Differences From Artifact [a7cadc51a2]:

• File src/cgi.c — part of check-in [be5d83f93a] at 2018-03-29 15:16:16 on branch trunk — New security feature: Reject any query parameter, POST parameter, or cookie whose name contains a non-alphanumeric character. No know vulnerabilities exist because of this. I'm just be paranoid. This enhancement is inspired by Drupalgeddon2. (user: drh size: 59731)

To Artifact [ec95f154e9]:

• File src/cgi.c — part of check-in [e09df6ea47] at 2018-03-29 15:20:21 on branch trunk — Slight revision to [be5d83f93ac66f65] to allow "_" in parameter names. (user: drh size: 59743)

583
584
585
586
587
588
589
590
591
592
593
594
595
596
597

        z++;
      }
      dehttpize(zValue);
    }else{
      if( *z ){ *z++ = 0; }
      zValue = "";
    }
    if( fossil_islower(zName[0]) && fossil_all_alnum(zName+1) ){
      cgi_set_parameter_nocopy(zName, zValue, isQP);
    }
#ifdef FOSSIL_ENABLE_JSON
    json_setenv( zName, cson_value_new_string(zValue,strlen(zValue)) );
#endif /* FOSSIL_ENABLE_JSON */
  }
}

|

583
584
585
586
587
588
589
590
591
592
593
594
595
596
597

        z++;
      }
      dehttpize(zValue);
    }else{
      if( *z ){ *z++ = 0; }
      zValue = "";
    }
    if( fossil_islower(zName[0]) && fossil_no_strange_characters(zName+1) ){
      cgi_set_parameter_nocopy(zName, zValue, isQP);
    }
#ifdef FOSSIL_ENABLE_JSON
    json_setenv( zName, cson_value_new_string(zValue,strlen(zValue)) );
#endif /* FOSSIL_ENABLE_JSON */
  }
}