Index: httpd-2.2.34/modules/proxy/mod_proxy_balancer.c
===================================================================
--- httpd-2.2.34.orig/modules/proxy/mod_proxy_balancer.c	2015-05-21 18:24:30.000000000 +0200
+++ httpd-2.2.34/modules/proxy/mod_proxy_balancer.c	2021-03-04 16:10:41.984017053 +0100
@@ -695,6 +695,18 @@ static int balancer_init(apr_pool_t *p,
     return OK;
 }
 
+/* Returns non-zero if the Referer: header value passed matches the
+ * host of the request. */
+static int safe_referer(request_rec *r, const char *ref)
+{
+    apr_uri_t uri;
+
+    if (apr_uri_parse(r->pool, ref, &uri) || !uri.hostname)
+        return 0;
+
+    return strcmp(uri.hostname, ap_get_server_name(r)) == 0;
+}
+
 /* Manages the loadfactors and member status
  */
 static int balancer_handler(request_rec *r)
@@ -707,7 +719,7 @@ static int balancer_handler(request_rec
     apr_table_t *params = apr_table_make(r->pool, 10);
     int access_status;
     int i, n;
-    const char *name;
+    const char *name, *ref;
 
     /* is this for us? */
     if (strcmp(r->handler, "balancer-manager"))
@@ -745,6 +757,15 @@ static int balancer_handler(request_rec
         apr_table_clear(params);
     }
 
+    /* Ignore parameters if this looks like XSRF */
+    ref = apr_table_get(r->headers_in, "Referer");
+    if (apr_table_elts(params)
+        && (!ref || !safe_referer(r, ref))) {
+        ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r->server,
+                      "ignoring params in balancer-manager cross-site access");
+        apr_table_clear(params);
+    }
+
     if ((name = apr_table_get(params, "b")))
         bsel = ap_proxy_get_balancer(r->pool, conf,
             apr_pstrcat(r->pool, "balancer://", name, NULL));
@@ -853,7 +874,7 @@ static int balancer_handler(request_rec
                 "<th>StickySession</th><th>Timeout</th><th>FailoverAttempts</th><th>Method</th>"
                 "</tr>\n<tr>", r);
             if (balancer->sticky) {
-                ap_rvputs(r, "<td>", balancer->sticky, NULL);
+                ap_rvputs(r, "<td>", ap_escape_html(r->pool, balancer->sticky), NULL);
             }
             else {
                 ap_rputs("<td> - ", r);
@@ -914,7 +935,7 @@ static int balancer_handler(request_rec
         ap_rputs("<hr />\n", r);
         if (wsel && bsel) {
             ap_rputs("<h3>Edit worker settings for ", r);
-            ap_rvputs(r, wsel->name, "</h3>\n", NULL);
+            ap_rvputs(r, ap_escape_uri(r->pool, wsel->name), "</h3>\n", NULL);
             ap_rvputs(r, "<form method=\"GET\" action=\"", NULL);
             ap_rvputs(r, ap_escape_uri(r->pool, r->uri), "\">\n<dl>", NULL);
             ap_rputs("<table><tr><td>Load factor:</td><td><input name=\"lf\" type=text ", r);
@@ -940,7 +961,7 @@ static int balancer_handler(request_rec
             ap_rvputs(r, "</table>\n<input type=hidden name=\"w\" ",  NULL);
             ap_rvputs(r, "value=\"", ap_escape_uri(r->pool, wsel->name), "\">\n", NULL);
             ap_rvputs(r, "<input type=hidden name=\"b\" ", NULL);
-            ap_rvputs(r, "value=\"", bsel->name + sizeof("balancer://") - 1,
+            ap_rvputs(r, "value=\"", ap_escape_html(r->pool, bsel->name + sizeof("balancer://") - 1),
                       "\">\n", NULL);
             ap_rvputs(r, "<input type=hidden name=\"nonce\" value=\"", 
                       balancer_nonce, "\">\n", NULL);
Index: httpd-2.2.34/modules/proxy/mod_proxy_ftp.c
===================================================================
--- httpd-2.2.34.orig/modules/proxy/mod_proxy_ftp.c	2017-01-05 19:56:13.000000000 +0100
+++ httpd-2.2.34/modules/proxy/mod_proxy_ftp.c	2021-03-04 16:31:34.655192184 +0100
@@ -861,8 +861,9 @@ static int proxy_ftp_handler(request_rec
     /* We break the URL into host, port, path-search */
     if (r->parsed_uri.hostname == NULL) {
         if (APR_SUCCESS != apr_uri_parse(p, url, &uri)) {
-            return ap_proxyerror(r, HTTP_BAD_REQUEST,
-                apr_psprintf(p, "URI cannot be parsed: %s", url));
+            ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r->server,
+                          "URI cannot be parsed: %s", url);
+            return ap_proxyerror(r, HTTP_BAD_REQUEST, "URI cannot be parsed");
         }
         connectname = uri.hostname;
         connectport = uri.port;
Index: httpd-2.2.34/modules/proxy/proxy_util.c
===================================================================
--- httpd-2.2.34.orig/modules/proxy/proxy_util.c	2017-01-07 14:00:39.000000000 +0100
+++ httpd-2.2.34/modules/proxy/proxy_util.c	2021-03-04 16:10:41.984017053 +0100
@@ -509,11 +509,7 @@ PROXY_DECLARE(int) ap_proxyerror(request
 {
     apr_table_setn(r->notes, "error-notes",
     apr_pstrcat(r->pool,
-        "The proxy server could not handle the request "
-        "<em><a href=\"", ap_escape_html(r->pool, r->uri),
-        "\">", ap_escape_html(r->pool, r->method),
-        "&nbsp;",
-        ap_escape_html(r->pool, r->uri), "</a></em>.<p>\n"
+        "The proxy server could not handle the request<p>"
         "Reason: <strong>",
         ap_escape_html(r->pool, message),
         "</strong></p>", NULL));
Index: httpd-2.2.34/modules/http/http_protocol.c
===================================================================
--- httpd-2.2.34.orig/modules/http/http_protocol.c	2011-09-08 17:59:38.000000000 +0200
+++ httpd-2.2.34/modules/http/http_protocol.c	2021-03-04 16:18:08.506574666 +0100
@@ -899,13 +899,10 @@ static const char *get_canned_error_stri
                            "\">here</a>.</p>\n",
                            NULL));
     case HTTP_USE_PROXY:
-        return(apr_pstrcat(p,
-                           "<p>This resource is only accessible "
-                           "through the proxy\n",
-                           ap_escape_html(r->pool, location),
-                           "<br />\nYou will need to configure "
-                           "your client to use that proxy.</p>\n",
-                           NULL));
+        return("<p>This resource is only accessible "
+               "through the proxy\n"
+               "<br />\nYou will need to configure "
+               "your client to use that proxy.</p>\n");
     case HTTP_PROXY_AUTHENTICATION_REQUIRED:
     case HTTP_UNAUTHORIZED:
         return("<p>This server could not verify that you\n"
@@ -922,30 +919,20 @@ static const char *get_canned_error_stri
                                   "</p>\n"));
     case HTTP_FORBIDDEN:
         return(apr_pstrcat(p,
-                           "<p>You don't have permission to access ",
-                           ap_escape_html(r->pool, r->uri),
-                           "\non this server.</p>\n",
+                           "<p>You don't have permission to access on this server.</p>\n",
                            NULL));
     case HTTP_NOT_FOUND:
         return(apr_pstrcat(p,
-                           "<p>The requested URL ",
-                           ap_escape_html(r->pool, r->uri),
-                           " was not found on this server.</p>\n",
+                           "<p>The requested URL was not found on this server.</p>\n",
                            NULL));
     case HTTP_METHOD_NOT_ALLOWED:
         return(apr_pstrcat(p,
-                           "<p>The requested method ",
-                           ap_escape_html(r->pool, r->method),
-                           " is not allowed for the URL ",
-                           ap_escape_html(r->pool, r->uri),
-                           ".</p>\n",
+                           "<p>The requested method is not allowed for this URL.</p>\n",
                            NULL));
     case HTTP_NOT_ACCEPTABLE:
         s1 = apr_pstrcat(p,
                          "<p>An appropriate representation of the "
-                         "requested resource ",
-                         ap_escape_html(r->pool, r->uri),
-                         " could not be found on this server.</p>\n",
+                         "requested resource could not be found on this server.</p>\n",
                          NULL);
         return(add_optional_notes(r, s1, "variant-list", ""));
     case HTTP_MULTIPLE_CHOICES:
@@ -958,18 +945,13 @@ static const char *get_canned_error_stri
                          NULL);
         return(add_optional_notes(r, s1, "error-notes", "</p>\n"));
     case HTTP_PRECONDITION_FAILED:
-        return(apr_pstrcat(p,
-                           "<p>The precondition on the request "
-                           "for the URL ",
-                           ap_escape_html(r->pool, r->uri),
-                           " evaluated to false.</p>\n",
-                           NULL));
+        return("<p>The precondition on the request "
+               "for this URL evaluated to false.</p>\n");
     case HTTP_NOT_IMPLEMENTED:
         s1 = apr_pstrcat(p,
                          "<p>",
-                         ap_escape_html(r->pool, r->method), " to ",
-                         ap_escape_html(r->pool, r->uri),
-                         " not supported.<br />\n",
+                         ap_escape_html(r->pool, r->method), " ",
+                         " not supported for current URL.<br />\n",
                          NULL);
         return(add_optional_notes(r, s1, "error-notes", "</p>\n"));
     case HTTP_BAD_GATEWAY:
@@ -977,29 +959,19 @@ static const char *get_canned_error_stri
             "response from an upstream server.<br />" CRLF;
         return(add_optional_notes(r, s1, "error-notes", "</p>\n"));
     case HTTP_VARIANT_ALSO_VARIES:
-        return(apr_pstrcat(p,
-                           "<p>A variant for the requested "
-                           "resource\n<pre>\n",
-                           ap_escape_html(r->pool, r->uri),
-                           "\n</pre>\nis itself a negotiable resource. "
-                           "This indicates a configuration error.</p>\n",
-                           NULL));
+        return("<p>A variant for the requested "
+               "resource\n<pre>\n"
+               "\n</pre>\nis itself a negotiable resource. "
+               "This indicates a configuration error.</p>\n");
     case HTTP_REQUEST_TIME_OUT:
         return("<p>Server timeout waiting for the HTTP request from the client.</p>\n");
     case HTTP_GONE:
-        return(apr_pstrcat(p,
-                           "<p>The requested resource<br />",
-                           ap_escape_html(r->pool, r->uri),
-                           "<br />\nis no longer available on this server "
-                           "and there is no forwarding address.\n"
-                           "Please remove all references to this "
-                           "resource.</p>\n",
-                           NULL));
+        return("<p>The requested resource is no longer available on this server"
+               " and there is no forwarding address.\n"
+               "Please remove all references to this resource.</p>\n");
     case HTTP_REQUEST_ENTITY_TOO_LARGE:
         return(apr_pstrcat(p,
-                           "The requested resource<br />",
-                           ap_escape_html(r->pool, r->uri), "<br />\n",
-                           "does not allow request data with ",
+                           "The requested resource does not allow request data with ",
                            ap_escape_html(r->pool, r->method),
                            " requests, or the amount of data provided in\n"
                            "the request exceeds the capacity limit.\n",
