Received: (qmail 3598 invoked by uid 65534); 21 Mar 2000 17:27:55 -0000
Message-Id: <20000321172755.3597.qmail@locus.apache.org>
Date: 21 Mar 2000 17:27:55 -0000
From: Giles Agnew <gea22@cam.ac.uk>
Reply-To: gea22@cam.ac.uk
To: submit@bugz.apache.org
Subject: Default for "encoding" attribute in the <!--#echo directive is non consistent with behaviour of previous versions.
X-Send-Pr-Version: 3.110

>Number:         5909
>Category:       mod_include
>Synopsis:       Default for "encoding" attribute in the <!--#echo directive is non consistent with behaviour of previous versions.
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    apache
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          support
>Submitter-Id:   apache
>Arrival-Date:   Tue Mar 21 09:30:01 PST 2000
>Closed-Date:    Sat Apr 15 19:10:09 PDT 2000
>Last-Modified:  Sat Apr 15 19:10:09 PDT 2000
>Originator:     gea22@cam.ac.uk
>Release:        1.3.12
>Organization:
>Environment:
Windows NT 4.0 SP5, using pre-compiled binary.
>Description:
Previous versions of Apache defaulted to encoding="none" (ie the attribute wasn't available). Version 1.3.12 introduces the encoding attribute (very useful) but it defaults to encoding="entity". Thus any pages previously written (which assumed the default encoding="none") will break if the change of encoding affects them. 

For example, if you've used HTML tags in your variables which you subsequently want to echo, these get encoded to printable characters, so your HTML source appears as such in the browser display.
>How-To-Repeat:
Insert the following two lines in to a server-parsed file.

<!--#set var="foo" value="<h1>bar</h1>" -->
<!--#echo var="foo" -->

Then view it in a browser first using Apache 1.3.11 or below, then with 1.3.12.

Apache 1.3.11 and below will display "bar" as a heading type 1.
Apache 1.3.12 displays "<h1>bar</h1>" verbatim.
>Fix:
Either:

Change the line reading:

    encode = E_ENTITY;

to

    encode = E_NONE;

in line 5 of the handle_echo function in mod_include.c

OR

Add an option allowing the default encoding type to be set in httpd.conf.
>Release-Note:
>Audit-Trail:

From: Marc Slemko <marcs@znep.com>
To: gea22@cam.ac.uk
Cc: Apache bugs database <apbugs@apache.org>
Subject: Re: mod_include/5909: Default for "encoding" attribute in the
 <!--#echo directive is non consistent with behaviour of previous versions.
Date: Tue, 21 Mar 2000 23:11:55 -0700 (MST)

 On 21 Mar 2000, Giles Agnew wrote:
 
 > Previous versions of Apache defaulted to encoding="none" (ie the attribute wasn't available). Version 1.3.12 introduces the encoding attribute (very useful) but it defaults to encoding="entity". Thus any pages previously written (which assumed the default encoding="none") will break if the change of encoding affects them. 
 > 
 > For example, if you've used HTML tags in your variables which you subsequently want to echo, these get encoded to printable characters, so your HTML source appears as such in the browser display.
 
 It is correct that the default has changed.  This is necessary for 
 security reasons related to the "cross site scripting" security problem.
 It is unlikely the default default will be changed.
 
 A config directive to change the default could perhaps be added,
 but in the vast majority of cases where people use mod_include, it
 is used to output something more than a static string.  In the
 majority of cases, this is based off some request variable that
 needs to be encoded.
 
State-Changed-From-To: open-closed
State-Changed-By: lars
State-Changed-When: Sat Apr 15 19:10:08 PDT 2000
State-Changed-Why:

An answer has already been mailed to the user.

Class-Changed-From-To: sw-bug-support
Class-Changed-By: lars
Class-Changed-When: Sat Apr 15 19:10:08 PDT 2000
>Unformatted:
 [In order for any reply to be added to the PR database, you need]
 [to include <apbugs@Apache.Org> in the Cc line and make sure the]
 [subject line starts with the report component and number, with ]
 [or without any 'Re:' prefixes (such as "general/1098:" or      ]
 ["Re: general/1098:").  If the subject doesn't match this       ]
 [pattern, your message will be misfiled and ignored.  The       ]
 ["apbugs" address is not added to the Cc line of messages from  ]
 [the database automatically because of the potential for mail   ]
 [loops.  If you do not include this Cc, your reply may be ig-   ]
 [nored unless you are responding to an explicit request from a  ]
 [developer.  Reply only with text; DO NOT SEND ATTACHMENTS!     ]