Commit d44e9c72 authored by Eric Covener's avatar Eric Covener
Browse files

remove r1792169 taint checks from proxy and status modules 

Both of these checks are problematic without further
work.

status: even a .htaccess with no SetHandler blocks the handler.
proxy: RewriteRule ... ... [P] in htaccess is blocked.




git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1796352 13f79535-47bb-0310-9956-ffa450edef68
parent fe6a3061

modules/generators/mod_status.c

+0 −7
Original line number Diff line number Diff line
@@ -213,13 +213,6 @@ static int status_handler(request_rec *r) 
        return DECLINED;

    }



    /* A request that has passed through .htaccess has no business

     * landing up here.

     */

    if (ap_request_tainted(r, AP_TAINT_HTACCESS)) {

        return DECLINED;

    }



#ifdef HAVE_TIMES

    times_per_thread = getpid() != child_pid;

#endif

modules/proxy/mod_proxy.c

+0 −8
Original line number Diff line number Diff line
@@ -932,14 +932,6 @@ static int proxy_fixup(request_rec *r) 
    if (!r->proxyreq || !r->filename || strncmp(r->filename, "proxy:", 6) != 0)

        return DECLINED;



    /* A request that has passed through .htaccess has no business

     * serving contents from so far outside its directory.

     * Since we're going to decline it, don't waste time here.

     */

    if (ap_request_tainted(r, AP_TAINT_HTACCESS)) {

        return DECLINED;

    }



    /* XXX: Shouldn't we try this before we run the proxy_walk? */

    url = &r->filename[6];