[mapserver-commits] r10306 - branches/branch-5-6/mapserver

svn at osgeo.org svn at osgeo.org
Thu Jul 8 16:07:15 EDT 2010


Author: dmorissette
Date: 2010-07-08 20:07:15 +0000 (Thu, 08 Jul 2010)
New Revision: 10306

Modified:
   branches/branch-5-6/mapserver/README.CONFIGURE
   branches/branch-5-6/mapserver/configure
   branches/branch-5-6/mapserver/configure.in
   branches/branch-5-6/mapserver/mapserv.c
Log:
Disable insecure mapserv cgi command-line debug params by default (#3484)

Modified: branches/branch-5-6/mapserver/README.CONFIGURE
===================================================================
--- branches/branch-5-6/mapserver/README.CONFIGURE	2010-07-08 20:04:54 UTC (rev 10305)
+++ branches/branch-5-6/mapserver/README.CONFIGURE	2010-07-08 20:07:15 UTC (rev 10306)
@@ -54,6 +54,12 @@
   --disable-fast-nint     Use safe MS_NINT with reliable rounding
   --enable-debug          Include "-g" in CFLAGS for debugging.
   --disable-debug         Do not include "-g" in CFLAGS (the default).
+  --enable-cgi-cl-debug-args
+                          Enable mapserv CGI command-line debug arguments
+                          (disabled by default). These command-line args may
+                          be insecure and should be enabled only on
+                          development servers and only if you understand the
+                          security implications.
   --enable-gcov           Enable source code coverage testing using gcov
   --enable-perlv-ld-detect (applies to --with-php only)
                           Use perl -V output to figure the command to use to
@@ -673,6 +679,15 @@
 
 ::
 
+  --enable-cgi-cl-debug-args
+                          Enable mapserv CGI command-line debug arguments
+                          (disabled by default). These command-line args may
+                          be insecure and should be enabled only on
+                          development servers and only if you understand the
+                          security implications.
+
+::
+
   --enable-gcov           Enable source code coverage testing using gcov
 
 ::

Modified: branches/branch-5-6/mapserver/configure
===================================================================
--- branches/branch-5-6/mapserver/configure	2010-07-08 20:04:54 UTC (rev 10305)
+++ branches/branch-5-6/mapserver/configure	2010-07-08 20:07:15 UTC (rev 10306)
@@ -857,6 +857,12 @@
   --disable-fast-nint     Use safe MS_NINT with reliable rounding
   --enable-debug          Include "-g" in CFLAGS for debugging.
   --disable-debug         Do not include "-g" in CFLAGS (the default).
+  --enable-cgi-cl-debug-args
+                          Enable mapserv CGI command-line debug arguments
+                          (disabled by default). These command-line args may
+                          be insecure and should be enabled only on
+                          development servers and only if you understand the
+                          security implications.
   --enable-gcov           Enable source code coverage testing using gcov
   --enable-perlv-ld-detect
                           (applies to --with-php only)
@@ -11416,8 +11422,81 @@
       POSTGIS_LIB="-L`$PG_CONFIG --libdir` -lpq"
   fi
   POSTGIS_INC="-I`$PG_CONFIG --includedir`"
+
+  old_LDFLAGS="$LDFLAGS"
+  LDFLAGS="$LDFLAGS -L`$PG_CONFIG --libdir`"
+  echo "$as_me:$LINENO: checking for PQserverVersion in -lpq" >&5
+echo $ECHO_N "checking for PQserverVersion in -lpq... $ECHO_C" >&6
+if test "${ac_cv_lib_pq_PQserverVersion+set}" = set; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+  ac_check_lib_save_LIBS=$LIBS
+LIBS="-lpq  $LIBS"
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+
+/* Override any gcc2 internal prototype to avoid an error.  */
+#ifdef __cplusplus
+extern "C"
+#endif
+/* We use char because int might match the return type of a gcc2
+   builtin and then its argument prototype would still apply.  */
+char PQserverVersion ();
+int
+main ()
+{
+PQserverVersion ();
+  ;
+  return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (eval echo "$as_me:$LINENO: \"$ac_link\"") >&5
+  (eval $ac_link) 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } &&
+	 { ac_try='test -z "$ac_c_werror_flag"
+			 || test ! -s conftest.err'
+  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+  (eval $ac_try) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; } &&
+	 { ac_try='test -s conftest$ac_exeext'
+  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+  (eval $ac_try) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; }; then
+  ac_cv_lib_pq_PQserverVersion=yes
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ac_cv_lib_pq_PQserverVersion=no
 fi
+rm -f conftest.err conftest.$ac_objext \
+      conftest$ac_exeext conftest.$ac_ext
+LIBS=$ac_check_lib_save_LIBS
+fi
+echo "$as_me:$LINENO: result: $ac_cv_lib_pq_PQserverVersion" >&5
+echo "${ECHO_T}$ac_cv_lib_pq_PQserverVersion" >&6
+if test $ac_cv_lib_pq_PQserverVersion = yes; then
+  POSTGIS_ENABLED="$POSTGIS_ENABLED -DPOSTGIS_HAS_SERVER_VERSION"
+fi
 
+  LDFLAGS="$old_LDFLAGS"
+
+fi
+
 POSTGIS_ENABLED=$POSTGIS_ENABLED
 
 POSTGIS_INC=$POSTGIS_INC
@@ -12636,6 +12715,21 @@
   CFLAGS=`echo "$CFLAGS " | sed "s/-g //"`
 fi
 
+
+{ echo "$as_me:$LINENO: checking whether we should enable mapserv CGI command-line debug arguments..." >&5
+echo "$as_me: checking whether we should enable mapserv CGI command-line debug arguments..." >&6;}
+# Check whether --enable-cgi-cl-debug-args or --disable-cgi-cl-debug-args was given.
+if test "${enable_cgi_cl_debug_args+set}" = set; then
+  enableval="$enable_cgi_cl_debug_args"
+
+fi;
+
+if test "$enable_cgi_cl_debug_args" = "yes" ; then
+  DEBUG_FLAGS="$DEBUG_FLAGS -DMS_ENABLE_CGI_CL_DEBUG_ARGS"
+  echo "$as_me:$LINENO: result:         Enabling (potentially insecure) mapserv CGI command-line debug arguments: -DMS_ENABLE_CGI_CL_DEBUG_ARGS." >&5
+echo "${ECHO_T}        Enabling (potentially insecure) mapserv CGI command-line debug arguments: -DMS_ENABLE_CGI_CL_DEBUG_ARGS." >&6
+fi
+
 DEBUG_FLAGS=$DEBUG_FLAGS
 
 ALL_ENABLED="$DEBUG_FLAGS $ALL_ENABLED"

Modified: branches/branch-5-6/mapserver/configure.in
===================================================================
--- branches/branch-5-6/mapserver/configure.in	2010-07-08 20:04:54 UTC (rev 10305)
+++ branches/branch-5-6/mapserver/configure.in	2010-07-08 20:07:15 UTC (rev 10306)
@@ -2382,6 +2382,24 @@
   CFLAGS=`echo "$CFLAGS " | sed "s/-g //"`
 fi
 
+dnl ---------------------------------------------------------------------
+dnl Check --enable-cgi-cl-debug-args option (OFF by default)
+dnl ---------------------------------------------------------------------
+
+AC_CHECKING(whether we should enable mapserv CGI command-line debug arguments)
+AC_ARG_ENABLE(cgi-cl-debug-args,
+[  --enable-cgi-cl-debug-args 
+                          Enable mapserv CGI command-line debug arguments
+                          (disabled by default). These command-line args may
+                          be insecure and should be enabled only on 
+                          development servers and only if you understand the 
+                          security implications.],,)
+
+if test "$enable_cgi_cl_debug_args" = "yes" ; then
+  DEBUG_FLAGS="$DEBUG_FLAGS -DMS_ENABLE_CGI_CL_DEBUG_ARGS"
+  AC_MSG_RESULT([        Enabling (potentially insecure) mapserv CGI command-line debug arguments: -DMS_ENABLE_CGI_CL_DEBUG_ARGS.])
+fi
+
 AC_SUBST(DEBUG_FLAGS, $DEBUG_FLAGS)
 ALL_ENABLED="$DEBUG_FLAGS $ALL_ENABLED"
 

Modified: branches/branch-5-6/mapserver/mapserv.c
===================================================================
--- branches/branch-5-6/mapserver/mapserv.c	2010-07-08 20:04:54 UTC (rev 10305)
+++ branches/branch-5-6/mapserver/mapserv.c	2010-07-08 20:07:15 UTC (rev 10306)
@@ -1139,13 +1139,23 @@
   /*      purposes, and to query the version info.                        */
   /* -------------------------------------------------------------------- */
   for( iArg = 1; iArg < argc; iArg++ ) {
+    /* Keep only "-v", "-nh" and "QUERY_STRING=..." enabled by default.
+     * The others will require an explicit -DMS_ENABLE_CGI_CL_DEBUG_ARGS
+     * at compile time.
+     */
     if( strcmp(argv[iArg],"-v") == 0 ) {
       printf("%s\n", msGetVersion());
       fflush(stdout);
       exit(0);
     } else if(strcmp(argv[iArg], "-nh") == 0) {
       sendheaders = MS_FALSE;
-    } else if( iArg < argc-1 && strcmp(argv[iArg], "-tmpbase") == 0) {
+    } else if( strncmp(argv[iArg], "QUERY_STRING=", 13) == 0 ) {
+      /* Debugging hook... pass "QUERY_STRING=..." on the command-line */
+      putenv( "REQUEST_METHOD=GET" );
+      putenv( argv[iArg] );
+    }
+#ifdef MS_ENABLE_CGI_CL_DEBUG_ARGS
+    else if( iArg < argc-1 && strcmp(argv[iArg], "-tmpbase") == 0) {
       msForceTmpFileBase( argv[++iArg] );
     } else if( iArg < argc-1 && strcmp(argv[iArg], "-t") == 0) {
       char **tokens;
@@ -1161,15 +1171,13 @@
       }
             
       exit(0);
-    } else if( strncmp(argv[iArg], "QUERY_STRING=", 13) == 0) {
-      /* Debugging hook... pass "QUERY_STRING=..." on the command-line */
-      putenv( "REQUEST_METHOD=GET" );
-      putenv( argv[iArg] );
     } else if( strncmp(argv[iArg], "MS_ERRORFILE=", 13) == 0 ) {
       msSetErrorFile( argv[iArg] + 13 );
     } else if( strncmp(argv[iArg], "MS_DEBUGLEVEL=", 14) == 0) {
       msSetGlobalDebugLevel( atoi(argv[iArg] + 14) );
-    } else {
+    }
+#endif /* MS_ENABLE_CGI_CL_DEBUG_ARGS */
+    else {
       /* we don't produce a usage message as some web servers pass junk arguments */
     }
   }



More information about the mapserver-commits mailing list