From a0f03465ebb77a4dc5d647d7b5d4f721d1127873 Mon Sep 17 00:00:00 2001 From: Ingo Schwarze Date: Thu, 31 Jan 2019 23:00:23 +0000 Subject: Relax overzealous PATH_INFO validation. URIs like https://man.openbsd.org/OpenBSD-2.2/cat1/cat.0 are still required to work because they result from apropos searches for old releases (up to 5.0) which used to install preformatted manual pages. Regression reported by jj@. --- cgi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/cgi.c b/cgi.c index 167fd84e..812e7701 100644 --- a/cgi.c +++ b/cgi.c @@ -1,4 +1,4 @@ -/* $Id: cgi.c,v 1.164 2018/12/30 00:49:54 schwarze Exp $ */ +/* $Id: cgi.c,v 1.165 2019/01/31 23:00:23 schwarze Exp $ */ /* * Copyright (c) 2011, 2012 Kristaps Dzonsons * Copyright (c) 2014, 2015, 2016, 2017, 2018 Ingo Schwarze @@ -1178,7 +1178,7 @@ parse_path_info(struct req *req, const char *path) } /* Optional section. */ - if (strncmp(path, "man", 3) == 0) { + if (strncmp(path, "man", 3) == 0 || strncmp(path, "cat", 3) == 0) { path += 3; end = strchr(path, '/'); free(req->q.sec); -- cgit v1.2.3-56-ge451