httpd-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Alexandra Zaharia" <f0r...@gmail.com>
Subject Re: [users@httpd] AddDefaultLanguage broken?
Date Fri, 29 Feb 2008 04:29:40 GMT
On 2/28/08, Joshua Slive <joshua@slive.ca> wrote:
> In earlier versions, mod_autoindex didn't set any charset at all. This
>  meant that AddDefaultCharset, which only works when no other charset
>  is specified, was picked up. But it also meant that no charset was
>  sent at all if AddDefaultCharset wasn't present.
>
>  To protect buggy browsers from cross-site scripting (XSS) attacks, all
>  content originated from apache needs to have a charset assigned, so a
>  change was made in 2.2.6 to assign a charset (utf-8 for windows and
>  iso-8859-1 for everything else, if I recall correctly). The charset
>  option was also added to IndexOptions for those who need to override
>  it.
>
>  So, yes, the current behavior is expected and correct and the old
>  behavior is wrong. You should use IndexOptions charset= to change the
>  mod_autoindex charset and not AddDefaultCharset.
>
>  Joshua.

Hello Joshua,

Thank you for your reply. Now it all starts to make sense. Thinking
back, I noticed this behavior for the first time right after the
cross-site scripting vulnerability was announced and patched. I found
this whole thing strange since apparenlty I was going 'by the manual'
-- so far on the official 2.2/mod/core documentation page there's no
mention of this change.

Cheers,

Alex.

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org


Mime
View raw message