From 6d9b8bc9ac9935024b9c1b5d06d4f294d7fce3d1 Mon Sep 17 00:00:00 2001 From: Ingo Schwarze Date: Fri, 18 Jul 2014 19:03:39 +0000 Subject: Do not use the HTTP_HOST CGI variable, just make the HTTP redirect Location: relative. Less user input is good, it reduces the attack surface. Besides, this removes one global variable and 4 lines of code. Patch from Sebastien Marie . --- man.cgi.8 | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) (limited to 'man.cgi.8') diff --git a/man.cgi.8 b/man.cgi.8 index d68da6c2..25fe9f2b 100644 --- a/man.cgi.8 +++ b/man.cgi.8 @@ -1,4 +1,4 @@ -.\" $Id: man.cgi.8,v 1.6 2014/07/13 15:38:36 schwarze Exp $ +.\" $Id: man.cgi.8,v 1.7 2014/07/18 19:03:39 schwarze Exp $ .\" .\" Copyright (c) 2014 Ingo Schwarze .\" @@ -14,7 +14,7 @@ .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. .\" -.Dd $Mdocdate: July 13 2014 $ +.Dd $Mdocdate: July 18 2014 $ .Dt MAN.CGI 8 .Os .Sh NAME @@ -266,11 +266,6 @@ is supported as an alias for The web server may pass the following CGI variables to .Nm : .Bl -tag -width Ds -.It Ev HTTP_HOST -The FQDN of the (possibly virtual) host the HTTP server is running on. -This is used for -.Ic Location: -headers in HTTP 303 responses. .It Ev PATH_INFO The final part of the URI path passed from the client to the server, starting after the -- cgit v1.2.3-56-ge451