Re: MP1 Security issue

2007-03-23 Thread Alex Solovey
On 3/23/07, Randal L. Schwartz wrote: You're correct. It has been fixed in Apache::Registry for MP1. I'm sorry I overlooked that last night. For mp1, it affects only users of Apache::PerlRun. However, for mp2, since the listed modules all use ModPerl::RegistryCooker, and the problem is in th

Re: MP1 Security issue (was Re: [mp1] PerlRun fails if path_info contains special symbols)

2007-03-23 Thread Alex Solovey
On 3/23/07, Geoffrey Young <[EMAIL PROTECTED]> wrote: as for mp2, nothing in the current distribution is affected - ModPerl::Registry and ModPerl::PerlRun are both filesystem based and not uri based. however, if you use RegistryCooker to roll your own non-standard Registry handler and are using

[mp1] PerlRun fails if path_info contains special symbols

2007-03-22 Thread Alex Solovey
Hi, If I have a PerlRun script, e.g., http://localhost/test/script, and call it using a URL with special symbols like '(' in path_info, PerlRun fails with server error. For example, calling http://localhost/test/script/( produces this error: [Thu Mar 22 10:24:57 2007] [error] Unmatched ( in