mod_auth_openidc/CVE-2021-20718-pre1.patch
2021-06-10 17:33:57 +08:00

44 lines
1.4 KiB
Diff

From 9793565ade06dcea0626e8c05137725141ef827b Mon Sep 17 00:00:00 2001
From: Hans Zandbelt <hans.zandbelt@zmartzone.eu>
Date: Fri, 28 Aug 2020 19:05:52 +0200
Subject: [PATCH] allow Content-Type check on backchannel logout to have postfixes utf-8 etc. ; bump to 2.4.4rc8
Signed-off-by: Hans Zandbelt <hans.zandbelt@zmartzone.eu>
---
configure.ac | 2 +-
src/util.c | 7 +++++--
2 files changed, 6 insertions(+), 3 deletions(-)
diff --git a/configure.ac b/configure.ac
index c976c5c..7e8353c 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1,4 +1,4 @@
-AC_INIT([mod_auth_openidc],[2.4.0.3],[hans.zandbelt@zmartzone.eu])
+AC_INIT([mod_auth_openidc],[2.4.4rc8],[hans.zandbelt@zmartzone.eu])
AC_SUBST(NAMEVER, AC_PACKAGE_TARNAME()-AC_PACKAGE_VERSION())
diff --git a/src/util.c b/src/util.c
index 617136e..ca13512 100644
--- a/src/util.c
+++ b/src/util.c
@@ -1526,9 +1526,12 @@ apr_byte_t oidc_util_read_post_params(request_rec *r, apr_table_t *table,
const char *content_type = NULL;
content_type = oidc_util_hdr_in_content_type_get(r);
- if ((r->method_number != M_POST) || (apr_strnatcmp(content_type,
- OIDC_CONTENT_TYPE_FORM_ENCODED) != 0))
+ if ((r->method_number != M_POST) || (strstr(content_type,
+ OIDC_CONTENT_TYPE_FORM_ENCODED) != content_type)) {
+ oidc_debug(r, "required content-type %s not found",
+ OIDC_CONTENT_TYPE_FORM_ENCODED);
goto end;
+ }
if (oidc_util_read(r, &data) != TRUE)
goto end;
--
2.23.0