From e66a3d328ebba33e6580a917041a68b5e2d2aeb6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Fri, 12 Jul 2024 13:39:26 +0200 Subject: [PATCH] Add missing patch Resolves: RHEL-45777 - httpd:2.4/httpd: Improper escaping of output in mod_rewrite (CVE-2024-38475) --- httpd-2.4.37-CVE-2024-38473.patch | 172 ++++++++++ httpd-2.4.37-CVE-2024-38476.patch | 545 ------------------------------ 2 files changed, 172 insertions(+), 545 deletions(-) create mode 100644 httpd-2.4.37-CVE-2024-38473.patch delete mode 100644 httpd-2.4.37-CVE-2024-38476.patch diff --git a/httpd-2.4.37-CVE-2024-38473.patch b/httpd-2.4.37-CVE-2024-38473.patch new file mode 100644 index 0000000..7c26944 --- /dev/null +++ b/httpd-2.4.37-CVE-2024-38473.patch @@ -0,0 +1,172 @@ +diff --git a/modules/proxy/mod_proxy.c b/modules/proxy/mod_proxy.c +index a6df1b8..94ec87e 100644 +--- a/modules/proxy/mod_proxy.c ++++ b/modules/proxy/mod_proxy.c +@@ -968,6 +968,7 @@ static int proxy_fixup(request_rec *r) + + return OK; /* otherwise; we've done the best we can */ + } ++ + /* Send a redirection if the request contains a hostname which is not */ + /* fully qualified, i.e. doesn't have a domain name appended. Some proxy */ + /* servers like Netscape's allow this and access hosts from the local */ +@@ -1021,7 +1022,7 @@ static int proxy_handler(request_rec *r) + ap_get_module_config(sconf, &proxy_module); + apr_array_header_t *proxies = conf->proxies; + struct proxy_remote *ents = (struct proxy_remote *) proxies->elts; +- int i, rc, access_status; ++ int rc = DECLINED, access_status, i; + int direct_connect = 0; + const char *str; + apr_int64_t maxfwd; +@@ -1036,19 +1037,28 @@ static int proxy_handler(request_rec *r) + return DECLINED; + } + +- if (!r->proxyreq) { +- /* We may have forced the proxy handler via config or .htaccess */ +- if (r->handler && +- strncmp(r->handler, "proxy:", 6) == 0 && +- strncmp(r->filename, "proxy:", 6) != 0) { +- r->proxyreq = PROXYREQ_REVERSE; +- r->filename = apr_pstrcat(r->pool, r->handler, r->filename, NULL); ++ /* We may have forced the proxy handler via config or .htaccess */ ++ if (!r->proxyreq && r->handler && strncmp(r->handler, "proxy:", 6) == 0) { ++ char *old_filename = r->filename; ++ ++ r->proxyreq = PROXYREQ_REVERSE; ++ r->filename = apr_pstrcat(r->pool, r->handler, r->filename, NULL); ++ ++ /* Still need to fixup/canonicalize r->filename */ ++ rc = ap_proxy_fixup_uds_filename(r); ++ if (rc <= OK) { ++ rc = proxy_fixup(r); + } +- else { +- return DECLINED; ++ if (rc != OK) { ++ r->filename = old_filename; ++ r->proxyreq = 0; + } +- } else if (strncmp(r->filename, "proxy:", 6) != 0) { +- return DECLINED; ++ } ++ else if (r->proxyreq && strncmp(r->filename, "proxy:", 6) == 0) { ++ rc = OK; ++ } ++ if (rc != OK) { ++ return rc; + } + + /* handle max-forwards / OPTIONS / TRACE */ +diff --git a/modules/proxy/mod_proxy.h b/modules/proxy/mod_proxy.h +index e5c0a26..354f395 100644 +--- a/modules/proxy/mod_proxy.h ++++ b/modules/proxy/mod_proxy.h +@@ -921,6 +921,14 @@ PROXY_DECLARE(proxy_balancer_shared *) ap_proxy_find_balancershm(ap_slotmem_prov + proxy_balancer *balancer, + unsigned int *index); + ++/* ++ * Strip the UDS part of r->filename if any, and put the UDS path in ++ * r->notes ("uds_path") ++ * @param r current request ++ * @return OK if fixed up, DECLINED if not UDS, or an HTTP_XXX error ++ */ ++PROXY_DECLARE(int) ap_proxy_fixup_uds_filename(request_rec *r); ++ + /** + * Get the most suitable worker and/or balancer for the request + * @param worker worker used for processing request +diff --git a/modules/proxy/proxy_util.c b/modules/proxy/proxy_util.c +index 6626ea0..6244e74 100644 +--- a/modules/proxy/proxy_util.c ++++ b/modules/proxy/proxy_util.c +@@ -2098,7 +2098,7 @@ static int ap_proxy_retry_worker(const char *proxy_function, proxy_worker *worke + * were passed a UDS url (eg: from mod_proxy) and adjust uds_path + * as required. + */ +-static int fix_uds_filename(request_rec *r, char **url) ++PROXY_DECLARE(int) ap_proxy_fixup_uds_filename(request_rec *r) + { + char *uds_url = r->filename + 6, *origin_url; + +@@ -2106,7 +2106,6 @@ static int fix_uds_filename(request_rec *r, char **url) + !ap_cstr_casecmpn(uds_url, "unix:", 5) && + (origin_url = ap_strchr(uds_url + 5, '|'))) { + char *uds_path = NULL; +- apr_size_t url_len; + apr_uri_t urisock; + apr_status_t rv; + +@@ -2122,21 +2121,20 @@ static int fix_uds_filename(request_rec *r, char **url) + if (!uds_path) { + ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10292) + "Invalid proxy UDS filename (%s)", r->filename); +- return 0; ++ return HTTP_BAD_REQUEST; + } + apr_table_setn(r->notes, "uds_path", uds_path); + +- /* Remove the UDS path from *url and r->filename */ +- url_len = strlen(origin_url); +- *url = apr_pstrmemdup(r->pool, origin_url, url_len); +- memcpy(uds_url, *url, url_len + 1); +- + ap_log_rerror(APLOG_MARK, APLOG_TRACE2, 0, r, +- "*: rewrite of url due to UDS(%s): %s (%s)", +- uds_path, *url, r->filename); ++ "*: fixup UDS from %s: %s (%s)", ++ r->filename, origin_url, uds_path); ++ ++ /* Overwrite the UDS part in place */ ++ memmove(uds_url, origin_url, strlen(origin_url) + 1); ++ return OK; + } + +- return 1; ++ return DECLINED; + } + + PROXY_DECLARE(int) ap_proxy_pre_request(proxy_worker **worker, +@@ -2155,9 +2153,6 @@ PROXY_DECLARE(int) ap_proxy_pre_request(proxy_worker **worker, + ap_log_rerror(APLOG_MARK, APLOG_TRACE2, 0, r, + "%s: found worker %s for %s", + (*worker)->s->scheme, (*worker)->s->name, *url); +- if (!forward && !fix_uds_filename(r, url)) { +- return HTTP_INTERNAL_SERVER_ERROR; +- } + access_status = OK; + } + else if (forward) { +@@ -2187,9 +2182,6 @@ PROXY_DECLARE(int) ap_proxy_pre_request(proxy_worker **worker, + * regarding the Connection header in the request. + */ + apr_table_setn(r->subprocess_env, "proxy-nokeepalive", "1"); +- if (!fix_uds_filename(r, url)) { +- return HTTP_INTERNAL_SERVER_ERROR; +- } + } + } + } +@@ -2199,6 +2191,20 @@ PROXY_DECLARE(int) ap_proxy_pre_request(proxy_worker **worker, + "all workers are busy. Unable to serve %s", *url); + access_status = HTTP_SERVICE_UNAVAILABLE; + } ++ ++ if (access_status == OK && r->proxyreq == PROXYREQ_REVERSE) { ++ int rc = ap_proxy_fixup_uds_filename(r); ++ if (ap_is_HTTP_ERROR(rc)) { ++ return rc; ++ } ++ /* If the URL has changed in r->filename, take everything after ++ * the "proxy:" prefix. ++ */ ++ if (rc == OK) { ++ *url = apr_pstrdup(r->pool, r->filename + 6); ++ } ++ } ++ + return access_status; + } + diff --git a/httpd-2.4.37-CVE-2024-38476.patch b/httpd-2.4.37-CVE-2024-38476.patch deleted file mode 100644 index 0b35e4e..0000000 --- a/httpd-2.4.37-CVE-2024-38476.patch +++ /dev/null @@ -1,545 +0,0 @@ -diff --git a/include/http_protocol.h b/include/http_protocol.h -index 8ed77ac..81949ca 100644 ---- a/include/http_protocol.h -+++ b/include/http_protocol.h -@@ -402,6 +402,17 @@ AP_DECLARE(void) ap_clear_method_list(ap_method_list_t *l); - */ - AP_DECLARE(void) ap_set_content_type(request_rec *r, const char *ct); - -+/** -+ * Set the content type for this request (r->content_type). -+ * @param r The current request -+ * @param ct The new content type -+ * @param trusted If non-zero, The content-type should come from a -+ * trusted source such as server configuration rather -+ * than application output. -+ * for the AddOutputFilterByType directive to work correctly. -+ */ -+AP_DECLARE(void) ap_set_content_type_ex(request_rec *r, const char *ct, int trusted); -+ - /** - * Set the Accept-Ranges header for this response - * @param r The current request -diff --git a/include/httpd.h b/include/httpd.h -index 99f7f04..a8be236 100644 ---- a/include/httpd.h -+++ b/include/httpd.h -@@ -685,6 +685,13 @@ struct ap_method_list_t { - /** Useful for common code with either platform charset. */ - #define CRLF_ASCII "\015\012" - -+/** -+ * These constants represent bitmasks for notes associated with this -+ * request. There are space for 64 bits in the apr_uint64_t. -+ * -+ */ -+#define AP_REQUEST_TRUSTED_CT 1 << 1 -+ - /** - * @defgroup values_request_rec_body Possible values for request_rec.read_body - * @{ -@@ -715,6 +722,12 @@ struct ap_method_list_t { - - /** @} // values_request_rec_used_path_info */ - -+/** -+ * Returns true if the content-type field is from a trusted source -+ */ -+#define AP_REQUEST_IS_TRUSTED_CT(r) \ -+ (!!AP_REQUEST_GET_BNOTE((r), AP_REQUEST_TRUSTED_CT)) -+/** @} */ - - /* - * Things which may vary per file-lookup WITHIN a request --- -diff --git a/modules/cluster/mod_heartmonitor.c b/modules/cluster/mod_heartmonitor.c -index 965fef5..6df3bf4 100644 ---- a/modules/cluster/mod_heartmonitor.c -+++ b/modules/cluster/mod_heartmonitor.c -@@ -782,7 +782,7 @@ static int hm_handler(request_rec *r) - hmserver.seen = apr_time_now(); - hm_update_stat(ctx, &hmserver, r->pool); - -- ap_set_content_type(r, "text/plain"); -+ ap_set_content_type_ex(r, "text/plain", 1); - ap_set_content_length(r, 2); - ap_rputs("OK", r); - ap_rflush(r); -diff --git a/modules/dav/main/mod_dav.c b/modules/dav/main/mod_dav.c -index 792b514..28479b9 100644 ---- a/modules/dav/main/mod_dav.c -+++ b/modules/dav/main/mod_dav.c -@@ -323,7 +323,7 @@ static int dav_error_response(request_rec *r, int status, const char *body) - r->status = status; - r->status_line = ap_get_status_line(status); - -- ap_set_content_type(r, "text/html; charset=ISO-8859-1"); -+ ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1); - - /* begin the response now... */ - ap_rvputs(r, -@@ -354,7 +354,7 @@ static int dav_error_response_tag(request_rec *r, - { - r->status = err->status; - -- ap_set_content_type(r, DAV_XML_CONTENT_TYPE); -+ ap_set_content_type_ex(r, DAV_XML_CONTENT_TYPE, 1); - - ap_rputs(DAV_XML_HEADER DEBUG_CR - "status = status; -- ap_set_content_type(r, DAV_XML_CONTENT_TYPE); -+ ap_set_content_type_ex(r, DAV_XML_CONTENT_TYPE, 1); - - /* Send the headers and actual multistatus response now... */ - ap_fputs(r->output_filters, bb, DAV_XML_HEADER DEBUG_CR -@@ -1923,7 +1923,7 @@ static int dav_method_options(request_rec *r) - - /* send the options response */ - r->status = HTTP_OK; -- ap_set_content_type(r, DAV_XML_CONTENT_TYPE); -+ ap_set_content_type_ex(r, DAV_XML_CONTENT_TYPE, 1); - - /* send the headers and response body */ - ap_rputs(DAV_XML_HEADER DEBUG_CR -@@ -3191,7 +3191,7 @@ static int dav_method_lock(request_rec *r) - (*locks_hooks->close_lockdb)(lockdb); - - r->status = HTTP_OK; -- ap_set_content_type(r, DAV_XML_CONTENT_TYPE); -+ ap_set_content_type_ex(r, DAV_XML_CONTENT_TYPE, 1); - - ap_rputs(DAV_XML_HEADER DEBUG_CR "" DEBUG_CR, r); - if (lock == NULL) -diff --git a/modules/examples/mod_example_hooks.c b/modules/examples/mod_example_hooks.c -index d818dc1..4d79b86 100644 ---- a/modules/examples/mod_example_hooks.c -+++ b/modules/examples/mod_example_hooks.c -@@ -993,7 +993,7 @@ static int x_handler(request_rec *r) - * Set the Content-type header. Note that we do not actually have to send - * the headers: this is done by the http core. - */ -- ap_set_content_type(r, "text/html"); -+ ap_set_content_type_ex(r, "text/html", 1); - /* - * If we're only supposed to send header information (HEAD request), we're - * already there. -diff --git a/modules/filters/mod_data.c b/modules/filters/mod_data.c -index d083d32..489e76c 100644 ---- a/modules/filters/mod_data.c -+++ b/modules/filters/mod_data.c -@@ -117,7 +117,7 @@ static apr_status_t data_out_filter(ap_filter_t *f, apr_bucket_brigade *bb) - } - } - -- ap_set_content_type(r, "text/plain"); -+ ap_set_content_type_ex(r, "text/plain", 1); - - } - -diff --git a/modules/filters/mod_include.c b/modules/filters/mod_include.c -index a46a944..05f994c 100644 ---- a/modules/filters/mod_include.c -+++ b/modules/filters/mod_include.c -@@ -3971,7 +3971,7 @@ static int include_fixup(request_rec *r) - if (r->handler && (strcmp(r->handler, "server-parsed") == 0)) - { - if (!r->content_type || !*r->content_type) { -- ap_set_content_type(r, "text/html"); -+ ap_set_content_type_ex(r, "text/html", 1); - } - r->handler = "default-handler"; - } -diff --git a/modules/filters/mod_proxy_html.c b/modules/filters/mod_proxy_html.c -index ea6bf03..8b619e8 100644 ---- a/modules/filters/mod_proxy_html.c -+++ b/modules/filters/mod_proxy_html.c -@@ -933,7 +933,7 @@ static apr_status_t proxy_html_filter(ap_filter_t *f, apr_bucket_brigade *bb) - ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, f->r, APLOGNO(01422) - "No i18n support found. Install mod_xml2enc if required"); - enc = XML_CHAR_ENCODING_NONE; -- ap_set_content_type(f->r, "text/html;charset=utf-8"); -+ ap_set_content_type_ex(f->r, "text/html;charset=utf-8", 1); - } - else { - /* if we wanted a non-default charset_out, insert the -@@ -949,7 +949,7 @@ static apr_status_t proxy_html_filter(ap_filter_t *f, apr_bucket_brigade *bb) - cenc, NULL)); - } - else /* Normal case, everything worked, utf-8 output */ -- ap_set_content_type(f->r, "text/html;charset=utf-8"); -+ ap_set_content_type_ex(f->r, "text/html;charset=utf-8", 1); - } - - ap_fputs(f->next, ctxt->bb, ctxt->cfg->doctype); -diff --git a/modules/generators/mod_cgi.c b/modules/generators/mod_cgi.c -index 66cd31c..4650d18 100644 ---- a/modules/generators/mod_cgi.c -+++ b/modules/generators/mod_cgi.c -@@ -795,7 +795,7 @@ static apr_status_t include_cgi(include_ctx_t *ctx, ap_filter_t *f, - /* Force sub_req to be treated as a CGI request, even if ordinary - * typing rules would have called it something else. - */ -- ap_set_content_type(rr, CGI_MAGIC_TYPE); -+ ap_set_content_type_ex(rr, CGI_MAGIC_TYPE, 1); - - /* Run it. */ - rr_status = ap_run_sub_req(rr); -diff --git a/modules/generators/mod_cgid.c b/modules/generators/mod_cgid.c -index 102d2b3..57e119f 100644 ---- a/modules/generators/mod_cgid.c -+++ b/modules/generators/mod_cgid.c -@@ -1801,7 +1801,7 @@ static apr_status_t include_cgi(include_ctx_t *ctx, ap_filter_t *f, - /* Force sub_req to be treated as a CGI request, even if ordinary - * typing rules would have called it something else. - */ -- ap_set_content_type(rr, CGI_MAGIC_TYPE); -+ ap_set_content_type_ex(rr, CGI_MAGIC_TYPE, 1); - - /* Run it. */ - rr_status = ap_run_sub_req(rr); -diff --git a/modules/generators/mod_info.c b/modules/generators/mod_info.c -index e5e63de..67df675 100644 ---- a/modules/generators/mod_info.c -+++ b/modules/generators/mod_info.c -@@ -777,7 +777,7 @@ static int display_info(request_rec * r) - return DECLINED; - } - -- ap_set_content_type(r, "text/html; charset=ISO-8859-1"); -+ ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1); - - ap_rputs(DOCTYPE_XHTML_1_0T - "\n" -diff --git a/modules/generators/mod_status.c b/modules/generators/mod_status.c -index 5bada07..2cb38c7 100644 ---- a/modules/generators/mod_status.c -+++ b/modules/generators/mod_status.c -@@ -273,7 +273,7 @@ static int status_handler(request_rec *r) - if (r->method_number != M_GET) - return DECLINED; - -- ap_set_content_type(r, "text/html; charset=ISO-8859-1"); -+ ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1); - - /* - * Simple table-driven form data set parser that lets you alter the header -@@ -301,7 +301,7 @@ static int status_handler(request_rec *r) - no_table_report = 1; - break; - case STAT_OPT_AUTO: -- ap_set_content_type(r, "text/plain; charset=ISO-8859-1"); -+ ap_set_content_type_ex(r, "text/plain; charset=ISO-8859-1", 1); - short_report = 1; - break; - } -diff --git a/modules/http/http_filters.c b/modules/http/http_filters.c -index 16cb23c..27c44b2 100644 ---- a/modules/http/http_filters.c -+++ b/modules/http/http_filters.c -@@ -1245,7 +1245,7 @@ AP_DECLARE_NONSTD(int) ap_send_http_trace(request_rec *r) - } - } - -- ap_set_content_type(r, "message/http"); -+ ap_set_content_type_ex(r, "message/http", 1); - - /* Now we recreate the request, and echo it back */ - -diff --git a/modules/http/http_protocol.c b/modules/http/http_protocol.c -index dcafa9c..d003aea 100644 ---- a/modules/http/http_protocol.c -+++ b/modules/http/http_protocol.c -@@ -1077,8 +1077,14 @@ AP_DECLARE(void) ap_set_content_type(request_rec *r, const char *ct) - } - else if (!r->content_type || strcmp(r->content_type, ct)) { - r->content_type = ct; -+ AP_REQUEST_SET_BNOTE(r, AP_REQUEST_TRUSTED_CT, 0); - } - } -+AP_DECLARE(void) ap_set_content_type_ex(request_rec *r, const char *ct, int trusted) -+{ -+ ap_set_content_type(r, ct); -+ AP_REQUEST_SET_BNOTE(r, AP_REQUEST_TRUSTED_CT, trusted ? AP_REQUEST_TRUSTED_CT : 0); -+} - - AP_DECLARE(void) ap_set_accept_ranges(request_rec *r) - { -@@ -1417,10 +1423,10 @@ AP_DECLARE(void) ap_send_error_response(request_rec *r, int recursive_error) - request_conf->suppress_charset = 1; /* avoid adding default - * charset later - */ -- ap_set_content_type(r, "text/html"); -+ ap_set_content_type_ex(r, "text/html", 1); - } - else { -- ap_set_content_type(r, "text/html; charset=iso-8859-1"); -+ ap_set_content_type_ex(r, "text/html; charset=iso-8859-1", 1); - } - - if ((status == HTTP_METHOD_NOT_ALLOWED) -diff --git a/modules/http/http_request.c b/modules/http/http_request.c -index e873aab..f5193db 100644 ---- a/modules/http/http_request.c -+++ b/modules/http/http_request.c -@@ -709,7 +709,7 @@ AP_DECLARE(void) ap_internal_fast_redirect(request_rec *rr, request_rec *r) - r->args = rr->args; - r->finfo = rr->finfo; - r->handler = rr->handler; -- ap_set_content_type(r, rr->content_type); -+ ap_set_content_type_ex(r, rr->content_type, AP_REQUEST_IS_TRUSTED_CT(r)); - r->content_encoding = rr->content_encoding; - r->content_languages = rr->content_languages; - r->per_dir_config = rr->per_dir_config; -diff --git a/modules/http/mod_mime.c b/modules/http/mod_mime.c -index 28c53be..4cd1c48 100644 ---- a/modules/http/mod_mime.c -+++ b/modules/http/mod_mime.c -@@ -759,7 +759,7 @@ static int find_ct(request_rec *r) - int found_metadata = 0; - - if (r->finfo.filetype == APR_DIR) { -- ap_set_content_type(r, DIR_MAGIC_TYPE); -+ ap_set_content_type_ex(r, DIR_MAGIC_TYPE, 1); - return OK; - } - -@@ -837,7 +837,7 @@ static int find_ct(request_rec *r) - if (exinfo == NULL || !exinfo->forced_type) { - if ((type = apr_hash_get(mime_type_extensions, ext, - APR_HASH_KEY_STRING)) != NULL) { -- ap_set_content_type(r, (char*) type); -+ ap_set_content_type_ex(r, (char*) type, 1); - found = 1; - } - } -@@ -846,7 +846,7 @@ static int find_ct(request_rec *r) - - /* empty string is treated as special case for RemoveType */ - if (exinfo->forced_type && *exinfo->forced_type) { -- ap_set_content_type(r, exinfo->forced_type); -+ ap_set_content_type_ex(r, exinfo->forced_type, 1); - found = 1; - } - -@@ -951,33 +951,33 @@ static int find_ct(request_rec *r) - memcpy(tmp, ctp->subtype, ctp->subtype_len); - tmp += ctp->subtype_len; - *tmp = 0; -- ap_set_content_type(r, base_content_type); -+ ap_set_content_type_ex(r, base_content_type, AP_REQUEST_IS_TRUSTED_CT(r)); - while (pp != NULL) { - if (charset && !strcmp(pp->attr, "charset")) { - if (!override) { -- ap_set_content_type(r, -+ ap_set_content_type_ex(r, - apr_pstrcat(r->pool, - r->content_type, - "; charset=", - charset, -- NULL)); -+ NULL), AP_REQUEST_IS_TRUSTED_CT(r)); - override = 1; - } - } - else { -- ap_set_content_type(r, -+ ap_set_content_type_ex(r, - apr_pstrcat(r->pool, - r->content_type, - "; ", pp->attr, - "=", pp->val, -- NULL)); -+ NULL), AP_REQUEST_IS_TRUSTED_CT(r)); - } - pp = pp->next; - } - if (charset && !override) { -- ap_set_content_type(r, apr_pstrcat(r->pool, r->content_type, -+ ap_set_content_type_ex(r, apr_pstrcat(r->pool, r->content_type, - "; charset=", charset, -- NULL)); -+ NULL), AP_REQUEST_IS_TRUSTED_CT(r)); - } - } - } -diff --git a/modules/ldap/util_ldap.c b/modules/ldap/util_ldap.c -index eecb3f7..b71dc98 100644 ---- a/modules/ldap/util_ldap.c -+++ b/modules/ldap/util_ldap.c -@@ -125,7 +125,7 @@ static int util_ldap_handler(request_rec *r) - st = (util_ldap_state_t *) ap_get_module_config(r->server->module_config, - &ldap_module); - -- ap_set_content_type(r, "text/html; charset=ISO-8859-1"); -+ ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1); - - if (r->header_only) - return OK; -diff --git a/modules/mappers/mod_actions.c b/modules/mappers/mod_actions.c -index ac9c3b7..5e398b5 100644 ---- a/modules/mappers/mod_actions.c -+++ b/modules/mappers/mod_actions.c -@@ -182,8 +182,10 @@ static int action_handler(request_rec *r) - return DECLINED; - - /* Second, check for actions (which override the method scripts) */ -- action = r->handler ? r->handler : -- ap_field_noparam(r->pool, r->content_type); -+ action = r->handler; -+ if (!action && AP_REQUEST_IS_TRUSTED_CT(r)) { -+ action = ap_field_noparam(r->pool, r->content_type); -+ } - - if (action && (t = apr_table_get(conf->action_types, action))) { - int virtual = (*t++ == '0' ? 0 : 1); -diff --git a/modules/mappers/mod_imagemap.c b/modules/mappers/mod_imagemap.c -index 187a500..3e14933 100644 ---- a/modules/mappers/mod_imagemap.c -+++ b/modules/mappers/mod_imagemap.c -@@ -475,7 +475,7 @@ static int imap_reply(request_rec *r, const char *redirect) - - static void menu_header(request_rec *r, char *menu) - { -- ap_set_content_type(r, "text/html; charset=ISO-8859-1"); -+ ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1); - - ap_rvputs(r, DOCTYPE_HTML_3_2, "\nMenu for ", - ap_escape_html(r->pool, r->uri), -diff --git a/modules/mappers/mod_negotiation.c b/modules/mappers/mod_negotiation.c -index da68353..e91ba5f 100644 ---- a/modules/mappers/mod_negotiation.c -+++ b/modules/mappers/mod_negotiation.c -@@ -1169,7 +1169,7 @@ static int read_types_multi(negotiation_state *neg) - * might be doing. - */ - if (sub_req->handler && !sub_req->content_type) { -- ap_set_content_type(sub_req, CGI_MAGIC_TYPE); -+ ap_set_content_type_ex(sub_req, CGI_MAGIC_TYPE, 1); - } - - /* -@@ -3008,14 +3008,14 @@ static int handle_map_file(request_rec *r) - /* set MIME type and charset as negotiated */ - if (best->mime_type && *best->mime_type) { - if (best->content_charset && *best->content_charset) { -- ap_set_content_type(r, apr_pstrcat(r->pool, -+ ap_set_content_type_ex(r, apr_pstrcat(r->pool, - best->mime_type, - "; charset=", - best->content_charset, -- NULL)); -+ NULL), 1); - } - else { -- ap_set_content_type(r, apr_pstrdup(r->pool, best->mime_type)); -+ ap_set_content_type_ex(r, apr_pstrdup(r->pool, best->mime_type), 1); - } - } - -diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c -index b71c67c..1735f6d 100644 ---- a/modules/mappers/mod_rewrite.c -+++ b/modules/mappers/mod_rewrite.c -@@ -5297,7 +5297,7 @@ static int hook_mimetype(request_rec *r) - rewritelog((r, 1, NULL, "force filename %s to have MIME-type '%s'", - r->filename, t)); - -- ap_set_content_type(r, t); -+ ap_set_content_type_ex(r, t, 1); - } - - /* handler */ -diff --git a/modules/metadata/mod_headers.c b/modules/metadata/mod_headers.c -index 1ea970d..55ab281 100644 ---- a/modules/metadata/mod_headers.c -+++ b/modules/metadata/mod_headers.c -@@ -792,14 +792,14 @@ static int do_headers_fixup(request_rec *r, apr_table_t *headers, - break; - case hdr_set: - if (!strcasecmp(hdr->header, "Content-Type")) { -- ap_set_content_type(r, process_tags(hdr, r)); -+ ap_set_content_type_ex(r, process_tags(hdr, r), 1); - } - apr_table_setn(headers, hdr->header, process_tags(hdr, r)); - break; - case hdr_setifempty: - if (NULL == apr_table_get(headers, hdr->header)) { - if (!strcasecmp(hdr->header, "Content-Type")) { -- ap_set_content_type(r, process_tags(hdr, r)); -+ ap_set_content_type_ex(r, process_tags(hdr, r), 1); - } - apr_table_setn(headers, hdr->header, process_tags(hdr, r)); - } -@@ -818,7 +818,7 @@ static int do_headers_fixup(request_rec *r, apr_table_t *headers, - const char *repl = process_regexp(hdr, r->content_type, r); - if (repl == NULL) - return 0; -- ap_set_content_type(r, repl); -+ ap_set_content_type_ex(r, repl, 1); - } - if (apr_table_get(headers, hdr->header)) { - edit_do ed; -diff --git a/modules/metadata/mod_mime_magic.c b/modules/metadata/mod_mime_magic.c -index c12529a..fe30f27 100644 ---- a/modules/metadata/mod_mime_magic.c -+++ b/modules/metadata/mod_mime_magic.c -@@ -789,7 +789,7 @@ static int magic_rsl_to_request(request_rec *r) - /* XXX: this could be done at config time I'm sure... but I'm - * confused by all this magic_rsl stuff. -djg */ - ap_content_type_tolower(tmp); -- ap_set_content_type(r, tmp); -+ ap_set_content_type_ex(r, tmp, 1); - - if (state == rsl_encoding) { - tmp = rsl_strdup(r, encoding_frag, -@@ -2326,7 +2326,7 @@ static int revision_suffix(request_rec *r) - - /* extract content type/encoding/language from sub-request */ - if (sub->content_type) { -- ap_set_content_type(r, apr_pstrdup(r->pool, sub->content_type)); -+ ap_set_content_type_ex(r, apr_pstrdup(r->pool, sub->content_type), 1); - #if MIME_MAGIC_DEBUG - ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(01557) - MODNAME ": subrequest %s got %s", -diff --git a/modules/proxy/mod_proxy_balancer.c b/modules/proxy/mod_proxy_balancer.c -index c599e1a..d5c20af 100644 ---- a/modules/proxy/mod_proxy_balancer.c -+++ b/modules/proxy/mod_proxy_balancer.c -@@ -1480,7 +1480,7 @@ static int balancer_handler(request_rec *r) - - if (apr_table_get(params, "xml")) { - char date[APR_RFC822_DATE_LEN]; -- ap_set_content_type(r, "text/xml"); -+ ap_set_content_type_ex(r, "text/xml", 1); - ap_rputs("<?xml version='1.0' encoding='UTF-8' ?>\n", r); - ap_rputs("<httpd:manager xmlns:httpd='http://httpd.apache.org'>\n", r); - ap_rputs(" <httpd:balancers>\n", r); -diff --git a/server/config.c b/server/config.c -index f815b22..fc4d76b 100644 ---- a/server/config.c -+++ b/server/config.c -@@ -419,7 +419,7 @@ AP_CORE_DECLARE(int) ap_invoke_handler(request_rec *r) - } - - if (!r->handler) { -- if (r->content_type) { -+ if (r->content_type && AP_REQUEST_IS_TRUSTED_CT(r)) { - handler = r->content_type; - if ((p=ap_strchr_c(handler, ';')) != NULL) { - char *new_handler = (char *)apr_pmemdup(r->pool, handler, -diff --git a/server/core.c b/server/core.c -index ba3b87f..a9e0e4a 100644 ---- a/server/core.c -+++ b/server/core.c -@@ -4722,7 +4722,7 @@ static int core_override_type(request_rec *r) - /* Check for overrides with ForceType / SetHandler - */ - if (conf->mime_type && strcmp(conf->mime_type, "none")) -- ap_set_content_type(r, (char*) conf->mime_type); -+ ap_set_content_type_ex(r, (char*) conf->mime_type, 1); - - if (conf->expr_handler) { - const char *err;