summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorFelix Fietkau <nbd@openwrt.org>2006-11-25 02:28:17 +0000
committerFelix Fietkau <nbd@openwrt.org>2006-11-25 02:28:17 +0000
commit9b6e2862b6c455afc9d39576641705c5d06671f8 (patch)
tree0687e4aac563fea99a2a82a03cbbef5f986bb749
parent292be415a068af077062f3673688804971561fa2 (diff)
downloadmtk-20170518-9b6e2862b6c455afc9d39576641705c5d06671f8.zip
mtk-20170518-9b6e2862b6c455afc9d39576641705c5d06671f8.tar.gz
mtk-20170518-9b6e2862b6c455afc9d39576641705c5d06671f8.tar.bz2
haserl: use a different prefix for cookie variables to prevent form variable injection from other websites (potential security risk)
SVN-Revision: 5638
-rw-r--r--package/haserl/patches/100-cookie_prefix.patch20
1 files changed, 20 insertions, 0 deletions
diff --git a/package/haserl/patches/100-cookie_prefix.patch b/package/haserl/patches/100-cookie_prefix.patch
new file mode 100644
index 0000000..abd19bc
--- /dev/null
+++ b/package/haserl/patches/100-cookie_prefix.patch
@@ -0,0 +1,20 @@
+diff -ur haserl.old/src/haserl.c haserl.dev/src/haserl.c
+--- haserl.old/src/haserl.c 2004-11-10 18:59:35.000000000 +0100
++++ haserl.dev/src/haserl.c 2006-11-25 03:24:31.000000000 +0100
+@@ -74,6 +74,7 @@
+ token_t /*@null@*/ *token_list = NULL;
+
+ char global_variable_prefix[] = HASERL_VAR_PREFIX;
++char cookie_variable_prefix[] = "COOKIE_";
+ int global_subshell_pipe[4];
+ int global_subshell_pid;
+ int global_subshell_died = 0;
+@@ -221,7 +222,7 @@
+ while (token) {
+ // skip leading spaces
+ while ( token[0] == ' ' ) { token++; }
+- myputenv(token, global_variable_prefix);
++ myputenv(token, cookie_variable_prefix);
+ token=strtok(NULL, ";");
+ }
+ free (qs);