Disallow setting arg_ and cookie_ variables in Set Var module

vision5 · Oct 13, 2010 · d8e2750 · d8e2750
1 parent 2e48cd4
commit d8e2750
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/src/ndk_set_var.c b/src/ndk_set_var.c
@@ -285,6 +285,8 @@ ndk_set_var_name (ndk_set_var_info_t *info, ngx_str_t *varname)
     }
 
     if (v->get_handler == NULL
+        && ngx_strncasecmp(name.data, (u_char *) "arg_", 4) != 0
+        && ngx_strncasecmp(name.data, (u_char *) "cookie_", 7) != 0
         && ngx_strncasecmp(name.data, (u_char *) "http_", 5) != 0
         && ngx_strncasecmp(name.data, (u_char *) "sent_http_", 10) != 0
         && ngx_strncasecmp(name.data, (u_char *) "upstream_http_", 14) != 0)