Re: [mp2] Sections, Method handlers

2003-01-27 Thread Philippe M. Chiasson
On Tue, 2003-01-28 at 10:22, Randy J. Ray wrote: > > Is there anything specific you found not working like in 1.x with your > > sections ? > > Actually, I got an error saying that section support was not available > yet. I'm running from rpm packages, and have mod_perl 1.99_05. sections were

Re: [mp2] Sections, Method handlers

2003-01-27 Thread Stas Bekman
Philippe M. Chiasson wrote: On Tue, 2003-01-28 at 09:01, Stas Bekman wrote: Randy J. Ray wrote: Any indication of when/if these features will make it to mp2? I've been trying to get my RPC::XML code (specifically the Apache::RPC::Server and Apache::RPC::Status modules) to work under Apache2

Re: [mp2 Patch] Apache::Directive->lookup($directive, [$args]);

2003-01-27 Thread Stas Bekman
Philippe M. Chiasson wrote: Following a discussion about how to best access the information stored in Apache's configuration tree, I now submit Apache::Directive->lookup() In a nutshell, one could now do this: my $tree = Apache::Directive->conftree; my $port = $tree->lookup('Listen'); Or even

Re: [mp2] Sections, Method handlers

2003-01-27 Thread Philippe M. Chiasson
On Tue, 2003-01-28 at 09:01, Stas Bekman wrote: > Randy J. Ray wrote: > > Any indication of when/if these features will make it to mp2? I've been > > trying to get my RPC::XML code (specifically the Apache::RPC::Server and > > Apache::RPC::Status modules) to work under Apache2 and mod_perl2 (than

Re: Mitigating XSS in the mod_perl API

2003-01-27 Thread Matthew Byng-Maddick
On Mon, Jan 27, 2003 at 08:57:38AM -0600, Thomas Eibner wrote: > On Mon, Jan 27, 2003 at 02:45:13PM +, Matt Sergeant wrote: > > The programmer wants to output a header. If he accidentally tries to > > output something thats not a header he actually ends up outputting body. > > Thats a bug. > I

Re: Mitigating XSS in the mod_perl API

2003-01-27 Thread Thomas Eibner
On Mon, Jan 27, 2003 at 03:07:01PM +, Matt Sergeant wrote: > Anyway the main reason for doing this is there's no other way. Since > headers_out is just a plain table object, and there are no "setter" hooks > for tables, so I couldn't do it in mod_perl space. And I couldn't do it in > AxKit spa

Re: Mitigating XSS in the mod_perl API

2003-01-27 Thread Matt Sergeant
On Mon, 27 Jan 2003, Thomas Eibner wrote: > > On Mon, Jan 27, 2003 at 02:45:13PM +, Matt Sergeant wrote: > > On Mon, 27 Jan 2003, Thomas Eibner wrote: > > > > > So, because a programmer doesn't check the validity of the input he gets > > > it's a bug that should be fixed in Apache? Maybe someo

Re: Mitigating XSS in the mod_perl API

2003-01-27 Thread Thomas Eibner
On Mon, Jan 27, 2003 at 02:45:13PM +, Matt Sergeant wrote: > On Mon, 27 Jan 2003, Thomas Eibner wrote: > > > So, because a programmer doesn't check the validity of the input he gets > > it's a bug that should be fixed in Apache? Maybe someone should make > > sure that the same thing can't hap

Re: Mitigating XSS in the mod_perl API

2003-01-27 Thread Matt Sergeant
On Mon, 27 Jan 2003, Thomas Eibner wrote: > So, because a programmer doesn't check the validity of the input he gets > it's a bug that should be fixed in Apache? Maybe someone should make > sure that the same thing can't happen with allowing CGI input going > straight into a form.. oh wait. > I do

Re: Mitigating XSS in the mod_perl API

2003-01-27 Thread Geoffrey Young
I suppose the opposition is that well, mod_perl is just an API, and we shouldn't be forcing programming styles onto the programmer, but there isn't a single legitimate use of \n in an outgoing header, so I don't think that argument has much weight. Thoughts? If that causes a bug, may be this

Re: Mitigating XSS in the mod_perl API

2003-01-27 Thread Thomas Eibner
On Mon, Jan 27, 2003 at 09:28:38AM +1100, Stas Bekman wrote: > Matt Sergeant wrote: > >At the moment it's possible to do nasty XSS things in mod_perl when you > >set a cookie. That's because $r->headers_out->add() (or set()) doesn't > >care if you include carriage returns in your header. Simple

[mp2 Patch] Apache::Directive->lookup($directive, [$args]);

2003-01-27 Thread Philippe M. Chiasson
Following a discussion about how to best access the information stored in Apache's configuration tree, I now submit Apache::Directive->lookup() In a nutshell, one could now do this: my $tree = Apache::Directive->conftree; my $port = $tree->lookup('Listen'); Or even cooler: my @vhosts = Apach