deon/phpldapadmin
1
0
Fork 0
Code Issues 36 Pull Requests Packages Projects Releases Wiki Activity

Fixed request smuggling vulnerability. See: https://www.owasp.org/index.php/OWASP_Periodic_Table_of_Vulnerabilities_-_HTTP_Request/Response_Smuggling

Browse Source 
According to https://www.w3.org/TR/XMLHttpRequest/#the-setrequestheader%28%29-method, the header should be ignored anyway if those properties were set.
This commit is contained in:
Patrick Baus 2016-08-11 01:48:12 +02:00
parent 665dbc2690
commit dd6e9583a2
1 changed files with 0 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
htdocs/js/ajax_functions.js
View File

@ -202,8 +202,6 @@ function makeHttpRequest(url,parameters,meth,successCallbackFunctionName,errorCa
http_request.open(meth,url,true);
http_request.setRequestHeader('Content-type','application/x-www-form-urlencoded');
http_request.setRequestHeader('Content-length',parameters.length);
http_request.setRequestHeader('Connection','close');
if (meth == 'GET') parameters = null;
http_request.send(parameters);