.do-not-sync-with-fedora

@@ -0,0 +1,3 @@
+Owner: luhliari
+Rationale: RHEL branding is used in this package, will be merged manually
+           with Fedora as required.

.fmf/version

@@ -0,0 +1 @@
+1

.gitignore

@@ -1,2 +1,5 @@
-SOURCES/apache-poweredby.png
-SOURCES/httpd-2.4.37.tar.bz2
+/httpd-2.4.28.tar.bz2
+/httpd-2.4.33.tar.bz2
+/httpd-2.4.35.tar.bz2
+/httpd-2.4.37.tar.bz2
+/httpd.conf.5

.httpd.metadata

@@ -1,2 +0,0 @@
-3a7449d6cff00e5ccb3ed8571f34c0528555d38f SOURCES/apache-poweredby.png
-4a38471de821288b0300148016f2b03dfee8adf2 SOURCES/httpd-2.4.37.tar.bz2

01-md.conf

@@ -0,0 +1 @@
+LoadModule md_module modules/mod_md.so

SOURCES/httpd-2.4.37-CVE-2023-31122.patch

@@ -1,11 +0,0 @@
---- a/modules/core/mod_macro.c	2023/10/16 06:19:16	1912992
-+++ b/modules/core/mod_macro.c	2023/10/16 06:38:32	1912993
-@@ -483,7 +483,7 @@
-     for (i = 0; i < contents->nelts; i++) {
-         const char *errmsg;
-         /* copy the line and substitute macro parameters */
--        strncpy(line, ((char **) contents->elts)[i], MAX_STRING_LEN - 1);
-+        apr_cpystrn(line, ((char **) contents->elts)[i], MAX_STRING_LEN);
-         errmsg = substitute_macro_args(line, MAX_STRING_LEN,
-                                        macro, replacements, used);
-         if (errmsg) {

SOURCES/httpd-2.4.37-CVE-2023-38709.patch

@@ -1,74 +0,0 @@
-diff --git a/modules/http/http_filters.c b/modules/http/http_filters.c
-index 393343a..16cb23c 100644
---- a/modules/http/http_filters.c
-+++ b/modules/http/http_filters.c
-@@ -1348,6 +1348,9 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_http_header_filter(ap_filter_t *f,
-          */
-         apr_table_clear(r->headers_out);
-         apr_table_clear(r->err_headers_out);
-+        r->content_type = r->content_encoding = NULL;
-+        r->content_languages = NULL;
-+        r->clength = r->chunked = 0;
-         apr_brigade_cleanup(b);
- 
-         /* Don't recall ap_die() if we come back here (from its own internal
-@@ -1364,8 +1367,6 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_http_header_filter(ap_filter_t *f,
-         APR_BRIGADE_INSERT_TAIL(b, e);
-         e = apr_bucket_eos_create(c->bucket_alloc);
-         APR_BRIGADE_INSERT_TAIL(b, e);
--        r->content_type = r->content_encoding = NULL;
--        r->content_languages = NULL;
-         ap_set_content_length(r, 0);
-         recursive_error = 1;
-     }
-@@ -1392,6 +1393,7 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_http_header_filter(ap_filter_t *f,
-     if (!apr_is_empty_table(r->err_headers_out)) {
-         r->headers_out = apr_table_overlay(r->pool, r->err_headers_out,
-                                            r->headers_out);
-+        apr_table_clear(r->err_headers_out);
-     }
- 
-     /*
-@@ -1411,6 +1413,17 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_http_header_filter(ap_filter_t *f,
-         fixup_vary(r);
-     }
- 
-+
-+    /*
-+     * Control cachability for non-cacheable responses if not already set by
-+     * some other part of the server configuration.
-+     */
-+    if (r->no_cache && !apr_table_get(r->headers_out, "Expires")) {
-+        char *date = apr_palloc(r->pool, APR_RFC822_DATE_LEN);
-+        ap_recent_rfc822_date(date, r->request_time);
-+        apr_table_addn(r->headers_out, "Expires", date);
-+    }
-+
-     /*
-      * Now remove any ETag response header field if earlier processing
-      * says so (such as a 'FileETag None' directive).
-@@ -1423,6 +1436,7 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_http_header_filter(ap_filter_t *f,
-     basic_http_header_check(r, &protocol);
-     ap_set_keepalive(r);
- 
-+    /* 204/304 responses don't have content related headers */
-     if (AP_STATUS_IS_HEADER_ONLY(r->status)) {
-         apr_table_unset(r->headers_out, "Transfer-Encoding");
-         apr_table_unset(r->headers_out, "Content-Length");
-@@ -1465,16 +1479,6 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_http_header_filter(ap_filter_t *f,
-         apr_table_setn(r->headers_out, "Content-Language", field);
-     }
- 
--    /*
--     * Control cachability for non-cacheable responses if not already set by
--     * some other part of the server configuration.
--     */
--    if (r->no_cache && !apr_table_get(r->headers_out, "Expires")) {
--        char *date = apr_palloc(r->pool, APR_RFC822_DATE_LEN);
--        ap_recent_rfc822_date(date, r->request_time);
--        apr_table_addn(r->headers_out, "Expires", date);
--    }
--
-     /* This is a hack, but I can't find anyway around it.  The idea is that
-      * we don't want to send out 0 Content-Lengths if it is a head request.
-      * This happens when modules try to outsmart the server, and return

SOURCES/httpd-2.4.37-CVE-2024-38473.patch

@@ -1,172 +0,0 @@
-diff --git a/modules/proxy/mod_proxy.c b/modules/proxy/mod_proxy.c
-index a6df1b8..94ec87e 100644
---- a/modules/proxy/mod_proxy.c
-+++ b/modules/proxy/mod_proxy.c
-@@ -968,6 +968,7 @@ static int proxy_fixup(request_rec *r)
- 
-     return OK;      /* otherwise; we've done the best we can */
- }
-+
- /* Send a redirection if the request contains a hostname which is not */
- /* fully qualified, i.e. doesn't have a domain name appended. Some proxy */
- /* servers like Netscape's allow this and access hosts from the local */
-@@ -1021,7 +1022,7 @@ static int proxy_handler(request_rec *r)
-         ap_get_module_config(sconf, &proxy_module);
-     apr_array_header_t *proxies = conf->proxies;
-     struct proxy_remote *ents = (struct proxy_remote *) proxies->elts;
--    int i, rc, access_status;
-+    int rc = DECLINED, access_status, i;
-     int direct_connect = 0;
-     const char *str;
-     apr_int64_t maxfwd;
-@@ -1036,19 +1037,28 @@ static int proxy_handler(request_rec *r)
-         return DECLINED;
-     }
- 
--    if (!r->proxyreq) {
--        /* We may have forced the proxy handler via config or .htaccess */
--        if (r->handler &&
--            strncmp(r->handler, "proxy:", 6) == 0 &&
--            strncmp(r->filename, "proxy:", 6) != 0) {
--            r->proxyreq = PROXYREQ_REVERSE;
--            r->filename = apr_pstrcat(r->pool, r->handler, r->filename, NULL);
-+    /* We may have forced the proxy handler via config or .htaccess */
-+    if (!r->proxyreq && r->handler && strncmp(r->handler, "proxy:", 6) == 0) {
-+        char *old_filename = r->filename;
-+
-+        r->proxyreq = PROXYREQ_REVERSE;
-+        r->filename = apr_pstrcat(r->pool, r->handler, r->filename, NULL);
-+
-+        /* Still need to fixup/canonicalize r->filename */
-+        rc = ap_proxy_fixup_uds_filename(r);
-+        if (rc <= OK) {
-+            rc = proxy_fixup(r);
-         }
--        else {
--            return DECLINED;
-+        if (rc != OK) {
-+            r->filename = old_filename;
-+            r->proxyreq = 0;
-         }
--    } else if (strncmp(r->filename, "proxy:", 6) != 0) {
--        return DECLINED;
-+    }
-+    else if (r->proxyreq && strncmp(r->filename, "proxy:", 6) == 0) {
-+        rc = OK;
-+    }
-+    if (rc != OK) {
-+        return rc;
-     }
- 
-     /* handle max-forwards / OPTIONS / TRACE */
-diff --git a/modules/proxy/mod_proxy.h b/modules/proxy/mod_proxy.h
-index e5c0a26..354f395 100644
---- a/modules/proxy/mod_proxy.h
-+++ b/modules/proxy/mod_proxy.h
-@@ -921,6 +921,14 @@ PROXY_DECLARE(proxy_balancer_shared *) ap_proxy_find_balancershm(ap_slotmem_prov
-                                                                  proxy_balancer *balancer,
-                                                                  unsigned int *index);
- 
-+/*
-+ * Strip the UDS part of r->filename if any, and put the UDS path in
-+ * r->notes ("uds_path")
-+ * @param r        current request
-+ * @return         OK if fixed up, DECLINED if not UDS, or an HTTP_XXX error
-+ */
-+PROXY_DECLARE(int) ap_proxy_fixup_uds_filename(request_rec *r);
-+
- /**
-  * Get the most suitable worker and/or balancer for the request
-  * @param worker   worker used for processing request
-diff --git a/modules/proxy/proxy_util.c b/modules/proxy/proxy_util.c
-index 6626ea0..6244e74 100644
---- a/modules/proxy/proxy_util.c
-+++ b/modules/proxy/proxy_util.c
-@@ -2098,7 +2098,7 @@ static int ap_proxy_retry_worker(const char *proxy_function, proxy_worker *worke
-  * were passed a UDS url (eg: from mod_proxy) and adjust uds_path
-  * as required.  
-  */
--static int fix_uds_filename(request_rec *r, char **url) 
-+PROXY_DECLARE(int) ap_proxy_fixup_uds_filename(request_rec *r) 
- {
-     char *uds_url = r->filename + 6, *origin_url;
- 
-@@ -2106,7 +2106,6 @@ static int fix_uds_filename(request_rec *r, char **url)
-             !ap_cstr_casecmpn(uds_url, "unix:", 5) &&
-             (origin_url = ap_strchr(uds_url + 5, '|'))) {
-         char *uds_path = NULL;
--        apr_size_t url_len;
-         apr_uri_t urisock;
-         apr_status_t rv;
- 
-@@ -2122,21 +2121,20 @@ static int fix_uds_filename(request_rec *r, char **url)
-         if (!uds_path) {
-              ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10292)
-                      "Invalid proxy UDS filename (%s)", r->filename);
--             return 0;
-+             return HTTP_BAD_REQUEST;
-         }
-         apr_table_setn(r->notes, "uds_path", uds_path);
- 
--        /* Remove the UDS path from *url and r->filename */
--        url_len = strlen(origin_url);
--        *url = apr_pstrmemdup(r->pool, origin_url, url_len);
--        memcpy(uds_url, *url, url_len + 1);
--
-         ap_log_rerror(APLOG_MARK, APLOG_TRACE2, 0, r,
--                 "*: rewrite of url due to UDS(%s): %s (%s)",
--                 uds_path, *url, r->filename);
-+                "*: fixup UDS from %s: %s (%s)",
-+                r->filename, origin_url, uds_path);
-+
-+        /* Overwrite the UDS part in place */
-+        memmove(uds_url, origin_url, strlen(origin_url) + 1);
-+        return OK;
-      }
- 
--     return 1;
-+     return DECLINED;
- }
- 
- PROXY_DECLARE(int) ap_proxy_pre_request(proxy_worker **worker,
-@@ -2155,9 +2153,6 @@ PROXY_DECLARE(int) ap_proxy_pre_request(proxy_worker **worker,
-             ap_log_rerror(APLOG_MARK, APLOG_TRACE2, 0, r,
-                           "%s: found worker %s for %s",
-                           (*worker)->s->scheme, (*worker)->s->name, *url);
--            if (!forward && !fix_uds_filename(r, url)) {
--                     return HTTP_INTERNAL_SERVER_ERROR;
--            }
-             access_status = OK;
-         }
-         else if (forward) {
-@@ -2187,9 +2182,6 @@ PROXY_DECLARE(int) ap_proxy_pre_request(proxy_worker **worker,
-                  * regarding the Connection header in the request.
-                  */
-                 apr_table_setn(r->subprocess_env, "proxy-nokeepalive", "1");
--                if (!fix_uds_filename(r, url)) {
--                     return HTTP_INTERNAL_SERVER_ERROR;
--                }
-             }
-         }
-     }
-@@ -2199,6 +2191,20 @@ PROXY_DECLARE(int) ap_proxy_pre_request(proxy_worker **worker,
-                       "all workers are busy.  Unable to serve %s", *url);
-         access_status = HTTP_SERVICE_UNAVAILABLE;
-     }
-+
-+    if (access_status == OK && r->proxyreq == PROXYREQ_REVERSE) {
-+        int rc = ap_proxy_fixup_uds_filename(r);
-+        if (ap_is_HTTP_ERROR(rc)) {
-+            return rc;
-+        }
-+        /* If the URL has changed in r->filename, take everything after
-+         * the "proxy:" prefix.
-+         */
-+        if (rc == OK) {
-+            *url = apr_pstrdup(r->pool, r->filename + 6);
-+        }
-+    }
-+
-     return access_status;
- }
- 

SOURCES/httpd-2.4.37-CVE-2024-38474+.patch

@@ -1,439 +0,0 @@
-diff --git a/docs/manual/mod/mod_rewrite.html.en b/docs/manual/mod/mod_rewrite.html.en
-index 2b8ed35..b7f1c31 100644
---- a/docs/manual/mod/mod_rewrite.html.en
-+++ b/docs/manual/mod/mod_rewrite.html.en
-@@ -1403,6 +1403,16 @@ cannot use <code>$N</code> in the substitution string!
-         <td>Force the <a class="glossarylink" href="../glossary.html#mime-type" title="see glossary">MIME-type</a> of the target file
-         to be the specified type. <em><a href="../rewrite/flags.html#flag_t">details ...</a></em></td>
-     </tr>
-+<tr>
-+        <td>UnsafeAllow3F</td>
-+        <td>Allows substitutions from URL's that may be unsafe.
-+        <em><a href="../rewrite/flags.html#flag_unsafe_allow_3f">details ...</a></em></td>
-+    </tr>
-+<tr>
-+        <td>UnsafePrefixStat</td>
-+        <td>Allows potentially unsafe substitutions from a leading variable or backreference to a filesystem path.
-+        <em><a href="../rewrite/flags.html#flag_unsafe_prefix_stat">details ...</a></em></td>
-+    </tr>
- </table>
- 
- <div class="note"><h3>Home directory expansion</h3>
-diff --git a/docs/manual/rewrite/flags.html.en b/docs/manual/rewrite/flags.html.en
-index 734809a..30d549d 100644
---- a/docs/manual/rewrite/flags.html.en
-+++ b/docs/manual/rewrite/flags.html.en
-@@ -768,6 +768,30 @@ re-processing (including subsequent rounds of mod_rewrite processing).
- The <code>L</code> flag can be useful in this context to end the
- <em>current</em> round of mod_rewrite processing.</p>
- 
-+</div>
-+
-+<div class="section">
-+<h2><a name="flag_unsafe_allow_3f" id="flag_unsafe_allow_3f">UnsafeAllow3F</a></h2>
-+
-+<p>
-+Setting this flag is required to allow a rewrite to continue If the
-+HTTP request being written has an encoded question mark, '%3f', and the
-+rewritten result has a '?' in the substiution.  This protects from a malicious
-+URL taking advantage of a capture and re-substitution of the encoded
-+question mark.</p>
-+
-+</div>
-+<div class="section">
-+<h2><a name="flag_unsafe_prefix_status" id="flag_unsafe_prefix_status">UnsafePrefixStat</a></h2>
-+
-+<p>
-+Setting this flag is required in server-scoped substitutions
-+start with a variable or backreference and resolve to a filesystem path.
-+These substitutions are not prefixed with the document root.
-+This protects from a malicious URL causing the expanded substitution to
-+map to an unexpected filesystem location.
-+</p>
-+
- </div></div>
- <div class="bottomlang">
- <p><span>Available Languages: </span><a href="../en/rewrite/flags.html" title="English">&nbsp;en&nbsp;</a> |
-diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c
-index b71c67c..797f093 100644
---- a/modules/mappers/mod_rewrite.c
-+++ b/modules/mappers/mod_rewrite.c
-@@ -172,6 +172,8 @@ static const char* really_last_key = "rewrite_really_last";
- #define RULEFLAG_QSLAST             (1<<19)
- #define RULEFLAG_QSNONE             (1<<20) /* programattic only */
- #define RULEFLAG_ESCAPECTLS         (1<<21)
-+#define RULEFLAG_UNSAFE_PREFIX_STAT (1<<22)
-+#define RULEFLAG_UNSAFE_ALLOW3F     (1<<23)
- 
- /* return code of the rewrite rule
-  * the result may be escaped - or not
-@@ -179,7 +181,7 @@ static const char* really_last_key = "rewrite_really_last";
- #define ACTION_NORMAL               (1<<0)
- #define ACTION_NOESCAPE             (1<<1)
- #define ACTION_STATUS               (1<<2)
--
-+#define ACTION_STATUS_SET           (1<<3)
- 
- #define MAPTYPE_TXT                 (1<<0)
- #define MAPTYPE_DBM                 (1<<1)
-@@ -203,6 +205,7 @@ static const char* really_last_key = "rewrite_really_last";
- #define OPTION_IGNORE_INHERIT       (1<<8)
- #define OPTION_IGNORE_CONTEXT_INFO  (1<<9)
- #define OPTION_LEGACY_PREFIX_DOCROOT (1<<10)
-+#define OPTION_UNSAFE_PREFIX_STAT   (1<<12)
- 
- #ifndef RAND_MAX
- #define RAND_MAX 32767
-@@ -296,6 +299,14 @@ typedef enum {
-     CONDPAT_AP_EXPR
- } pattern_type;
- 
-+typedef enum {
-+  RULE_RC_NOMATCH = 0,      /* the rule didn't match                        */
-+  RULE_RC_MATCH = 1,        /* a matching rule w/ substitution              */
-+  RULE_RC_NOSUB = 2,        /* a matching rule w/ no substitution           */
-+  RULE_RC_STATUS_SET = 3    /* a matching rule that has set an HTTP error
-+                               to be returned in r->status */
-+} rule_return_type;
-+
- typedef struct {
-     char           *input;   /* Input string of RewriteCond   */
-     char           *pattern; /* the RegExp pattern string     */
-@@ -927,10 +938,15 @@ static void fully_qualify_uri(request_rec *r)
-     return;
- }
- 
-+static int startsWith(request_rec *r, const char *haystack, const char *needle) {
-+    int rc = (ap_strstr_c(haystack, needle) == haystack);
-+    rewritelog((r, 5, NULL, "prefix_stat startsWith(%s, %s) %d", haystack, needle, rc));
-+    return rc;
-+}
- /*
-- * stat() only the first segment of a path
-+ * stat() only the first segment of a path, and only if it matches the output of the last matching rule
-  */
--static int prefix_stat(const char *path, apr_pool_t *pool)
-+static int prefix_stat(request_rec *r, const char *path, apr_pool_t *pool, rewriterule_entry *lastsub)
- {
-     const char *curpath = path;
-     const char *root;
-@@ -964,10 +980,36 @@ static int prefix_stat(const char *path, apr_pool_t *pool)
-         apr_finfo_t sb;
- 
-         if (apr_stat(&sb, statpath, APR_FINFO_MIN, pool) == APR_SUCCESS) {
--            return 1;
-+            if (!lastsub) {
-+                rewritelog((r, 3, NULL, "prefix_stat no lastsub subst prefix %s", statpath));
-+                return 1;
-+            }
-+
-+            rewritelog((r, 3, NULL, "prefix_stat compare statpath %s and lastsub output %s STATOK %d ",
-+                    statpath, lastsub->output, lastsub->flags & RULEFLAG_UNSAFE_PREFIX_STAT));
-+            if (lastsub->flags & RULEFLAG_UNSAFE_PREFIX_STAT) {
-+                return 1;
-+            }
-+            else {
-+                const char *docroot = ap_document_root(r);
-+                const char *context_docroot = ap_context_document_root(r);
-+                /*
-+                 * As an example, path (r->filename) is /var/foo/bar/baz.html
-+                 * even if the flag is not set,  we can accept a rule that
-+                 * began with a literal /var (stapath), or if the entire path
-+                 * starts with the docroot or context document root
-+                 */
-+                if (startsWith(r, lastsub->output, statpath) ||
-+                        startsWith(r, path, docroot) ||
-+                        ((docroot != context_docroot) &&
-+                          startsWith(r, path, context_docroot))) {
-+                    return 1;
-+                }
-+            }
-         }
-     }
- 
-+    /* prefix will be added */
-     return 0;
- }
- 
-@@ -3046,6 +3088,9 @@ static const char *cmd_rewriteoptions(cmd_parms *cmd,
-         else if (!strcasecmp(w, "legacyprefixdocroot")) {
-             options |= OPTION_LEGACY_PREFIX_DOCROOT;
-         }
-+        else if (!strcasecmp(w, "UnsafePrefixStat")) {
-+            options |= OPTION_UNSAFE_PREFIX_STAT;
-+        }
-         else {
-             return apr_pstrcat(cmd->pool, "RewriteOptions: unknown option '",
-                                w, "'", NULL);
-@@ -3752,6 +3797,18 @@ static const char *cmd_rewriterule_setflag(apr_pool_t *p, void *_cfg,
-             ++error;
-         }
-         break;
-+    case 'u':
-+    case 'U':
-+        if (!strcasecmp(key, "nsafePrefixStat")){
-+            cfg->flags |= (RULEFLAG_UNSAFE_PREFIX_STAT);
-+        }
-+        else if(!strcasecmp(key, "nsafeAllow3F")) {
-+            cfg->flags |= RULEFLAG_UNSAFE_ALLOW3F;
-+        }
-+        else {
-+            ++error;
-+        }
-+        break;
-     default:
-         ++error;
-         break;
-@@ -4102,7 +4159,8 @@ static APR_INLINE void force_type_handler(rewriterule_entry *p,
- /*
-  * Apply a single RewriteRule
-  */
--static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
-+static rule_return_type apply_rewrite_rule(rewriterule_entry *p,
-+                                           rewrite_ctx *ctx)
- {
-     ap_regmatch_t regmatch[AP_MAX_REG_MATCH];
-     apr_array_header_t *rewriteconds;
-@@ -4153,7 +4211,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
-     rc = !ap_regexec(p->regexp, ctx->uri, AP_MAX_REG_MATCH, regmatch, 0);
-     if (! (( rc && !(p->flags & RULEFLAG_NOTMATCH)) ||
-            (!rc &&  (p->flags & RULEFLAG_NOTMATCH))   ) ) {
--        return 0;
-+        return RULE_RC_NOMATCH;
-     }
- 
-     /* It matched, wow! Now it's time to prepare the context structure for
-@@ -4204,7 +4262,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
-             }
-         }
-         else if (!rc) {
--            return 0;
-+            return RULE_RC_NOMATCH;
-         }
- 
-         /* If some HTTP header was involved in the condition, remember it
-@@ -4224,6 +4282,15 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
-         newuri = do_expand(p->output, ctx, p);
-         rewritelog((r, 2, ctx->perdir, "rewrite '%s' -> '%s'", ctx->uri,
-                     newuri));
-+        if (!(p->flags & RULEFLAG_UNSAFE_ALLOW3F) &&
-+            ap_strcasestr(r->unparsed_uri, "%3f") &&
-+            ap_strchr_c(newuri, '?')) {
-+            ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO()
-+                    "Unsafe URL with %%3f URL rewritten without "
-+                    "UnsafeAllow3F");
-+            r->status = HTTP_FORBIDDEN;
-+            return RULE_RC_STATUS_SET;
-+        }
-     }
- 
-     /* expand [E=var:val] and [CO=<cookie>] */
-@@ -4241,7 +4308,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
-             r->status = p->forced_responsecode;
-         }
- 
--        return 2;
-+        return RULE_RC_NOSUB;
-     }
- 
-     /* Now adjust API's knowledge about r->filename and r->args */
-@@ -4293,7 +4360,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
-                     r->filename));
- 
-         r->filename = apr_pstrcat(r->pool, "proxy:", r->filename, NULL);
--        return 1;
-+        return RULE_RC_MATCH;
-     }
- 
-     /* If this rule is explicitly forced for HTTP redirection
-@@ -4308,7 +4375,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
-                     r->filename));
- 
-         r->status = p->forced_responsecode;
--        return 1;
-+        return RULE_RC_MATCH;
-     }
- 
-     /* Special Rewriting Feature: Self-Reduction
-@@ -4330,7 +4397,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
-                     "with %s", p->forced_responsecode, r->filename));
- 
-         r->status = p->forced_responsecode;
--        return 1;
-+        return RULE_RC_MATCH;
-     }
- 
-     /* Finally remember the forced mime-type */
-@@ -4339,7 +4406,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
-     /* Puuhhhhhhhh... WHAT COMPLICATED STUFF ;_)
-      * But now we're done for this particular rule.
-      */
--    return 1;
-+    return RULE_RC_MATCH;
- }
- 
- /*
-@@ -4347,13 +4414,13 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
-  * i.e. a list of rewrite rules
-  */
- static int apply_rewrite_list(request_rec *r, apr_array_header_t *rewriterules,
--                              char *perdir)
-+                              char *perdir, rewriterule_entry **lastsub)
- {
-     rewriterule_entry *entries;
-     rewriterule_entry *p;
-     int i;
-     int changed;
--    int rc;
-+    rule_return_type rc;
-     int s;
-     rewrite_ctx *ctx;
-     int round = 1;
-@@ -4361,6 +4428,7 @@ static int apply_rewrite_list(request_rec *r, apr_array_header_t *rewriterules,
-     ctx = apr_palloc(r->pool, sizeof(*ctx));
-     ctx->perdir = perdir;
-     ctx->r = r;
-+    *lastsub = NULL;
- 
-     /*
-      *  Iterate over all existing rules
-@@ -4388,7 +4456,12 @@ static int apply_rewrite_list(request_rec *r, apr_array_header_t *rewriterules,
-         ctx->vary = NULL;
-         rc = apply_rewrite_rule(p, ctx);
- 
--        if (rc) {
-+        if (rc != RULE_RC_NOMATCH) {
-+
-+            if (!(p->flags & RULEFLAG_NOSUB)) {
-+                rewritelog((r, 2, perdir, "setting lastsub to rule with output %s", p->output));
-+                *lastsub = p;
-+            }
- 
-             /* Catch looping rules with pathinfo growing unbounded */
-             if ( strlen( r->filename ) > 2*r->server->limit_req_line ) {
-@@ -4408,6 +4481,12 @@ static int apply_rewrite_list(request_rec *r, apr_array_header_t *rewriterules,
-                 apr_table_merge(r->headers_out, "Vary", ctx->vary);
-             }
- 
-+
-+            /* Error while evaluating rule, r->status set */
-+            if (RULE_RC_STATUS_SET == rc) {
-+                return ACTION_STATUS_SET;
-+            }
-+
-             /*
-              * The rule sets the response code (implies match-only)
-              */
-@@ -4418,7 +4497,7 @@ static int apply_rewrite_list(request_rec *r, apr_array_header_t *rewriterules,
-             /*
-              * Indicate a change if this was not a match-only rule.
-              */
--            if (rc != 2) {
-+            if (rc != RULE_RC_NOSUB) {
-                 changed = ((p->flags & RULEFLAG_NOESCAPE)
-                            ? ACTION_NOESCAPE : ACTION_NORMAL);
-             }
-@@ -4607,6 +4686,7 @@ static int hook_uri2file(request_rec *r)
-     int rulestatus;
-     void *skipdata;
-     const char *oargs;
-+    rewriterule_entry *lastsub = NULL;
- 
-     /*
-      *  retrieve the config structures
-@@ -4718,7 +4798,7 @@ static int hook_uri2file(request_rec *r)
-         /*
-          *  now apply the rules ...
-          */
--        rulestatus = apply_rewrite_list(r, conf->rewriterules, NULL);
-+        rulestatus = apply_rewrite_list(r, conf->rewriterules, NULL, &lastsub);
-         apr_table_setn(r->notes, "mod_rewrite_rewritten",
-                        apr_psprintf(r->pool,"%d",rulestatus));
-     }
-@@ -4756,6 +4836,9 @@ static int hook_uri2file(request_rec *r)
-             r->status = HTTP_OK;
-             return n;
-         }
-+        else if (ACTION_STATUS_SET == rulestatus) {
-+            return r->status;
-+        }
- 
-         if (to_proxyreq) {
-             /* it should be go on as an internal proxy request */
-@@ -4875,23 +4958,29 @@ static int hook_uri2file(request_rec *r)
-                 return HTTP_BAD_REQUEST;
-             }
- 
--            /* if there is no valid prefix, we call
--             * the translator from the core and
--             * prefix the filename with document_root
-+            /* We have r->filename as a path in a server-context rewrite without
-+             * the PT flag. The historical behavior is to treat it as a verbatim
-+             * filesystem path iff the first component of the path exists and is
-+             * readable by httpd. Otherwise, it is interpreted as DocumentRoot
-+             * relative.
-              *
-              * NOTICE:
-              * We cannot leave out the prefix_stat because
--             * - when we always prefix with document_root
--             *   then no absolute path can be created, e.g. via
--             *   emulating a ScriptAlias directive, etc.
--             * - when we always NOT prefix with document_root
-+             * - If we always prefix with document_root
-+             *   then no absolute path can could ever be used in
-+             *   a substitution. e.g. emulating an Alias.
-+             * - If we never prefix with document_root
-              *   then the files under document_root have to
-              *   be references directly and document_root
-              *   gets never used and will be a dummy parameter -
--             *   this is also bad
-+             *   this is also bad.
-+             *   - Later addition: This part is questionable.
-+             *     If we had never prefixed, users would just 
-+             *     need %{DOCUMENT_ROOT} in substitutions or the 
-+             *     [PT] flag.
-              *
-              * BUT:
--             * Under real Unix systems this is no problem,
-+             * Under real Unix systems this is no perf problem,
-              * because we only do stat() on the first directory
-              * and this gets cached by the kernel for along time!
-              */
-@@ -4900,7 +4989,9 @@ static int hook_uri2file(request_rec *r)
-                 uri_reduced = apr_table_get(r->notes, "mod_rewrite_uri_reduced");
-             }
- 
--            if (!prefix_stat(r->filename, r->pool) || uri_reduced != NULL) {
-+            if (!prefix_stat(r, r->filename, r->pool,
-+                             conf->options & OPTION_UNSAFE_PREFIX_STAT ? NULL : lastsub)
-+                || uri_reduced != NULL) {
-                 int res;
-                 char *tmp = r->uri;
- 
-@@ -4945,6 +5036,7 @@ static int hook_fixup(request_rec *r)
-     char *ofilename, *oargs;
-     int is_proxyreq;
-     void *skipdata;
-+    rewriterule_entry *lastsub;
- 
-     dconf = (rewrite_perdir_conf *)ap_get_module_config(r->per_dir_config,
-                                                         &rewrite_module);
-@@ -5029,7 +5121,7 @@ static int hook_fixup(request_rec *r)
-     /*
-      *  now apply the rules ...
-      */
--    rulestatus = apply_rewrite_list(r, dconf->rewriterules, dconf->directory);
-+    rulestatus = apply_rewrite_list(r, dconf->rewriterules, dconf->directory, &lastsub);
-     if (rulestatus) {
-         unsigned skip_absolute = is_absolute_uri(r->filename, NULL);
-         int to_proxyreq = 0;
-@@ -5058,6 +5150,9 @@ static int hook_fixup(request_rec *r)
-             r->status = HTTP_OK;
-             return n;
-         }
-+        else if (ACTION_STATUS_SET == rulestatus) {
-+            return r->status;
-+        }
- 
-         if (to_proxyreq) {
-             /* it should go on as an internal proxy request */

SOURCES/httpd-2.4.37-CVE-2024-38476.patch

@@ -1,301 +0,0 @@
-
--- backported bnotes needed by this CVE fix from https://svn.apache.org/viewvc?view=revision&revision=1887384
--- modified it a little bit so it actually doesn't store bnotes into req structure to not brake compatibility
--- but it stores AP_REQUEST_TRUSTED_CT info into r->notes
-
-diff --git a/include/http_protocol.h b/include/http_protocol.h
-index 8ed77ac..81949ca 100644
---- a/include/http_protocol.h
-+++ b/include/http_protocol.h
-@@ -402,6 +402,17 @@ AP_DECLARE(void) ap_clear_method_list(ap_method_list_t *l);
-  */
- AP_DECLARE(void) ap_set_content_type(request_rec *r, const char *ct);
- 
-+/**
-+ * Set the content type for this request (r->content_type).
-+ * @param r The current request
-+ * @param ct The new content type
-+ * @param trusted If non-zero, The content-type should come from a
-+ *        trusted source such as server configuration rather
-+ *        than application output.
-+ * for the AddOutputFilterByType directive to work correctly.
-+ */
-+AP_DECLARE(void) ap_set_content_type_ex(request_rec *r, const char *ct, int trusted);
-+
- /**
-  * Set the Accept-Ranges header for this response
-  * @param r The current request
-diff --git a/include/httpd.h b/include/httpd.h
-index 99f7f04..d8746c1 100644
---- a/include/httpd.h
-+++ b/include/httpd.h
-@@ -645,6 +645,7 @@ struct ap_method_list_t {
-     /** the array used for extension methods */
-     apr_array_header_t *method_list;
- };
-+/** @} */
- 
- /**
-  * @defgroup module_magic Module Magic mime types
-@@ -715,6 +716,31 @@ struct ap_method_list_t {
- 
- /** @} // values_request_rec_used_path_info */
- 
-+#define AP_REQUEST_TRUSTED_CT  "rh-bnotes-trusted-ct"
-+
-+/**
-+ * This is a convenience macro to ease with getting specific request
-+ * binary notes.
-+ */
-+#define AP_REQUEST_GET_BNOTE(r, mask) (apr_table_get(r->notes, mask) ? 1 : 0)
-+
-+/**
-+ * This is a convenience macro to ease with setting specific request
-+ * binary notes.
-+ */
-+#define AP_REQUEST_SET_BNOTE(r, mask, val) do { \
-+    if (val)                                    \
-+        apr_table_setn(r->notes, mask, "1");    \
-+    else                                        \
-+        apr_table_unset(r->notes, mask);        \
-+} while (0)
-+
-+/**
-+ * Returns true if the content-type field is from a trusted source
-+ */
-+#define AP_REQUEST_IS_TRUSTED_CT(r) \
-+    (!!AP_REQUEST_GET_BNOTE((r), AP_REQUEST_TRUSTED_CT))
-+/** @} */
- 
- /*
-  * Things which may vary per file-lookup WITHIN a request ---
-diff --git a/modules/http/http_protocol.c b/modules/http/http_protocol.c
-index df862e0..d003aea 100644
---- a/modules/http/http_protocol.c
-+++ b/modules/http/http_protocol.c
-@@ -1077,8 +1077,14 @@ AP_DECLARE(void) ap_set_content_type(request_rec *r, const char *ct)
-     }
-     else if (!r->content_type || strcmp(r->content_type, ct)) {
-         r->content_type = ct;
-+        AP_REQUEST_SET_BNOTE(r, AP_REQUEST_TRUSTED_CT, 0);
-     }
- }
-+AP_DECLARE(void) ap_set_content_type_ex(request_rec *r, const char *ct, int trusted)
-+{
-+    ap_set_content_type(r, ct);
-+    AP_REQUEST_SET_BNOTE(r, AP_REQUEST_TRUSTED_CT, trusted ? AP_REQUEST_TRUSTED_CT : 0);
-+}
- 
- AP_DECLARE(void) ap_set_accept_ranges(request_rec *r)
- {
-diff --git a/modules/http/mod_mime.c b/modules/http/mod_mime.c
-index 28c53be..4cd1c48 100644
---- a/modules/http/mod_mime.c
-+++ b/modules/http/mod_mime.c
-@@ -759,7 +759,7 @@ static int find_ct(request_rec *r)
-     int found_metadata = 0;
- 
-     if (r->finfo.filetype == APR_DIR) {
--        ap_set_content_type(r, DIR_MAGIC_TYPE);
-+        ap_set_content_type_ex(r, DIR_MAGIC_TYPE, 1);
-         return OK;
-     }
- 
-@@ -837,7 +837,7 @@ static int find_ct(request_rec *r)
-         if (exinfo == NULL || !exinfo->forced_type) {
-             if ((type = apr_hash_get(mime_type_extensions, ext,
-                                      APR_HASH_KEY_STRING)) != NULL) {
--                ap_set_content_type(r, (char*) type);
-+                ap_set_content_type_ex(r, (char*) type, 1);
-                 found = 1;
-             }
-         }
-@@ -846,7 +846,7 @@ static int find_ct(request_rec *r)
- 
-             /* empty string is treated as special case for RemoveType */
-             if (exinfo->forced_type && *exinfo->forced_type) {
--                ap_set_content_type(r, exinfo->forced_type);
-+                ap_set_content_type_ex(r, exinfo->forced_type, 1);
-                 found = 1;
-             }
- 
-@@ -951,33 +951,33 @@ static int find_ct(request_rec *r)
-             memcpy(tmp, ctp->subtype, ctp->subtype_len);
-             tmp += ctp->subtype_len;
-             *tmp = 0;
--            ap_set_content_type(r, base_content_type);
-+            ap_set_content_type_ex(r, base_content_type, AP_REQUEST_IS_TRUSTED_CT(r));
-             while (pp != NULL) {
-                 if (charset && !strcmp(pp->attr, "charset")) {
-                     if (!override) {
--                        ap_set_content_type(r,
-+                        ap_set_content_type_ex(r,
-                                             apr_pstrcat(r->pool,
-                                                         r->content_type,
-                                                         "; charset=",
-                                                         charset,
--                                                        NULL));
-+                                                        NULL), AP_REQUEST_IS_TRUSTED_CT(r));
-                         override = 1;
-                     }
-                 }
-                 else {
--                    ap_set_content_type(r,
-+                    ap_set_content_type_ex(r,
-                                         apr_pstrcat(r->pool,
-                                                     r->content_type,
-                                                     "; ", pp->attr,
-                                                     "=", pp->val,
--                                                    NULL));
-+                                                    NULL), AP_REQUEST_IS_TRUSTED_CT(r));
-                 }
-                 pp = pp->next;
-             }
-             if (charset && !override) {
--                ap_set_content_type(r, apr_pstrcat(r->pool, r->content_type,
-+                ap_set_content_type_ex(r, apr_pstrcat(r->pool, r->content_type,
-                                                    "; charset=", charset,
--                                                   NULL));
-+                                                   NULL), AP_REQUEST_IS_TRUSTED_CT(r));
-             }
-         }
-     }
-diff --git a/modules/mappers/mod_actions.c b/modules/mappers/mod_actions.c
-index ac9c3b7..5e398b5 100644
---- a/modules/mappers/mod_actions.c
-+++ b/modules/mappers/mod_actions.c
-@@ -182,8 +182,10 @@ static int action_handler(request_rec *r)
-         return DECLINED;
- 
-     /* Second, check for actions (which override the method scripts) */
--    action = r->handler ? r->handler :
--        ap_field_noparam(r->pool, r->content_type);
-+    action = r->handler;
-+    if (!action && AP_REQUEST_IS_TRUSTED_CT(r)) {
-+        action = ap_field_noparam(r->pool, r->content_type);
-+    }
- 
-     if (action && (t = apr_table_get(conf->action_types, action))) {
-         int virtual = (*t++ == '0' ? 0 : 1);
-diff --git a/modules/mappers/mod_negotiation.c b/modules/mappers/mod_negotiation.c
-index da68353..e91ba5f 100644
---- a/modules/mappers/mod_negotiation.c
-+++ b/modules/mappers/mod_negotiation.c
-@@ -1169,7 +1169,7 @@ static int read_types_multi(negotiation_state *neg)
-          * might be doing.
-          */
-         if (sub_req->handler && !sub_req->content_type) {
--            ap_set_content_type(sub_req, CGI_MAGIC_TYPE);
-+            ap_set_content_type_ex(sub_req, CGI_MAGIC_TYPE, 1);
-         }
- 
-         /*
-@@ -3008,14 +3008,14 @@ static int handle_map_file(request_rec *r)
-         /* set MIME type and charset as negotiated */
-         if (best->mime_type && *best->mime_type) {
-             if (best->content_charset && *best->content_charset) {
--                ap_set_content_type(r, apr_pstrcat(r->pool,
-+                ap_set_content_type_ex(r, apr_pstrcat(r->pool,
-                                                    best->mime_type,
-                                                    "; charset=",
-                                                    best->content_charset,
--                                                   NULL));
-+                                                   NULL), 1);
-             }
-             else {
--                ap_set_content_type(r, apr_pstrdup(r->pool, best->mime_type));
-+                ap_set_content_type_ex(r, apr_pstrdup(r->pool, best->mime_type), 1);
-             }
-         }
- 
-diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c
-index a25c7ae..2b70d66 100644
---- a/modules/mappers/mod_rewrite.c
-+++ b/modules/mappers/mod_rewrite.c
-@@ -5477,7 +5477,7 @@ static int hook_mimetype(request_rec *r)
-         rewritelog((r, 1, NULL, "force filename %s to have MIME-type '%s'",
-                     r->filename, t));
- 
--        ap_set_content_type(r, t);
-+        ap_set_content_type_ex(r, t, 1);
-     }
- 
-     /* handler */
-diff --git a/modules/metadata/mod_headers.c b/modules/metadata/mod_headers.c
-index 1ea970d..55ab281 100644
---- a/modules/metadata/mod_headers.c
-+++ b/modules/metadata/mod_headers.c
-@@ -792,14 +792,14 @@ static int do_headers_fixup(request_rec *r, apr_table_t *headers,
-             break;
-         case hdr_set:
-             if (!strcasecmp(hdr->header, "Content-Type")) {
--                 ap_set_content_type(r, process_tags(hdr, r));
-+                 ap_set_content_type_ex(r, process_tags(hdr, r), 1);
-             }
-             apr_table_setn(headers, hdr->header, process_tags(hdr, r));
-             break;
-         case hdr_setifempty:
-             if (NULL == apr_table_get(headers, hdr->header)) {
-                 if (!strcasecmp(hdr->header, "Content-Type")) {
--                    ap_set_content_type(r, process_tags(hdr, r));
-+                    ap_set_content_type_ex(r, process_tags(hdr, r), 1);
-                 }
-                 apr_table_setn(headers, hdr->header, process_tags(hdr, r));
-             }
-@@ -818,7 +818,7 @@ static int do_headers_fixup(request_rec *r, apr_table_t *headers,
-                 const char *repl = process_regexp(hdr, r->content_type, r);
-                 if (repl == NULL)
-                     return 0;
--                ap_set_content_type(r, repl);
-+                ap_set_content_type_ex(r, repl, 1);
-             }
-             if (apr_table_get(headers, hdr->header)) {
-                 edit_do ed;
-diff --git a/modules/metadata/mod_mime_magic.c b/modules/metadata/mod_mime_magic.c
-index c12529a..fe30f27 100644
---- a/modules/metadata/mod_mime_magic.c
-+++ b/modules/metadata/mod_mime_magic.c
-@@ -789,7 +789,7 @@ static int magic_rsl_to_request(request_rec *r)
-     /* XXX: this could be done at config time I'm sure... but I'm
-      * confused by all this magic_rsl stuff. -djg */
-     ap_content_type_tolower(tmp);
--    ap_set_content_type(r, tmp);
-+    ap_set_content_type_ex(r, tmp, 1);
- 
-     if (state == rsl_encoding) {
-         tmp = rsl_strdup(r, encoding_frag,
-@@ -2326,7 +2326,7 @@ static int revision_suffix(request_rec *r)
- 
-     /* extract content type/encoding/language from sub-request */
-     if (sub->content_type) {
--        ap_set_content_type(r, apr_pstrdup(r->pool, sub->content_type));
-+        ap_set_content_type_ex(r, apr_pstrdup(r->pool, sub->content_type), 1);
- #if MIME_MAGIC_DEBUG
-         ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(01557)
-                     MODNAME ": subrequest %s got %s",
-diff --git a/server/config.c b/server/config.c
-index f815b22..fc4d76b 100644
---- a/server/config.c
-+++ b/server/config.c
-@@ -419,7 +419,7 @@ AP_CORE_DECLARE(int) ap_invoke_handler(request_rec *r)
-     }
- 
-     if (!r->handler) {
--        if (r->content_type) {
-+        if (r->content_type && AP_REQUEST_IS_TRUSTED_CT(r)) {
-             handler = r->content_type;
-             if ((p=ap_strchr_c(handler, ';')) != NULL) {
-                 char *new_handler = (char *)apr_pmemdup(r->pool, handler,
-diff --git a/server/core.c b/server/core.c
-index 8575aae..82706cf 100644
---- a/server/core.c
-+++ b/server/core.c
-@@ -4722,7 +4722,7 @@ static int core_override_type(request_rec *r)
-     /* Check for overrides with ForceType / SetHandler
-      */
-     if (conf->mime_type && strcmp(conf->mime_type, "none"))
--        ap_set_content_type(r, (char*) conf->mime_type);
-+        ap_set_content_type_ex(r, (char*) conf->mime_type, 1);
- 
-     if (conf->expr_handler) { 
-         const char *err;

SOURCES/httpd-2.4.37-CVE-2024-38477.patch

@@ -1,29 +0,0 @@
-diff --git a/modules/proxy/proxy_util.c b/modules/proxy/proxy_util.c
-index 6244e74..f5c3283 100644
---- a/modules/proxy/proxy_util.c
-+++ b/modules/proxy/proxy_util.c
-@@ -2406,6 +2406,13 @@ ap_proxy_determine_connection(apr_pool_t *p, request_rec *r,
-                              apr_pstrcat(p,"URI cannot be parsed: ", *url,
-                                          NULL));
-     }
-+
-+    if (!uri->hostname) {
-+        return ap_proxyerror(r, HTTP_BAD_REQUEST,
-+                             apr_pstrcat(p,"URI has no hostname: ", *url,
-+                                         NULL));
-+    }
-+
-     if (!uri->port) {
-         uri->port = ap_proxy_port_of_scheme(uri->scheme);
-     }
-@@ -3727,6 +3734,10 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbrgd(apr_pool_t *p,
-      * way. No telling which legacy backend is relying no this.
-      */
-     if (dconf->preserve_host == 0) {
-+        if (!uri->hostname) {
-+            rc = HTTP_BAD_REQUEST;
-+            goto cleanup;
-+        }
-         if (ap_strchr_c(uri->hostname, ':')) { /* if literal IPv6 address */
-             if (uri->port_str && uri->port != DEFAULT_HTTP_PORT) {
-                 buf = apr_pstrcat(p, "Host: [", uri->hostname, "]:",

SOURCES/httpd-2.4.37-CVE-2024-39573.patch

@@ -1,56 +0,0 @@
-diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c
-index 797f093..114b126 100644
---- a/modules/mappers/mod_rewrite.c
-+++ b/modules/mappers/mod_rewrite.c
-@@ -4311,6 +4311,32 @@ static rule_return_type apply_rewrite_rule(rewriterule_entry *p,
-         return RULE_RC_NOSUB;
-     }
- 
-+    /* Add the previously stripped per-directory location prefix, unless
-+     * (1) it's an absolute URL path and
-+     * (2) it's a full qualified URL
-+     */
-+    if (!is_proxyreq && *newuri != '/' && !is_absolute_uri(newuri, NULL)) {
-+        if (ctx->perdir) {
-+            rewritelog((r, 3, ctx->perdir, "add per-dir prefix: %s -> %s%s",
-+                       newuri, ctx->perdir, newuri));
-+
-+            newuri = apr_pstrcat(r->pool, ctx->perdir, newuri, NULL);
-+        }
-+        else if (!(p->flags & (RULEFLAG_PROXY | RULEFLAG_FORCEREDIRECT))) {
-+            /* Not an absolute URI-path and the scheme (if any) is unknown,
-+             * and it won't be passed to fully_qualify_uri() below either,
-+             * so add an implicit '/' prefix. This avoids potentially a common
-+             * rule like "RewriteRule ^/some/path(.*) $1" that is given a path
-+             * like "/some/pathscheme:..." to produce the fully qualified URL
-+             * "scheme:..." which could be misinterpreted later.
-+             */
-+            rewritelog((r, 3, ctx->perdir, "add root prefix: %s -> /%s",
-+                       newuri, newuri));
-+
-+            newuri = apr_pstrcat(r->pool, "/", newuri, NULL);
-+        }
-+    }
-+
-     /* Now adjust API's knowledge about r->filename and r->args */
-     r->filename = newuri;
- 
-@@ -4320,18 +4346,6 @@ static rule_return_type apply_rewrite_rule(rewriterule_entry *p,
- 
-     splitout_queryargs(r, p->flags);
- 
--    /* Add the previously stripped per-directory location prefix, unless
--     * (1) it's an absolute URL path and
--     * (2) it's a full qualified URL
--     */
--    if (   ctx->perdir && !is_proxyreq && *r->filename != '/'
--        && !is_absolute_uri(r->filename, NULL)) {
--        rewritelog((r, 3, ctx->perdir, "add per-dir prefix: %s -> %s%s",
--                    r->filename, ctx->perdir, r->filename));
--
--        r->filename = apr_pstrcat(r->pool, ctx->perdir, r->filename, NULL);
--    }
--
-     /* If this rule is forced for proxy throughput
-      * (`RewriteRule ... ... [P]') then emulate mod_proxy's
-      * URL-to-filename handler to be sure mod_proxy is triggered

SOURCES/httpd-2.4.37-CVE-2024-39884+.patch

@@ -1,266 +0,0 @@
-diff --git a/modules/cluster/mod_heartmonitor.c b/modules/cluster/mod_heartmonitor.c
-index 965fef5..6df3bf4 100644
---- a/modules/cluster/mod_heartmonitor.c
-+++ b/modules/cluster/mod_heartmonitor.c
-@@ -782,7 +782,7 @@ static int hm_handler(request_rec *r)
-     hmserver.seen = apr_time_now();
-     hm_update_stat(ctx, &hmserver, r->pool);
- 
--    ap_set_content_type(r, "text/plain");
-+    ap_set_content_type_ex(r, "text/plain", 1);
-     ap_set_content_length(r, 2);
-     ap_rputs("OK", r);
-     ap_rflush(r);
-diff --git a/modules/dav/main/mod_dav.c b/modules/dav/main/mod_dav.c
-index 792b514..28479b9 100644
---- a/modules/dav/main/mod_dav.c
-+++ b/modules/dav/main/mod_dav.c
-@@ -323,7 +323,7 @@ static int dav_error_response(request_rec *r, int status, const char *body)
-     r->status = status;
-     r->status_line = ap_get_status_line(status);
- 
--    ap_set_content_type(r, "text/html; charset=ISO-8859-1");
-+    ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1);
- 
-     /* begin the response now... */
-     ap_rvputs(r,
-@@ -354,7 +354,7 @@ static int dav_error_response_tag(request_rec *r,
- {
-     r->status = err->status;
- 
--    ap_set_content_type(r, DAV_XML_CONTENT_TYPE);
-+    ap_set_content_type_ex(r, DAV_XML_CONTENT_TYPE, 1);
- 
-     ap_rputs(DAV_XML_HEADER DEBUG_CR
-              "<D:error xmlns:D=\"DAV:\"", r);
-@@ -512,7 +512,7 @@ DAV_DECLARE(void) dav_begin_multistatus(apr_bucket_brigade *bb,
- {
-     /* Set the correct status and Content-Type */
-     r->status = status;
--    ap_set_content_type(r, DAV_XML_CONTENT_TYPE);
-+    ap_set_content_type_ex(r, DAV_XML_CONTENT_TYPE, 1);
- 
-     /* Send the headers and actual multistatus response now... */
-     ap_fputs(r->output_filters, bb, DAV_XML_HEADER DEBUG_CR
-@@ -1923,7 +1923,7 @@ static int dav_method_options(request_rec *r)
- 
-     /* send the options response */
-     r->status = HTTP_OK;
--    ap_set_content_type(r, DAV_XML_CONTENT_TYPE);
-+    ap_set_content_type_ex(r, DAV_XML_CONTENT_TYPE, 1);
- 
-     /* send the headers and response body */
-     ap_rputs(DAV_XML_HEADER DEBUG_CR
-@@ -3191,7 +3191,7 @@ static int dav_method_lock(request_rec *r)
-     (*locks_hooks->close_lockdb)(lockdb);
- 
-     r->status = HTTP_OK;
--    ap_set_content_type(r, DAV_XML_CONTENT_TYPE);
-+    ap_set_content_type_ex(r, DAV_XML_CONTENT_TYPE, 1);
- 
-     ap_rputs(DAV_XML_HEADER DEBUG_CR "<D:prop xmlns:D=\"DAV:\">" DEBUG_CR, r);
-     if (lock == NULL)
-diff --git a/modules/examples/mod_example_hooks.c b/modules/examples/mod_example_hooks.c
-index d818dc1..4d79b86 100644
---- a/modules/examples/mod_example_hooks.c
-+++ b/modules/examples/mod_example_hooks.c
-@@ -993,7 +993,7 @@ static int x_handler(request_rec *r)
-      * Set the Content-type header. Note that we do not actually have to send
-      * the headers: this is done by the http core.
-      */
--    ap_set_content_type(r, "text/html");
-+    ap_set_content_type_ex(r, "text/html", 1);
-     /*
-      * If we're only supposed to send header information (HEAD request), we're
-      * already there.
-diff --git a/modules/filters/mod_data.c b/modules/filters/mod_data.c
-index d083d32..489e76c 100644
---- a/modules/filters/mod_data.c
-+++ b/modules/filters/mod_data.c
-@@ -117,7 +117,7 @@ static apr_status_t data_out_filter(ap_filter_t *f, apr_bucket_brigade *bb)
-             }
-         }
- 
--        ap_set_content_type(r, "text/plain");
-+        ap_set_content_type_ex(r, "text/plain", 1);
- 
-     }
- 
-diff --git a/modules/filters/mod_include.c b/modules/filters/mod_include.c
-index a46a944..05f994c 100644
---- a/modules/filters/mod_include.c
-+++ b/modules/filters/mod_include.c
-@@ -3971,7 +3971,7 @@ static int include_fixup(request_rec *r)
-     if (r->handler && (strcmp(r->handler, "server-parsed") == 0))
-     {
-         if (!r->content_type || !*r->content_type) {
--            ap_set_content_type(r, "text/html");
-+            ap_set_content_type_ex(r, "text/html", 1);
-         }
-         r->handler = "default-handler";
-     }
-diff --git a/modules/filters/mod_proxy_html.c b/modules/filters/mod_proxy_html.c
-index ea6bf03..8b619e8 100644
---- a/modules/filters/mod_proxy_html.c
-+++ b/modules/filters/mod_proxy_html.c
-@@ -933,7 +933,7 @@ static apr_status_t proxy_html_filter(ap_filter_t *f, apr_bucket_brigade *bb)
-                         ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, f->r, APLOGNO(01422)
-                                       "No i18n support found.  Install mod_xml2enc if required");
-                     enc = XML_CHAR_ENCODING_NONE;
--                    ap_set_content_type(f->r, "text/html;charset=utf-8");
-+                    ap_set_content_type_ex(f->r, "text/html;charset=utf-8", 1);
-                 }
-                 else {
-                     /* if we wanted a non-default charset_out, insert the
-@@ -949,7 +949,7 @@ static apr_status_t proxy_html_filter(ap_filter_t *f, apr_bucket_brigade *bb)
-                                                         cenc, NULL));
-                     }
-                     else /* Normal case, everything worked, utf-8 output */
--                        ap_set_content_type(f->r, "text/html;charset=utf-8");
-+                        ap_set_content_type_ex(f->r, "text/html;charset=utf-8", 1);
-                 }
- 
-                 ap_fputs(f->next, ctxt->bb, ctxt->cfg->doctype);
-diff --git a/modules/generators/mod_cgi.c b/modules/generators/mod_cgi.c
-index 66cd31c..4650d18 100644
---- a/modules/generators/mod_cgi.c
-+++ b/modules/generators/mod_cgi.c
-@@ -795,7 +795,7 @@ static apr_status_t include_cgi(include_ctx_t *ctx, ap_filter_t *f,
-     /* Force sub_req to be treated as a CGI request, even if ordinary
-      * typing rules would have called it something else.
-      */
--    ap_set_content_type(rr, CGI_MAGIC_TYPE);
-+    ap_set_content_type_ex(rr, CGI_MAGIC_TYPE, 1);
- 
-     /* Run it. */
-     rr_status = ap_run_sub_req(rr);
-diff --git a/modules/generators/mod_cgid.c b/modules/generators/mod_cgid.c
-index 102d2b3..57e119f 100644
---- a/modules/generators/mod_cgid.c
-+++ b/modules/generators/mod_cgid.c
-@@ -1801,7 +1801,7 @@ static apr_status_t include_cgi(include_ctx_t *ctx, ap_filter_t *f,
-     /* Force sub_req to be treated as a CGI request, even if ordinary
-      * typing rules would have called it something else.
-      */
--    ap_set_content_type(rr, CGI_MAGIC_TYPE);
-+    ap_set_content_type_ex(rr, CGI_MAGIC_TYPE, 1);
- 
-     /* Run it. */
-     rr_status = ap_run_sub_req(rr);
-diff --git a/modules/generators/mod_info.c b/modules/generators/mod_info.c
-index e5e63de..67df675 100644
---- a/modules/generators/mod_info.c
-+++ b/modules/generators/mod_info.c
-@@ -777,7 +777,7 @@ static int display_info(request_rec * r)
-         return DECLINED;
-     }
- 
--    ap_set_content_type(r, "text/html; charset=ISO-8859-1");
-+    ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1);
- 
-     ap_rputs(DOCTYPE_XHTML_1_0T
-              "<html xmlns=\"http://www.w3.org/1999/xhtml\">\n"
-diff --git a/modules/generators/mod_status.c b/modules/generators/mod_status.c
-index 5bada07..2cb38c7 100644
---- a/modules/generators/mod_status.c
-+++ b/modules/generators/mod_status.c
-@@ -273,7 +273,7 @@ static int status_handler(request_rec *r)
-     if (r->method_number != M_GET)
-         return DECLINED;
- 
--    ap_set_content_type(r, "text/html; charset=ISO-8859-1");
-+    ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1);
- 
-     /*
-      * Simple table-driven form data set parser that lets you alter the header
-@@ -301,7 +301,7 @@ static int status_handler(request_rec *r)
-                     no_table_report = 1;
-                     break;
-                 case STAT_OPT_AUTO:
--                    ap_set_content_type(r, "text/plain; charset=ISO-8859-1");
-+                    ap_set_content_type_ex(r, "text/plain; charset=ISO-8859-1", 1);
-                     short_report = 1;
-                     break;
-                 }
-diff --git a/modules/http/http_filters.c b/modules/http/http_filters.c
-index 16cb23c..27c44b2 100644
---- a/modules/http/http_filters.c
-+++ b/modules/http/http_filters.c
-@@ -1245,7 +1245,7 @@ AP_DECLARE_NONSTD(int) ap_send_http_trace(request_rec *r)
-         }
-     }
- 
--    ap_set_content_type(r, "message/http");
-+    ap_set_content_type_ex(r, "message/http", 1);
- 
-     /* Now we recreate the request, and echo it back */
- 
-diff --git a/modules/http/http_protocol.c b/modules/http/http_protocol.c
-index 417fee6..d003aea 100644
---- a/modules/http/http_protocol.c
-+++ b/modules/http/http_protocol.c
-@@ -1423,10 +1423,10 @@ AP_DECLARE(void) ap_send_error_response(request_rec *r, int recursive_error)
-             request_conf->suppress_charset = 1; /* avoid adding default
-                                                  * charset later
-                                                  */
--            ap_set_content_type(r, "text/html");
-+            ap_set_content_type_ex(r, "text/html", 1);
-         }
-         else {
--            ap_set_content_type(r, "text/html; charset=iso-8859-1");
-+            ap_set_content_type_ex(r, "text/html; charset=iso-8859-1", 1);
-         }
- 
-         if ((status == HTTP_METHOD_NOT_ALLOWED)
-diff --git a/modules/http/http_request.c b/modules/http/http_request.c
-index e873aab..3521cfb 100644
---- a/modules/http/http_request.c
-+++ b/modules/http/http_request.c
-@@ -709,7 +709,7 @@ AP_DECLARE(void) ap_internal_fast_redirect(request_rec *rr, request_rec *r)
-     r->args = rr->args;
-     r->finfo = rr->finfo;
-     r->handler = rr->handler;
--    ap_set_content_type(r, rr->content_type);
-+    ap_set_content_type_ex(r, rr->content_type, AP_REQUEST_IS_TRUSTED_CT(rr));
-     r->content_encoding = rr->content_encoding;
-     r->content_languages = rr->content_languages;
-     r->per_dir_config = rr->per_dir_config;
-diff --git a/modules/ldap/util_ldap.c b/modules/ldap/util_ldap.c
-index eecb3f7..b71dc98 100644
---- a/modules/ldap/util_ldap.c
-+++ b/modules/ldap/util_ldap.c
-@@ -125,7 +125,7 @@ static int util_ldap_handler(request_rec *r)
-     st = (util_ldap_state_t *) ap_get_module_config(r->server->module_config,
-             &ldap_module);
- 
--    ap_set_content_type(r, "text/html; charset=ISO-8859-1");
-+    ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1);
- 
-     if (r->header_only)
-         return OK;
-diff --git a/modules/mappers/mod_imagemap.c b/modules/mappers/mod_imagemap.c
-index 187a500..3e14933 100644
---- a/modules/mappers/mod_imagemap.c
-+++ b/modules/mappers/mod_imagemap.c
-@@ -475,7 +475,7 @@ static int imap_reply(request_rec *r, const char *redirect)
- 
- static void menu_header(request_rec *r, char *menu)
- {
--    ap_set_content_type(r, "text/html; charset=ISO-8859-1");
-+    ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1);
- 
-     ap_rvputs(r, DOCTYPE_HTML_3_2, "<html><head>\n<title>Menu for ",
-               ap_escape_html(r->pool, r->uri),
-diff --git a/modules/proxy/mod_proxy_balancer.c b/modules/proxy/mod_proxy_balancer.c
-index c599e1a..d5c20af 100644
---- a/modules/proxy/mod_proxy_balancer.c
-+++ b/modules/proxy/mod_proxy_balancer.c
-@@ -1480,7 +1480,7 @@ static int balancer_handler(request_rec *r)
- 
-     if (apr_table_get(params, "xml")) {
-         char date[APR_RFC822_DATE_LEN];
--        ap_set_content_type(r, "text/xml");
-+        ap_set_content_type_ex(r, "text/xml", 1);
-         ap_rputs("<?xml version='1.0' encoding='UTF-8' ?>\n", r);
-         ap_rputs("<httpd:manager xmlns:httpd='http://httpd.apache.org'>\n", r);
-         ap_rputs("  <httpd:balancers>\n", r);

SOURCES/httpd-2.4.37-r1919325.patch

@@ -1,217 +0,0 @@
-diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c
-index 114b126..a25c7ae 100644
---- a/modules/mappers/mod_rewrite.c
-+++ b/modules/mappers/mod_rewrite.c
-@@ -2343,9 +2343,16 @@ static APR_INLINE char *find_char_in_curlies(char *s, int c)
-  * of an earlier expansion to include expansion specifiers that
-  * are interpreted by a later expansion, producing results that
-  * were not intended by the administrator.
-+ *
-+ * unsafe_qmark if not NULL will be set to 1 or 0 if a question mark
-+ * is found respectively in a literal or in a lookup/expansion (whether
-+ * it's the first or last qmark depends on [QSL]). Should be initialized
-+ * to -1 and remains so if no qmark is found.
-  */
--static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry)
-+static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry,
-+                       int *unsafe_qmark)
- {
-+#define EXPAND_SPECIALS "\\$%"
-     result_list *result, *current;
-     result_list sresult[SMALL_EXPANSION];
-     unsigned spc = 0;
-@@ -2353,8 +2360,29 @@ static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry)
-     char *p, *c;
-     apr_pool_t *pool = ctx->r->pool;
- 
--    span = strcspn(input, "\\$%");
-     inputlen = strlen(input);
-+    if (!unsafe_qmark) {
-+        span = strcspn(input, EXPAND_SPECIALS);
-+    }
-+    else {
-+        span = strcspn(input, EXPAND_SPECIALS "?");
-+        if (input[span] == '?') {
-+            /* this qmark is not from an expansion thus safe */
-+            *unsafe_qmark = 0;
-+
-+            /* keep tracking only if interested in the last qmark */
-+            if (entry && (entry->flags & RULEFLAG_QSLAST)) {
-+                do {
-+                    span++;
-+                    span += strcspn(input + span, EXPAND_SPECIALS "?");
-+                } while (input[span] == '?');
-+            }
-+            else {
-+                unsafe_qmark = NULL;
-+                span += strcspn(input + span, EXPAND_SPECIALS);
-+            }
-+        }
-+    }
- 
-     /* fast exit */
-     if (inputlen == span) {
-@@ -2372,6 +2400,8 @@ static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry)
- 
-     /* loop for specials */
-     do {
-+        int expanded = 0;
-+
-         /* prepare next entry */
-         if (current->len) {
-             current->next = (spc < SMALL_EXPANSION)
-@@ -2417,6 +2447,8 @@ static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry)
-                 current->len = span;
-                 current->string = p;
-                 outlen += span;
-+
-+                expanded = 1;
-                 p = endp + 1;
-             }
- 
-@@ -2456,19 +2488,18 @@ static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry)
-                     }
- 
-                     /* reuse of key variable as result */
--                    key = lookup_map(ctx->r, map, do_expand(key, ctx, entry));
--
-+                    key = lookup_map(ctx->r, map, do_expand(key, ctx, entry, NULL));
-                     if (!key && dflt && *dflt) {
--                        key = do_expand(dflt, ctx, entry);
-+                        key = do_expand(dflt, ctx, entry, NULL);
-                     }
--
--                    if (key) {
-+                    if (key && *key) {
-                         span = strlen(key);
-                         current->len = span;
-                         current->string = key;
-                         outlen += span;
-                     }
- 
-+                    expanded = 1;
-                     p = endp + 1;
-                 }
-             }
-@@ -2498,8 +2529,9 @@ static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry)
-                     current->len = span;
-                     current->string = bri->source + bri->regmatch[n].rm_so;
-                 }
--
-                 outlen += span;
-+
-+                expanded = 1;
-             }
- 
-             p += 2;
-@@ -2512,8 +2544,41 @@ static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry)
-             ++outlen;
-         }
- 
-+        if (unsafe_qmark && expanded && current->len
-+            && memchr(current->string, '?', current->len)) {
-+            /* this qmark is from an expansion thus unsafe */
-+            *unsafe_qmark = 1;
-+
-+            /* keep tracking only if interested in the last qmark */
-+            if (!entry || !(entry->flags & RULEFLAG_QSLAST)) {
-+                unsafe_qmark = NULL;
-+            }
-+        }
-+
-         /* check the remainder */
--        if (*p && (span = strcspn(p, "\\$%")) > 0) {
-+        if (!unsafe_qmark) {
-+            span = strcspn(p, EXPAND_SPECIALS);
-+        }
-+        else {
-+            span = strcspn(p, EXPAND_SPECIALS "?");
-+            if (p[span] == '?') {
-+                /* this qmark is not from an expansion thus safe */
-+                *unsafe_qmark = 0;
-+
-+                /* keep tracking only if interested in the last qmark */
-+                if (entry && (entry->flags & RULEFLAG_QSLAST)) {
-+                    do {
-+                        span++;
-+                        span += strcspn(p + span, EXPAND_SPECIALS "?");
-+                    } while (p[span] == '?');
-+                }
-+                else {
-+                    unsafe_qmark = NULL;
-+                    span += strcspn(p + span, EXPAND_SPECIALS);
-+                }
-+            }
-+        }
-+        if (span > 0) {
-             if (current->len) {
-                 current->next = (spc < SMALL_EXPANSION)
-                                 ? &(sresult[spc++])
-@@ -2558,7 +2623,7 @@ static void do_expand_env(data_item *env, rewrite_ctx *ctx)
-     char *name, *val;
- 
-     while (env) {
--        name = do_expand(env->data, ctx, NULL);
-+        name = do_expand(env->data, ctx, NULL, NULL);
-         if (*name == '!') {
-             name++;
-             apr_table_unset(ctx->r->subprocess_env, name);
-@@ -2685,7 +2750,7 @@ static void add_cookie(request_rec *r, char *s)
- static void do_expand_cookie(data_item *cookie, rewrite_ctx *ctx)
- {
-     while (cookie) {
--        add_cookie(ctx->r, do_expand(cookie->data, ctx, NULL));
-+        add_cookie(ctx->r, do_expand(cookie->data, ctx, NULL, NULL));
-         cookie = cookie->next;
-     }
- 
-@@ -3964,7 +4029,7 @@ static int apply_rewrite_cond(rewritecond_entry *p, rewrite_ctx *ctx)
-     int basis;
- 
-     if (p->ptype != CONDPAT_AP_EXPR)
--        input = do_expand(p->input, ctx, NULL);
-+        input = do_expand(p->input, ctx, NULL, NULL);
- 
-     switch (p->ptype) {
-     case CONDPAT_FILE_EXISTS:
-@@ -4128,7 +4193,7 @@ static APR_INLINE void force_type_handler(rewriterule_entry *p,
-     char *expanded;
- 
-     if (p->forced_mimetype) {
--        expanded = do_expand(p->forced_mimetype, ctx, p);
-+        expanded = do_expand(p->forced_mimetype, ctx, p, NULL);
- 
-         if (*expanded) {
-             ap_str_tolower(expanded);
-@@ -4142,7 +4207,7 @@ static APR_INLINE void force_type_handler(rewriterule_entry *p,
-     }
- 
-     if (p->forced_handler) {
--        expanded = do_expand(p->forced_handler, ctx, p);
-+        expanded = do_expand(p->forced_handler, ctx, p, NULL);
- 
-         if (*expanded) {
-             ap_str_tolower(expanded);
-@@ -4279,12 +4344,18 @@ static rule_return_type apply_rewrite_rule(rewriterule_entry *p,
- 
-     /* expand the result */
-     if (!(p->flags & RULEFLAG_NOSUB)) {
--        newuri = do_expand(p->output, ctx, p);
-+        int unsafe_qmark = -1;
-+
-+        if (p->flags & RULEFLAG_UNSAFE_ALLOW3F) {
-+            newuri = do_expand(p->output, ctx, p, NULL);
-+        }
-+        else {
-+            newuri = do_expand(p->output, ctx, p, &unsafe_qmark);
-+        }
-         rewritelog((r, 2, ctx->perdir, "rewrite '%s' -> '%s'", ctx->uri,
-                     newuri));
--        if (!(p->flags & RULEFLAG_UNSAFE_ALLOW3F) &&
--            ap_strcasestr(r->unparsed_uri, "%3f") &&
--            ap_strchr_c(newuri, '?')) {
-+
-+        if (unsafe_qmark > 0) {
-             ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO()
-                     "Unsafe URL with %%3f URL rewritten without "
-                     "UnsafeAllow3F");

SOURCES/httpd-2.4.57-r1884505+.patch

@@ -1,39 +0,0 @@
-# ./pullrev.sh 1884505 1915625
-http://svn.apache.org/viewvc?view=revision&revision=1884505
-http://svn.apache.org/viewvc?view=revision&revision=1915625
-
---- httpd-2.4.57/modules/filters/mod_xml2enc.c
-+++ httpd-2.4.57/modules/filters/mod_xml2enc.c
-@@ -329,7 +329,7 @@
-     apr_bucket* bstart;
-     apr_size_t insz = 0;
-     int pending_meta = 0;
--    char *ctype;
-+    char *mtype;
-     char *p;
- 
-     if (!ctx || !f->r->content_type) {
-@@ -338,13 +338,17 @@
-         return ap_pass_brigade(f->next, bb) ;
-     }
- 
--    ctype = apr_pstrdup(f->r->pool, f->r->content_type);
--    for (p = ctype; *p; ++p)
--        if (isupper(*p))
--            *p = tolower(*p);
-+    /* Extract the media type, ignoring parameters in content-type. */
-+    mtype = apr_pstrdup(f->r->pool, f->r->content_type);
-+    if ((p = ap_strchr(mtype, ';')) != NULL) *p = '\0';
-+    ap_str_tolower(mtype);
- 
--    /* only act if starts-with "text/" or contains "xml" */
--    if (strncmp(ctype, "text/", 5) && !strstr(ctype, "xml"))  {
-+    /* Accept text/ types, plus any XML media type per RFC 7303. */
-+    if (!(strncmp(mtype, "text/", 5) == 0
-+          || strcmp(mtype, "application/xml") == 0
-+          || (strlen(mtype) > 7 /* minimum 'a/b+xml' length */
-+              && (p = strstr(mtype, "+xml")) != NULL
-+              && strlen(p) == 4 /* ensures +xml is a suffix */))) {
-         ap_remove_output_filter(f);
-         return ap_pass_brigade(f->next, bb) ;
-     }