[Security] Prevent invalid client hostnames from appearing in
the log file. If a double-reverse lookup was performed (e.g., for an "Allow from .my.domain" directive) but failed, then a spoofed dns-reverse-address could appear in the logs. Now the numeric address is logged instead. Note that reverse-address-spoofing did NOT actually allow access to any protected resource! It was only possible to cause apache to log arbitrary names (for resources protected thusly) if you had control over the reverse dns zone. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@93426 13f79535-47bb-0310-9956-ffa450edef68
parent
b6d6b2b4
Please register or sign in to comment