Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Date: Fri, 9 Jan 2004 14:38:40 +0000
From: Joe Orton <jorton@redhat.com>
To: dev@httpd.apache.org
Subject: Re: log_error_core escaping change broke things
Message-ID: <20040109143839.GA26868@redhat.com>
Mail-Followup-To: dev@httpd.apache.org
References: <3FE2CE0A.2080909@stason.org>
 <20031219130404.00002a37.nd@perlig.de> <20031219130404.00002a37.nd@perlig.de>
 <3FE35130.50106@stason.org>
 <200312211525.hBLFPBY10807@secure.exclamationlabs.net>
 <3FFC6C58.9070307@modperlcookbook.org> <3FFDC1A8.3060409@stason.org>
 <20040109102919.00002e32.nd@perlig.de> <3FFEB793.4050808@modperlcookbook.org>
 <20040109153229.000011d8.nd@perlig.de>
Mime-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <20040109153229.000011d8.nd@perlig.de>
User-Agent: Mutt/1.4.1i

On Fri, Jan 09, 2004 at 03:32:29PM +0100, Andr� Malo wrote:
> * Geoffrey Young <geoff@modperlcookbook.org> wrote:
> 
> > > However, is it wise to add a configure option for it?
> > 
> > how do you mean?  I was trying to make it just a compile time option,
> > similar to -DBIG_SECURITY_HOLE (which seems to me a bigger risk than
> > this).
> >  do you mean to require users to change a define in the code itself?
> 
> No no. I wanted to say "would it be wise, to add a configure option", such
> as --without-escaping-errorlog or so.

I don't think it's appropriate to add configure switches to turn off
security features: users may not understand the implications of the
switch if they just see it in the --help output.

CFLAGS=-DUNSAFE_LOG_ESCAPING ./configure

is just as easy to document as

./configure --disable-errorlog-escaping

in any case.

Regards,

joe