HTTP_PROXY env var vulnerability

[chris]

See ​https://httpoxy.org/

[chris]

This vulnerability can be tested with using the Firefox ​Modify Headers and ​livehttpheaders add ons.

I assume it isn't worth fixing PuffinServer as this is probably due to be switched off as the site has been migrated off it?

On PenguinServer, this needs adding to all ngnix config for php:

fastcgi_param HTTP_PROXY "";

And for Trac:

proxy_set_header Proxy "";

And testing via ​https://penguin.transitionnetwork.org/info/php-info.php and all is good.

On ParrotServer the vulnerability was tested and was present so the following was added to /etc/apache2/apache2.conf:

RequestHeader unset Proxy early

And that fixed it.