mirror of
https://github.com/php/php-src.git
synced 2024-09-22 18:37:25 +00:00
- sapi_header_op(SAPI_HEADER_(REPLACE|ADD), {NULL, 0, 0}) caused HTTP response splitting
- sapi_send_headers() already takes care of default_content_type (left over of fix for bug #29983)
This commit is contained in:
parent
971bebd6e3
commit
ab95f1981c
@ -567,6 +567,10 @@ SAPI_API int sapi_header_op(sapi_header_op_enum op, void *arg TSRMLS_DC)
|
||||
case SAPI_HEADER_REPLACE:
|
||||
case SAPI_HEADER_ADD: {
|
||||
sapi_header_line *p = arg;
|
||||
|
||||
if (!p->line || !p->line_len) {
|
||||
return FAILURE;
|
||||
}
|
||||
header_line = p->line;
|
||||
header_line_len = p->line_len;
|
||||
http_response_code = p->response_code;
|
||||
|
@ -331,21 +331,13 @@ static int sapi_cgi_send_headers(sapi_headers_struct *sapi_headers TSRMLS_DC)
|
||||
PHPWRITE_H(buf, len);
|
||||
}
|
||||
|
||||
if (SG(sapi_headers).send_default_content_type)
|
||||
{
|
||||
char *hd;
|
||||
|
||||
hd = sapi_get_default_content_type(TSRMLS_C);
|
||||
PHPWRITE_H("Content-type: ", sizeof("Content-type: ") - 1);
|
||||
PHPWRITE_H(hd, strlen(hd));
|
||||
PHPWRITE_H("\r\n", 2);
|
||||
efree(hd);
|
||||
}
|
||||
|
||||
h = zend_llist_get_first_ex(&sapi_headers->headers, &pos);
|
||||
while (h) {
|
||||
PHPWRITE_H(h->header, h->header_len);
|
||||
PHPWRITE_H("\r\n", 2);
|
||||
/* prevent CRLFCRLF */
|
||||
if (h->header_len) {
|
||||
PHPWRITE_H(h->header, h->header_len);
|
||||
PHPWRITE_H("\r\n", 2);
|
||||
}
|
||||
h = zend_llist_get_next_ex(&sapi_headers->headers, &pos);
|
||||
}
|
||||
PHPWRITE_H("\r\n", 2);
|
||||
|
Loading…
Reference in New Issue
Block a user