From b5cfe770f4ed31ded4bcd477f8a3e5060bd52f84 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rapha=C3=ABl=20Hertzog?= Date: Wed, 28 Jan 2015 17:56:04 +0100 Subject: [PATCH] [1.4.x] Fixed #24239 -- merge both WSGIRequestHandler.get_environ() methods MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Commit 4f6fffc1dc429f1ad428ecf8e6620739e8837450 incorrectly added a get_environ() method that replaced the original implementation. Instead the filtering logic should have been merged into the pre-existing get_environ(). Signed-off-by: Raphaël Hertzog --- django/core/servers/basehttp.py | 19 ++++++++----------- 1 file changed, 8 insertions(+), 11 deletions(-) diff --git a/django/core/servers/basehttp.py b/django/core/servers/basehttp.py index 0ec5f98..ef18687 100644 --- a/django/core/servers/basehttp.py +++ b/django/core/servers/basehttp.py @@ -160,6 +160,14 @@ class WSGIRequestHandler(simple_server.WSGIRequestHandler, object): if length: env['CONTENT_LENGTH'] = length + # Strip all headers with underscores in the name before constructing + # the WSGI environ. This prevents header-spoofing based on ambiguity + # between underscores and dashes both normalized to underscores in WSGI + # env vars. Nginx and Apache 2.4+ both do this as well. + for k, v in self.headers.items(): + if '_' in k: + del self.headers[k] + for h in self.headers.headers: k,v = h.split(':',1) k=k.replace('-','_').upper(); v=v.strip() @@ -199,17 +207,6 @@ class WSGIRequestHandler(simple_server.WSGIRequestHandler, object): sys.stderr.write(msg) - def get_environ(self): - # Strip all headers with underscores in the name before constructing - # the WSGI environ. This prevents header-spoofing based on ambiguity - # between underscores and dashes both normalized to underscores in WSGI - # env vars. Nginx and Apache 2.4+ both do this as well. - for k, v in self.headers.items(): - if '_' in k: - del self.headers[k] - - return super(WSGIRequestHandler, self).get_environ() - class AdminMediaHandler(handlers.StaticFilesHandler): """ -- 2.1.4