Return-Path: Delivered-To: apmail-httpd-cvs-archive@www.apache.org Received: (qmail 51609 invoked from network); 4 Feb 2005 00:08:31 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (209.237.227.199) by minotaur-2.apache.org with SMTP; 4 Feb 2005 00:08:31 -0000 Received: (qmail 50047 invoked by uid 500); 4 Feb 2005 00:08:30 -0000 Delivered-To: apmail-httpd-cvs-archive@httpd.apache.org Received: (qmail 50011 invoked by uid 500); 4 Feb 2005 00:08:30 -0000 Mailing-List: contact cvs-help@httpd.apache.org; run by ezmlm Precedence: bulk Reply-To: dev@httpd.apache.org list-help: list-unsubscribe: list-post: Delivered-To: mailing list cvs@httpd.apache.org Received: (qmail 49997 invoked by uid 99); 4 Feb 2005 00:08:30 -0000 X-ASF-Spam-Status: No, hits=-9.8 required=10.0 tests=ALL_TRUSTED,NO_REAL_NAME X-Spam-Check-By: apache.org Received: from minotaur.apache.org (HELO minotaur.apache.org) (209.237.227.194) by apache.org (qpsmtpd/0.28) with SMTP; Thu, 03 Feb 2005 16:08:28 -0800 Received: (qmail 51573 invoked by uid 65534); 4 Feb 2005 00:08:27 -0000 Message-ID: <20050204000827.51572.qmail@minotaur.apache.org> Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Mailer: svnmailer-1.0.0-dev Date: Fri, 04 Feb 2005 00:08:27 -0000 Subject: svn commit: r151264 - in httpd/httpd/branches/2.0.x: CHANGES docs/conf/httpd-std.conf.in docs/conf/httpd-win.conf docs/manual/mod/core.xml docs/manual/mod/mod_mime.xml To: cvs@httpd.apache.org From: jerenkrantz@apache.org X-Virus-Checked: Checked X-Spam-Rating: minotaur-2.apache.org 1.6.2 0/1000/N Author: jerenkrantz Date: Thu Feb 3 16:08:25 2005 New Revision: 151264 URL: http://svn.apache.org/viewcvs?view=3Drev&rev=3D151264 Log: conf: Remove AddDefaultCharset from the default configuration because setting a site-wide default does more harm than good. MFC: 111581 PR: 23421 Reviewed by: fielding, erikabele, jerenkrantz Modified: httpd/httpd/branches/2.0.x/CHANGES httpd/httpd/branches/2.0.x/docs/conf/httpd-std.conf.in httpd/httpd/branches/2.0.x/docs/conf/httpd-win.conf httpd/httpd/branches/2.0.x/docs/manual/mod/core.xml httpd/httpd/branches/2.0.x/docs/manual/mod/mod_mime.xml Modified: httpd/httpd/branches/2.0.x/CHANGES URL: http://svn.apache.org/viewcvs/httpd/httpd/branches/2.0.x/CHANGES?view= =3Ddiff&r1=3D151263&r2=3D151264 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D --- httpd/httpd/branches/2.0.x/CHANGES (original) +++ httpd/httpd/branches/2.0.x/CHANGES Thu Feb 3 16:08:25 2005 @@ -1,5 +1,9 @@ Changes with Apache 2.0.53 =20 + *) conf: Remove AddDefaultCharset from the default configuration because + setting a site-wide default does more harm than good. PR 23421. + [Roy Fielding] + *) Add charset to example CGI scripts. [Roy Fielding] =20 *) mod_ssl: fail quickly if SSL connection is aborted rather than Modified: httpd/httpd/branches/2.0.x/docs/conf/httpd-std.conf.in URL: http://svn.apache.org/viewcvs/httpd/httpd/branches/2.0.x/docs/conf/htt= pd-std.conf.in?view=3Ddiff&r1=3D151263&r2=3D151264 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D --- httpd/httpd/branches/2.0.x/docs/conf/httpd-std.conf.in (original) +++ httpd/httpd/branches/2.0.x/docs/conf/httpd-std.conf.in Thu Feb 3 16:08= :25 2005 @@ -771,18 +771,6 @@ ForceLanguagePriority Prefer Fallback =20 # -# Specify a default charset for all pages sent out. This is -# always a good idea and opens the door for future internationalisation -# of your web site, should you ever want it. Specifying it as -# a default does little harm; as the standard dictates that a page -# is in iso-8859-1 (latin1) unless specified otherwise i.e. you -# are merely stating the obvious. There are also some security -# reasons in browsers, related to javascript and URL parsing -# which encourage you to always set a default char set. -# -AddDefaultCharset ISO-8859-1 - -# # Commonly used filename extensions to character sets. You probably # want to avoid clashes with the language extensions, unless you # are good at carefully testing your setup after each change. Modified: httpd/httpd/branches/2.0.x/docs/conf/httpd-win.conf URL: http://svn.apache.org/viewcvs/httpd/httpd/branches/2.0.x/docs/conf/htt= pd-win.conf?view=3Ddiff&r1=3D151263&r2=3D151264 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D --- httpd/httpd/branches/2.0.x/docs/conf/httpd-win.conf (original) +++ httpd/httpd/branches/2.0.x/docs/conf/httpd-win.conf Thu Feb 3 16:08:25= 2005 @@ -689,18 +689,6 @@ ForceLanguagePriority Prefer Fallback =20 # -# Specify a default charset for all pages sent out. This is -# always a good idea and opens the door for future internationalisation -# of your web site, should you ever want it. Specifying it as -# a default does little harm; as the standard dictates that a page -# is in iso-8859-1 (latin1) unless specified otherwise i.e. you -# are merely stating the obvious. There are also some security -# reasons in browsers, related to javascript and URL parsing -# which encourage you to always set a default char set. -# -AddDefaultCharset ISO-8859-1 - -# # Commonly used filename extensions to character sets. You probably # want to avoid clashes with the language extensions, unless you # are good at carefully testing your setup after each change. Modified: httpd/httpd/branches/2.0.x/docs/manual/mod/core.xml URL: http://svn.apache.org/viewcvs/httpd/httpd/branches/2.0.x/docs/manual/m= od/core.xml?view=3Ddiff&r1=3D151263&r2=3D151264 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D --- httpd/httpd/branches/2.0.x/docs/manual/mod/core.xml (original) +++ httpd/httpd/branches/2.0.x/docs/manual/mod/core.xml Thu Feb 3 16:08:25= 2005 @@ -139,8 +139,8 @@ =20 AddDefaultCharset -Default character set to be added for a -response without an explicit character set +Default charset parameter to be added when a response +content-type is "text/plain" or "text/html" AddDefaultCharset On|Off|charset AddDefaultCharset Off server config @@ -149,21 +149,36 @@ FileInfo =20 -

This directive specifies the name of the character set that - will be added to any response that does not have any parameter on - the content type in the HTTP headers. This will override any - character set specified in the body of the document via a - META tag. A setting of AddDefaultCharset - Off disables this - functionality. AddDefaultCharset On enables - Apache's internal default charset of iso-8859-1 as - required by the directive. You can also specify an alternate - charset to be used. For example:

+

This directive specifies a default value for the media type + charset parameter (the name of a character encoding) to be added + to a response if and only if the response's content-type is either + "text/plain" or "text/html". This should override any charset + specified in the body of the document via a META tag, + though the exact behavior is often dependent on the user's client + configuration. A setting of AddDefaultCharset Off + disables this functionality. AddDefaultCharset On enables + a default charset of iso-8859-1. Any other value is assum= ed + to be the charset to be used, which should be one of the + IANA regist= ered + charset values for use in MIME media types. + For example:

=20 AddDefaultCharset utf-8 + +

AddDefaultCharset should only be used when all + of the text resources to which it applies are known to be in that + character encoding and it is too inconvenient to label their charset + individually. One such example is to add the charset parameter + to resources containing generated content, such as legacy CGI + scripts, that might be vulnerable to cross-site scripting attacks + due to user-provided data being included in the output. Note, however, + that a better solution is to just fix (or delete) those scripts, since + setting a default charset does not protect users that have enabled + the "auto-detect character encoding" feature on their browser.

 +AddCharset =20 Modified: httpd/httpd/branches/2.0.x/docs/manual/mod/mod_mime.xml URL: http://svn.apache.org/viewcvs/httpd/httpd/branches/2.0.x/docs/manual/m= od/mod_mime.xml?view=3Ddiff&r1=3D151263&r2=3D151264 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D --- httpd/httpd/branches/2.0.x/docs/manual/mod/mod_mime.xml (original) +++ httpd/httpd/branches/2.0.x/docs/manual/mod/mod_mime.xml Thu Feb 3 16:0= 8:25 2005 @@ -235,7 +235,8 @@

The AddCharset directive maps the given filename extensions to the specified content charset. charset - is the MIME charset parameter of filenames containing + is the MIME + charset parameter of filenames containing extension. This mapping is added to any already in force, overriding any mappings that already exist for the same extension.