On 2/28/08, Joshua Slive <joshua@xxxxxxxx> wrote: > In earlier versions, mod_autoindex didn't set any charset at all. This > meant that AddDefaultCharset, which only works when no other charset > is specified, was picked up. But it also meant that no charset was > sent at all if AddDefaultCharset wasn't present. > > To protect buggy browsers from cross-site scripting (XSS) attacks, all > content originated from apache needs to have a charset assigned, so a > change was made in 2.2.6 to assign a charset (utf-8 for windows and > iso-8859-1 for everything else, if I recall correctly). The charset > option was also added to IndexOptions for those who need to override > it. > > So, yes, the current behavior is expected and correct and the old > behavior is wrong. You should use IndexOptions charset= to change the > mod_autoindex charset and not AddDefaultCharset. > > Joshua. Hello Joshua, Thank you for your reply. Now it all starts to make sense. Thinking back, I noticed this behavior for the first time right after the cross-site scripting vulnerability was announced and patched. I found this whole thing strange since apparenlty I was going 'by the manual' -- so far on the official 2.2/mod/core documentation page there's no mention of this change. Cheers, Alex. --------------------------------------------------------------------- The official User-To-User support forum of the Apache HTTP Server Project. See <URL:http://httpd.apache.org/userslist.html> for more info. To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx " from the digest: users-digest-unsubscribe@xxxxxxxxxxxxxxxx For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx
|