mirror/nginx
1
0
Fork 0
mirror of https://github.com/nginx/nginx.git synced 2025-07-24 14:16:20 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

nginx-0.3.9-RELEASE import

Browse Source 
*) Bugfix: nginx considered URI as unsafe if two any symbols was
       between two slashes; the bug had appeared in 0.3.8.
This commit is contained in:
Igor Sysoev 2005-11-10 07:44:53 +00:00
parent 75c1903fbf
commit 3fc6f64bd2
3 changed files with 23 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
docs/xml/nginx/changes.xml
View File

@ -9,6 +9,23 @@
<title lang="en">nginx changelog</title>
<changes ver="0.3.9" date="10.11.2005">
<change type="bugfix">
<para lang="ru">
nginx ÓÞÉÔÁÌ ÎÅÂÅÚÏÐÁÓÎÙÍÉ URI, × ËÏÔÏÒÙÈ ÍÅÖÄÕ Ä×ÕÍÑ ÓÌÜÛÁÍÉ
ÎÁÈÏÄÉÌÏÓØ Ä×Á ÌÀÂÙÈ ÓÉÍ×ÏÌÁ;
ÏÛÉÂËÁ ÐÏÑ×ÉÌÁÓØ × 0.3.8.
</para>
<para lang="en">
nginx considered URI as unsafe if two any symbols was between two slashes;
bug appeared in 0.3.8.
</para>
</change>
</changes>
<changes ver="0.3.8" date="09.11.2005">
<change type="security">
@ -119,7 +136,7 @@ and temporary files with client requests in open state.
<change type="bugfix">
<para lang="ru">
рабочие процессы не сбрасывал буферизированные логи при плавном выходе.
ÒÁÂÏÞÉÅ ÐÒÏÃÅÓÓÙ ÎÅ ÓÂÒÁÓÙ×ÁÌÉ ÂÕÆÅÒÉÚÉÒÏ×ÁÎÎÙÅ ÌÏÇÉ ÐÒÉ ÐÌÁ×ÎÏÍ ×ÙÈÏÄÅ.
</para>
<para lang="en">
the worker processes did not flush the buffered logs on graceful exit.

2
src/core/nginx.h
View File

@ -8,7 +8,7 @@
#define _NGINX_H_INCLUDED_
#define NGINX_VER "nginx/0.3.8"
#define NGINX_VER "nginx/0.3.9"
#define NGINX_VAR "NGINX"
#define NGX_OLDPID_EXT ".oldbin"

6
src/http/ngx_http_parse.c
View File

@ -1056,7 +1056,7 @@ ngx_http_parse_unsafe_uri(ngx_http_request_t *r, ngx_str_t *uri,
/* detect "/../" */
if (p[2] == '/') {
if (p[0] == '.' && p[1] == '.' && p[2] == '/') {
goto unsafe;
}
@ -1070,7 +1070,9 @@ ngx_http_parse_unsafe_uri(ngx_http_request_t *r, ngx_str_t *uri,
/* detect "/.../" */
if (p[3] == '/' || p[3] == '\\') {
if (p[0] == '.' && p[1] == '.' && p[2] == '.'
&& (p[3] == '/' || p[3] == '\\'))
{
goto unsafe;
}
}