diff options
| author |   Ingo Schwarze <schwarze@openbsd.org> | 2014-07-18 19:03:39 +0000 |
|---|---|---|
| committer | Ingo Schwarze <schwarze@openbsd.org> | 2014-07-18 19:03:39 +0000 |
| commit | 6d9b8bc9ac9935024b9c1b5d06d4f294d7fce3d1 (patch) | |
| tree | f4c7415fe3497c57c28588f04fe7d6f6687331f9 /cgi.c | |
| parent | 0065e1541bdf9d7132fd54e83dfeab0ed1f86f25 (diff) | |
| download | mandoc-6d9b8bc9ac9935024b9c1b5d06d4f294d7fce3d1.tar.gz mandoc-6d9b8bc9ac9935024b9c1b5d06d4f294d7fce3d1.tar.zst mandoc-6d9b8bc9ac9935024b9c1b5d06d4f294d7fce3d1.zip | |
Do not use the HTTP_HOST CGI variable,
just make the HTTP redirect Location: relative.
Less user input is good, it reduces the attack surface.
Besides, this removes one global variable and 4 lines of code.
Patch from Sebastien Marie <semarie-openbsd at latrappe dot fr>.
Diffstat (limited to 'cgi.c')
| -rw-r--r-- | cgi.c | 10 |
1 files changed, 3 insertions, 7 deletions
@@ -1,4 +1,4 @@ -/* $Id: cgi.c,v 1.74 2014/07/18 14:46:25 schwarze Exp $ */ +/* $Id: cgi.c,v 1.75 2014/07/18 19:03:39 schwarze Exp $ */ /* * Copyright (c) 2011, 2012 Kristaps Dzonsons <kristaps@bsd.lv> * Copyright (c) 2014 Ingo Schwarze <schwarze@usta.de> @@ -79,7 +79,6 @@ static void resp_searchform(const struct req *); static void resp_show(const struct req *, const char *); static const char *scriptname; /* CGI script name */ -static const char *httphost; /* hostname used in the URIs */ static const int sec_prios[] = {1, 4, 5, 8, 6, 3, 7, 2, 9}; static const char *const sec_numbers[] = { @@ -530,8 +529,8 @@ pg_searchres(const struct req *req, struct manpage *r, size_t sz) * without any delay. */ printf("Status: 303 See Other\r\n"); - printf("Location: http://%s%s/%s/%s?", - httphost, scriptname, req->q.manpath, r[0].file); + printf("Location: %s/%s/%s?", + scriptname, req->q.manpath, r[0].file); http_printquery(req); printf("\r\n" "Content-Type: text/html; charset=utf-8\r\n" @@ -907,9 +906,6 @@ main(void) if (NULL == (scriptname = getenv("SCRIPT_NAME"))) scriptname = ""; - if (NULL == (httphost = getenv("HTTP_HOST"))) - httphost = "localhost"; - /* * First we change directory into the MAN_DIR so that * subsequent scanning for manpath directories is rooted |