--- docs/conf/httpd.conf.in 2016/07/18 14:00:30 1753227

+++ docs/conf/httpd.conf.in 2016/07/18 14:07:00 1753228

@@ -283,6 +283,15 @@

Require all granted

</Directory>

+<IfModule headers_module>

+ #

+ # Avoid passing HTTP_PROXY environment to CGI's on this or any proxied

+ # backend servers which have lingering "httpoxy" defects.

+ # 'Proxy' request header is undefined by the IETF, not listed by IANA

+ #

+ RequestHeader unset Proxy early

+</IfModule>

+

<IfModule mime_module>

#

# TypesConfig points to the file containing the list of mappings from

--- server/util_script.c 2016/07/18 14:00:30 1753227

+++ server/util_script.c 2016/07/18 14:07:00 1753228

@@ -186,6 +186,14 @@

else if (!strcasecmp(hdrs[i].key, "Content-length")) {

apr_table_addn(e, "CONTENT_LENGTH", hdrs[i].val);

}

+ /* HTTP_PROXY collides with a popular envvar used to configure

+ * proxies, don't let clients set/override it. But, if you must...

+ */

+#ifndef SECURITY_HOLE_PASS_PROXY

+ else if (!ap_cstr_casecmp(hdrs[i].key, "Proxy")) {

+ ;

+ }

+#endif

/*

* You really don't want to disable this check, since it leaves you

* wide open to CGIs stealing passwords and people viewing them