Skip to content
Commit e0bb5f75 authored by Martin Kraemer's avatar Martin Kraemer
Browse files

[Security] Prevent invalid client hostnames from appearing in

the log file. If a double-reverse lookup was performed (e.g.,
for an "Allow from .my.domain" directive) but failed, then
a spoofed dns-reverse-address could appear in the logs. Now
the numeric address is logged instead. Note that
reverse-address-spoofing did NOT actually allow access
to any protected resource! It was only possible to cause apache to
log arbitrary names (for resources protected thusly) if you had
control over the reverse dns zone.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@93426 13f79535-47bb-0310-9956-ffa450edef68
parent b6d6b2b4
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment