File httpd-2.2.x-bnc806458-mod_info_ap_get_server_na... of Package apache2

Overview Repositories Revisions Requests Users Attributes Meta

File httpd-2.2.x-bnc806458-mod_info_ap_get_server_name-xss.diff of Package apache2

diff -rNU 30 ../httpd-2.2.12-o/modules/generators/mod_info.c ./modules/generators/mod_info.c
--- ../httpd-2.2.12-o/modules/generators/mod_info.c	2009-07-10 14:18:07.000000000 +0200
+++ ./modules/generators/mod_info.c	2013-03-27 09:49:12.000000000 +0100
@@ -344,61 +344,61 @@
 server_rec *serv = r->server;
 int max_daemons, forked, threaded;
 
 ap_rputs("<h2><a name=\"server\">Server Settings</a></h2>", r);
 ap_rprintf(r,
 "<dl><dt>Server Version: "
 "<tt>%s</tt></dt>\n",
 ap_get_server_description());
 ap_rprintf(r,
 "<dt>Server Built: "
 "<tt>%s</tt></dt>\n",
 ap_get_server_built());
 ap_rprintf(r,
 "<dt>Server loaded APR Version: "
 "<tt>%s</tt></dt>\n", apr_version_string());
 ap_rprintf(r,
 "<dt>Compiled with APR Version: "
 "<tt>%s</tt></dt>\n", APR_VERSION_STRING);
 ap_rprintf(r,
 "<dt>Server loaded APU Version: "
 "<tt>%s</tt></dt>\n", apu_version_string());
 ap_rprintf(r,
 "<dt>Compiled with APU Version: "
 "<tt>%s</tt></dt>\n", APU_VERSION_STRING);
 ap_rprintf(r,
 "<dt>Module Magic Number: "
 "<tt>%d:%d</tt></dt>\n", MODULE_MAGIC_NUMBER_MAJOR,
 MODULE_MAGIC_NUMBER_MINOR);
 ap_rprintf(r,
 "<dt>Hostname/port: "
- "<tt>%s:%u</tt></dt>\n", ap_get_server_name(r),
+ "<tt>%s:%u</tt></dt>\n", ap_escape_html(r->pool, ap_get_server_name(r)),
 ap_get_server_port(r));
 ap_rprintf(r,
 "<dt>Timeouts: "
 "<tt>connection: %d &nbsp;&nbsp; "
 "keep-alive: %d</tt></dt>",
 (int) (apr_time_sec(serv->timeout)),
 (int) (apr_time_sec(serv->keep_alive_timeout)));
 ap_mpm_query(AP_MPMQ_MAX_DAEMON_USED, &max_daemons);
 ap_mpm_query(AP_MPMQ_IS_THREADED, &threaded);
 ap_mpm_query(AP_MPMQ_IS_FORKED, &forked);
 ap_rprintf(r, "<dt>MPM Name: <tt>%s</tt></dt>\n",
 ap_show_mpm());
 ap_rprintf(r,
 "<dt>MPM Information: "
 "<tt>Max Daemons: %d Threaded: %s Forked: %s</tt></dt>\n",
 max_daemons, threaded ? "yes" : "no", forked ? "yes" : "no");
 ap_rprintf(r,
 "<dt>Server Architecture: "
 "<tt>%ld-bit</tt></dt>\n", 8 * (long) sizeof(void *));
 ap_rprintf(r,
 "<dt>Server Root: "
 "<tt>%s</tt></dt>\n", ap_server_root);
 ap_rprintf(r,
 "<dt>Config File: "
 "<tt>%s</tt></dt>\n", ap_conftree->filename);
 
 ap_rputs("<dt>Server Built With:\n"
 "<tt style=\"white-space: pre;\">\n", r);
 
 /* TODO: Not all of these defines are getting set like they do in main.c.

Places

File httpd-2.2.x-bnc806458-mod_info_ap_get_server_name-xss.diff of Package apache2

Places