On Sun, 2015-02-01 at 09:04 +0100, Stefan Fritsch wrote: > I think it would still be a good idea if httpd would not export the > HTTP_PROXY variable to CGIs and other subprocesses (mod_include, etc.)
Simple workaround: Untaint Header:Proxy s/.+// -- Nick Kew
