#! /bin/sh /usr/share/dpatch/dpatch-run
# Description: fix another mod_proxy reverse proxy exposure
# Origin: upstream, http://svn.apache.org/viewvc?view=revision&revision=1235443

@DPATCH@
diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' apache2-2.2.17~/modules/mappers/mod_rewrite.c apache2-2.2.17/modules/mappers/mod_rewrite.c
--- apache2-2.2.17~/modules/mappers/mod_rewrite.c	2012-02-14 10:01:30.000000000 -0500
+++ apache2-2.2.17/modules/mappers/mod_rewrite.c	2012-02-14 10:01:35.636418682 -0500
@@ -4276,6 +4276,11 @@
         return DECLINED;
     }
 
+    if ((r->unparsed_uri[0] == '*' && r->unparsed_uri[1] == '\0')
+        || !r->uri || r->uri[0] != '/') {
+        return DECLINED;
+    }
+
     /*
      *  add the SCRIPT_URL variable to the env. this is a bit complicated
      *  due to the fact that apache uses subrequests and internal redirects
diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' apache2-2.2.17~/modules/proxy/mod_proxy.c apache2-2.2.17/modules/proxy/mod_proxy.c
--- apache2-2.2.17~/modules/proxy/mod_proxy.c	2010-10-07 14:51:18.000000000 -0400
+++ apache2-2.2.17/modules/proxy/mod_proxy.c	2012-02-14 10:01:35.636418682 -0500
@@ -566,6 +566,11 @@
         return OK;
     }
 
+    if ((r->unparsed_uri[0] == '*' && r->unparsed_uri[1] == '\0')
+        || !r->uri || r->uri[0] != '/') {
+        return DECLINED;
+    }
+
     /* XXX: since r->uri has been manipulated already we're not really
      * compliant with RFC1945 at this point.  But this probably isn't
      * an issue because this is a hybrid proxy/origin server.
diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' apache2-2.2.17~/server/protocol.c apache2-2.2.17/server/protocol.c
--- apache2-2.2.17~/server/protocol.c	2012-02-14 10:01:30.000000000 -0500
+++ apache2-2.2.17/server/protocol.c	2012-02-14 10:01:35.640418683 -0500
@@ -640,25 +640,6 @@
 
     ap_parse_uri(r, uri);
 
-    /* RFC 2616:
-     *   Request-URI    = "*" | absoluteURI | abs_path | authority
-     *
-     * authority is a special case for CONNECT.  If the request is not
-     * using CONNECT, and the parsed URI does not have scheme, and
-     * it does not begin with '/', and it is not '*', then, fail
-     * and give a 400 response. */
-    if (r->method_number != M_CONNECT 
-        && !r->parsed_uri.scheme 
-        && uri[0] != '/'
-        && !(uri[0] == '*' && uri[1] == '\0')) {
-        ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
-                      "invalid request-URI %s", uri);
-        r->args = NULL;
-        r->hostname = NULL;
-        r->status = HTTP_BAD_REQUEST;
-        r->uri = apr_pstrdup(r->pool, uri);
-    }
-
     if (ll[0]) {
         r->assbackwards = 0;
         pro = ll;
