[Zope-Coders] FastCGI leaking Authorization header

[Matt Behrens]

--3V7upXqbjpZ4EhLz
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Bug Day I fixed this:

http://cvs.zope.org/Zope/ZServer/FCGIServer.py.diff?r1=3D1.17&r2=3D1.18

Essentially, (IMO) FastCGI is broken and passes the Authorization
header as an environment variable called 'Authorization'.  This
allows pretty much any script, DTML, or other user-creatable object
to read the Basic auth password when FastCGI is used.

I think this is worth hotfixing.  It looks like I can make it work
back to 2.2.0 with no trouble.  Before 2.2.0 there was a lot of
work in FCGIServer; I am not entirely sure I can make a clean hotfix
for those versions.  I am also not convinced that is really a
problem. :-)

I will write the hotfix if it will be posted.

--=20
Matt Behrens <matt@zigg.com> <URL:http://zigg.com/>

--3V7upXqbjpZ4EhLz
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (OpenBSD)

iD8DBQE9XlNV+xq4JbgNGlMRAs87AKCp2mVRj05cjpT36T0uvGuzyQe8vgCfdJkp
HEy3QsQ8ArquEHQN0vL8Om8=
=zS34
-----END PGP SIGNATURE-----

--3V7upXqbjpZ4EhLz--