httpd-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Jeff Trawick <traw...@gmail.com>
Subject Re: svn commit: r1362538 - in /httpd/httpd/trunk: CHANGES server/util_script.c
Date Thu, 19 Jul 2012 16:59:41 GMT
On Thu, Jul 19, 2012 at 12:56 PM, Chris Darroch <chrisd@pearsoncmg.com> wrote:
> Jeff Trawick wrote:
>
>>> Modified: httpd/httpd/trunk/server/util_script.c
>>> URL:
>>> http://svn.apache.org/viewvc/httpd/httpd/trunk/server/util_script.c?rev=1362538&r1=1362537&r2=1362538&view=diff
>>>
>>> ==============================================================================
>>> --- httpd/httpd/trunk/server/util_script.c (original)
>>> +++ httpd/httpd/trunk/server/util_script.c Tue Jul 17 15:26:27 2012
>>> @@ -592,11 +592,11 @@ AP_DECLARE(int) ap_scan_script_header_er
>>>              if (!ap_is_HTTP_VALID_RESPONSE(cgi_status))
>>>                  ap_log_rerror(SCRIPT_LOG_MARK, APLOG_ERR|APLOG_TOCLIENT,
>>> 0, r,
>>>                                "Invalid status line from script '%s':
>>> %s",
>>
>>
>> what about limiting the number of characters logged and potentially
>> sent to the client via error-notes?
>>
>> ("%.120s" anyone?)
>
>
>   Sounds good to me ... are there any debug/trace log which truncate
> output in a similar way that could serve as "best practices" examples?
> I fished around a bit for %.[0-9]+s but didn't see anything obvious ...

dunno

Actually, I wonder why this code allows the unexpected script output
to be part of error-notes anyway.  In fact all the uses of
APLOG_TOCLIENT look suspect.  Why should the client be told anything
about the application that handles the request?  The feature
presumably helps CGI developers, but they should be able to check the
error log.

>
> Chris.
>
> --
> GPG Key ID: 088335A9
> GPG Key Fingerprint: 86CD 3297 7493 75BC F820  6715 F54F E648 0883 35A9
>



-- 
Born in Roswell... married an alien...
http://emptyhammock.com/

Mime
View raw message