<!DOCTYPE html><html><head><title></title><style type="text/css">p.MsoNormal,p.MsoNoSpacing{margin:0}</style></head><body><div>Hi all,<br></div><div><br></div><div>Please see <a href="https://github.com/MapServer/MapServer/pull/6808">https://github.com/MapServer/MapServer/pull/6808</a>. There are lots of changes to expected msautotest results due to missing blank lines after the version number that weren't stripped, but the actual code changes are minimal.<br></div><div><br></div><div>Seth<br></div><div><br></div><div id="sig62266145"><div class="signature">--<br></div><div class="signature">web:<a href="https://geographika.net">https://geographika.net</a><br></div><div class="signature">twitter: @geographika<br></div></div><div><br></div><div>On Wed, Jan 25, 2023, at 5:00 PM, Steve Lime wrote:<br></div><blockquote type="cite" id="qt" style=""><div dir="ltr">I'm +1 on cleaning that up as well. I wouldn't think someone would base client behavior on a comment in an error message - too brittle.<br></div><div><br></div><div class="qt-gmail_quote"><div dir="ltr" class="qt-gmail_attr">On Wed, Jan 25, 2023 at 9:55 AM Nash, Edward <<a href="mailto:E.Nash@dvz-mv.de">E.Nash@dvz-mv.de</a>> wrote:<br></div><blockquote class="qt-gmail_quote" style="margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0.8ex;border-left-color:rgb(204, 204, 204);border-left-style:solid;border-left-width:1px;padding-left:1ex;"><div>I'd be +1 on sending as little information about the server as possible (aka "secure") by default.<br></div><div> <br></div><div> Whatever the technical merits, this one always comes up on security checklists, and anything that makes it harder to forget to set everything up correctly is fine by me - assuming the documentation of how to get the version details for debugging is clear and easy to find (as an FAQ, or maybe in a new "Troubleshooting" section in the docs?).<br></div><div> <br></div><div> Best regards,<br></div><div> <br></div><div> Ed<br></div><div> <br></div><div> -----Ursprüngliche Nachricht-----<br></div><div> Von: MapServer-dev <<a href="mailto:mapserver-dev-bounces@lists.osgeo.org" target="_blank">mapserver-dev-bounces@lists.osgeo.org</a>> Im Auftrag von Seth G<br></div><div> Gesendet: Mittwoch, 25. Januar 2023 16:13<br></div><div> An: MapServer Devs <<a href="mailto:mapserver-dev@lists.osgeo.org" target="_blank">mapserver-dev@lists.osgeo.org</a>><br></div><div> Betreff: [MapServer-dev] MapServer version information in error messages<br></div><div> <br></div><div> Hi all,<br></div><div> <br></div><div> Does anyone have any thoughts about removing MapServer version information from any errors/responses sent to client applications?<br></div><div> <br></div><div> A few relevant online discussions [1] [2]. As MapServer falls more in the generic server category I'd be +1 on removing the details from responses (and leaving them in the client applications). <br></div><div> <br></div><div> See <a href="https://github.com/MapServer/MapServer/pull/6794" rel="noreferrer" target="_blank">https://github.com/MapServer/MapServer/pull/6794</a> for some more details. I added in Proj and GDAL versions which are handy for admins/debugging, but provide more information to a malevolent party looking to attack a MapServer instance. <br></div><div> <br></div><div> Seth<br></div><div> <br></div><div> [1] <a href="https://softwareengineering.stackexchange.com/questions/345072/is-my-app-version-a-sensitive-information" rel="noreferrer" target="_blank">https://softwareengineering.stackexchange.com/questions/345072/is-my-app-version-a-sensitive-information</a><br></div><div> [2] <a href="https://security.stackexchange.com/questions/170352/is-it-safe-to-display-version-information-on-a-public-webpage-of-your-web-app" rel="noreferrer" target="_blank">https://security.stackexchange.com/questions/170352/is-it-safe-to-display-version-information-on-a-public-webpage-of-your-web-app</a><br></div><div> <br></div><div> --<br></div><div> web:<a href="https://geographika.net" rel="noreferrer" target="_blank">https://geographika.net</a><br></div><div> twitter: @geographika<br></div><div> _______________________________________________<br></div><div> MapServer-dev mailing list<br></div><div> <a href="mailto:MapServer-dev@lists.osgeo.org" target="_blank">MapServer-dev@lists.osgeo.org</a><br></div><div> <a href="https://lists.osgeo.org/mailman/listinfo/mapserver-dev" rel="noreferrer" target="_blank">https://lists.osgeo.org/mailman/listinfo/mapserver-dev</a><br></div><div> _______________________________________________<br></div><div> MapServer-dev mailing list<br></div><div> <a href="mailto:MapServer-dev@lists.osgeo.org" target="_blank">MapServer-dev@lists.osgeo.org</a><br></div><div> <a href="https://lists.osgeo.org/mailman/listinfo/mapserver-dev" rel="noreferrer" target="_blank">https://lists.osgeo.org/mailman/listinfo/mapserver-dev</a><br></div></blockquote></div></blockquote><div><br></div></body></html>