Re: Security flaws in recommended CGI setup?

This is in the Spyce trunk now and will be included in the 2.1 release.

-Jonathan

On Sun, 09 Jul 2006 19:50:15 +0300, "Pauli Virtanen"
<[email protected]> said:
> la, 2006-07-08 kello 14:31 -0700, Jonathan Ellis kirjoitti:
> 
> > Sure, if you'd like to submit a patch, I will put it in.
> 
> Hi,
> 
> Here are some patches:
> 
> * cgi-security.patch
> 
>   Here's the patch to make spyce check that a redirect is done before
>   arriving at the cgi script. But since REDIRECT_STATUS is not 
>   a standard CGI header, I left an option to disable this & documented
>   this in docs.
> 
> * fcgi-output-cleanup.patch
> 
>   Make FCGI not output anything if there is nothing to output.
>   This reduces clutter in Apache's logs.
> 
> * fcgi-reload.patch
> 
>   Make FCGI to reload modules if check_modules_and_restart is enabled.
> 
>   This implementation does not result in failed requests (assuming the
>   FastCGI implementation restarts the service, as it does for
>   Apache+fcgid), but on the other hands reloads Spyce only AFTER a
>   request. As a result, two page refreshes are required. The behavior is
>   easily changed by changing the order of cgi.accept and os.exit, but
>   this results in a failed request.
> 
> 	Pauli Virtanen
> 
-- 
C++ is history repeated as tragedy. Java is history repeated as farce.  --Scott McKay


-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys -- and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV