number Diff line
@@ -2485,10 +2485,18 @@ static void add_cookie(request_rec *r, char *s) 


    char *tok_cntx;

    char *cookie;

    /* long-standing default, but can't use ':' in a cookie */

    const char *sep = ":"; 



    var = apr_strtok(s, ":", &tok_cntx);

    val = apr_strtok(NULL, ":", &tok_cntx);

    domain = apr_strtok(NULL, ":", &tok_cntx);

    /* opt-in to ; separator if first character is a ; */

    if (s && *s == ';') { 

        sep = ";"; 

        s++;

    }



    var = apr_strtok(s, sep, &tok_cntx);

    val = apr_strtok(NULL, sep, &tok_cntx);

    domain = apr_strtok(NULL, sep, &tok_cntx);



    if (var && val && domain) {

        request_rec *rmain = r;
@@ -2504,10 +2512,10 @@ static void add_cookie(request_rec *r, char *s) 
        if (!data) {

            char *exp_time = NULL;



            expires = apr_strtok(NULL, ":", &tok_cntx);

            path = expires ? apr_strtok(NULL, ":", &tok_cntx) : NULL;

            secure = path ? apr_strtok(NULL, ":", &tok_cntx) : NULL;

            httponly = secure ? apr_strtok(NULL, ":", &tok_cntx) : NULL;

            expires = apr_strtok(NULL, sep, &tok_cntx);

            path = expires ? apr_strtok(NULL, sep, &tok_cntx) : NULL;

            secure = path ? apr_strtok(NULL, sep, &tok_cntx) : NULL;

            httponly = secure ? apr_strtok(NULL, sep, &tok_cntx) : NULL;



            if (expires) {

                apr_time_exp_t tms;