Skip to content

Omit the version number from headers and HTML responses#543

Merged
rofl0r merged 2 commits intotinyproxy:masterfrom
jpmckinney:no-version-disclosure
Jun 20, 2024
Merged

Omit the version number from headers and HTML responses#543
rofl0r merged 2 commits intotinyproxy:masterfrom
jpmckinney:no-version-disclosure

Conversation

@jpmckinney
Copy link
Copy Markdown
Contributor

@jpmckinney jpmckinney commented Jun 18, 2024

closes #542

I haven't written C or Perl in over a decade, but I think I got it (assuming tests pass).

I don't know what effect this line has, so I left it:

add_error_variable (connptr, "version", VERSION);

Edit: Aha, I think this fills in the version variable in the HTML templates. I can delete the {version} from the HTML templates and leave this variable (in case users want to customize the templates to add the version back) – or I can delete both (meaning users can't restore the variable), or I can not do anything (requiring users to edit templates to prevent disclosure of the version).

@rofl0r
Copy link
Copy Markdown
Contributor

rofl0r commented Jun 19, 2024

I can delete the {version} from the HTML templates and leave this variable (in case users want to customize the templates to add the version back)

that sounds like the best option, indeed.
i'm gonna click on approve already so the CI test kicks in on the changes you've already done.

@jpmckinney
Copy link
Copy Markdown
Contributor Author

Cool, I made the commit :)

@rofl0r rofl0r merged commit d652ed8 into tinyproxy:master Jun 20, 2024
@jpmckinney jpmckinney deleted the no-version-disclosure branch August 6, 2024 18:24
@jpmckinney
Copy link
Copy Markdown
Contributor Author

Thanks @rofl0r - just curious what the release cadence is?

@rofl0r
Copy link
Copy Markdown
Contributor

rofl0r commented Aug 7, 2024

a click on the releases tab should answer your question. it's typically > 12 months.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Option to disable disclosure of version via header and templates?

2 participants