* don't HTML-escape the SERVER_NAME variable * do escape SERVER_NAME in error docs * remove dates from error pages (#86474), since they won't be in the right language Upstream-Status: SERVER_NAME is not URI-encoded by default. --- httpd-2.0.45/docs/error/include/bottom.html.encode +++ httpd-2.0.45/docs/error/include/bottom.html @@ -5,10 +5,8 @@ <h2>Error <!--#echo encoding="none" var="REDIRECT_STATUS" --></h2> <address> - <a href="/"><!--#echo var="SERVER_NAME" --></a><br /> - <!--#config timefmt="%c" --> - <span><!--#echo var="DATE_LOCAL" --><br /> - <!--#echo var="SERVER_SOFTWARE" --></span> + <a href="/"><!--#echo encoding="entity" var="SERVER_NAME" --></a><br /> + <span><!--#echo var="SERVER_SOFTWARE" --></span> </address> </body> </html> --- httpd-2.1.10/server/util_script.c.orig 2005-11-10 15:20:05.000000000 +0000 +++ httpd-2.1.10/server/util_script.c 2005-11-25 13:11:37.000000000 +0000 @@ -224,8 +224,7 @@ apr_table_addn(e, "SERVER_SIGNATURE", ap_psignature("", r)); apr_table_addn(e, "SERVER_SOFTWARE", ap_get_server_version()); - apr_table_addn(e, "SERVER_NAME", - ap_escape_html(r->pool, ap_get_server_name(r))); + apr_table_addn(e, "SERVER_NAME",ap_get_server_name(r)); apr_table_addn(e, "SERVER_ADDR", r->connection->local_ip); /* Apache */ apr_table_addn(e, "SERVER_PORT", apr_psprintf(r->pool, "%u", ap_get_server_port(r)));