CHANGES

     in the access log. Problem reported on news group by Jerry Baker.
     [Bill Stoddard]

  *) Fix segfault when reporting this type of syntax error:
     "</container> without matching <container> section", where
     container is VirtualHost or Directory or whatever.
     [Jeff Trawick]

  *) SECURITY: CAN-2000-1204 (cve.mitre.org)
     Prevent the source code for CGIs from being revealed when 
     using mod_vhost_alias and the CGI directory is under the document root
     and a user makes a request like http://www.example.com//cgi-bin/cgi
     as reported in <news:960999105.344321 ernani.logica.co.uk>
     [Tony Finch]

  *) Add support for the new Beos NetwOrking Environment (BONE)
     [David Reid]

  *) xlate: ap_xlate_conv_buffer() now tells the caller when the
     final input char is incomplete; ap_bwrite_xlate() now handles
     incomplete final input chars.  [Jeff Trawick]

  *) Yet another update to saferead/halfduplex stuff -- need to ensure
     that a bhalfduplex call occurs before logging or else DNS and
     such can delay the last packet of the response.  [Dean Gaudet]

  *) Some syscall reduction in APR on unix -- don't seek when setting
     up an mmap; and don't fcntl() more than once per socket.
     [Dean Gaudet]

  *) When mod_cgid is started as root, the cgi daemon now switches 
     to the configured User/Group (like other httpd processes) 
     instead of continuing as root.  [Jeff Trawick]

  *) The prefork MPM now uses an APR lock for the accept() mutex.
     It has not been getting a lock at all recently.  httpd -V now 
     displays APR's selection of the lock mechanism instead of the 
     symbols previously respected by prefork.  [Jeff Trawick]

  *) Change the mmap() feature test to check only for existence.
     The previous check required features not used by Apache.
     [Greg Ames]

  *) Fix a couple of bugs in mod_cgid:  The cgi arguments were
     sometimes mangled.  The len parm to accept() was not 
     initialized, leading sometimes to an endless loop of failed
     accept() calls on OS/390 and anywhere else that failed the call
     if the len was negative.  Use <sys/un.h> for struct sockaddr_un
     instead of declaring it ourselves to fix a compilation problem
     on Solaris.  [Jeff Trawick]

  *) Add Resource limiting code back into Apache 2.0. [Ryan Bloom]

  *) Fix zombie process problem with mod_cgi.  [Jeff Trawick]

  *) Port mod_mmap_static to 2.0.  Make it go faster.  [Greg Ames]

  *) Fix storage overlay when loading dsos.  Symptom: Apache dies at
     initialization if ALLOC_DEBUG is defined; no known symptom 
     otherwise.  [Jeff Trawick]

  *) Fix typo in configure script when checking for mod_so.  bash
     doesn't seem to have a problem but /bin/sh on Solaris does.
     Symptom: "./configure: test: unknown operator =="
     [Jeff Trawick]
   
  *) Rebind the Win32 NT and 9x services control into the MPM.  
     All console, WinNT SCM and Win9x pseudo-service control code is
     now wrapped within the WinNT MPM.
     [William Rowe]

  *) Make a copy of getenv("PATH") before storing for later use.  Some
     getenv() implementations use the same storage for successive calls.
     CGIs on OS/390 had a bad PATH due to this.  [Jeff Trawick]

  *) Server Tokens work in 2.0 again.  This also propogates the change
     to allow just the product name in the server string using
     PRODUCT_ONLY.
     [Ryan Bloom]

Changes with Apache 2.0a4

  *) EBCDIC: Rearrange calls to ap_checkconv() so that most handlers
     won't need to call it.  [Greg Ames, Jeff Trawick]

  *) Move pre_config hook call to between configuration read and config
     tree walk.  This allows all modules to implement pre_config hooks
     and know that they will be called at an appropriate time.
     [Ryan Bloom] 

  *) mod_cgi, mod_cgid: Make ScriptLog directive work again.  
     [Jeff Trawick]

  *) Add pre-config hooks back to all modules.
     [Ryan Bloom]

  *) Fix a SIGSEGV in ap_md5digest(), which is used when you have
     ContentDigest enabled and we can't/don't mmap the file. 
     [Jeff Trawick]

  *) We now report the correct line number for syntax errors in config
     files.  [Ryan Bloom, Greg Stein, Jeff Trawick]

  *) Brought mod_auth_digest up to synch with 1.3, fixed ap_time_t-
     related bugs, and changed shmem/locking to use apr API. Shared-mem
     is currently disabled, however, because of problems with graceful
     restarts. [Ronald Tschalär]

  *) Fix corruption of IFS variable in --with-module= handling.  
     Depending on the user's shell or customization thereof, there 
     would be errors generating ap_config_auto.h later in the configure
     procedure.  [Jeff Trawick]

  *) mod_cgi: Restore logging of stderr from child process when ScriptLog 
     isn't used (as in 1.3), except that on Unix it is now logged via 
     ap_log_rerror() instead of by the child having STDERR_FILENO refer
     to the error log.  [Greg Ames, Jeff Trawick]

  *) Add '-D' argument processing for run time configuration defines.
     [William Rowe]

  *) Organize http_main.c as independent code, such that no code or
     global data is exported from it.  WIN32 will dynamically link it
     to the server core, so this will prevent mutual dependency.
     [William Rowe]

  *) Add separate dynamic linkage tags APR_EXPORT(), APR_EXPORT_NONSTD()
     and APR_VAR_EXPORT to correctly resolve apr functions and globals.
     [William Rowe]

  *) Add Win9x service execution and Ctrl+C/Ctrl+Break/Shutdown handlers.
     [William Rowe, Jan Just Keijser <KEIJSERJJ logica.com>]

  *) Add mod_charset_lite for configuring character set translation.
     [Jeff Trawick]

  *) Add '-n' option to htpasswd to make it print its user:pw record
     on stdout rather than having to frob a text file.  [Ken Coar]

  *) Fix saferead.  Basically, we flush the output buffer if a read on the
     input will block.
     [Ryan Bloom]
 
  *) APR: Add ap_xlate_get_sb() so that an app can find out whether or not
     a conversion is single-byte only. [Jeff Trawick]

  *) BEOS: ap_shutdown should return APR_SUCCESS or errno. Note that
     the BeOS 5.0 documentation says that shutdown doesn't work yet.
     [Roy Fielding]

  *) Fix some minor errors where pid was being manipulated as an int
     instead of the portable pid_t.  [Roy Fielding]

  *) Fix some error log prints that were printing the pointer to a
     structure rather than the pid within the structure.
     [Jeff Trawick, Roy Fielding]

  *) ab: Fix a command-line processing bug; track bad headers in 
     err_response; support reading headers up to 2K. 
     [Ask Bjoern Hansen <ask valueclick.com>]

  *) Fix ap_resolve_env() so that it handles new function added in a prior
     alpha (see "Added the capability to do ${ENVVAR} constructs in the
     config file.") as well as the constructs used by mod_rewrite.
     [Paul Reder <rederpj raleigh.ibm.com>]

  *) Apache 2.0 builds and runs on OS/390. [Jeff Trawick, Greg Ames]

  *) Change the EBCDIC support in functions for MD5, SHA1, and base 64 to use
     APR to perform translation, instead of accessing the hard-coded tables
     in 1.3's ebcdic.c. [Jeff Trawick]

  *) Fix some bugs (mostly lost 1.3 code) in ab's command-line processing. 
     [Jeff Trawick]

  *) Add the ability to hook into the config file reading phase.  Basically
     if a directive is specified EXEC_ON_READ, then when that directive is
     read from the config file, the assocaited function is executed.  This
     should only be used for those directives that must muck with HOW the
     server INTERPRETS the config.  This should not be used for directives
     that re-order or replace items in the config tree.  Those changes should
     be made in the pre-config step.
     [Ryan Bloom]

  *) Add mod_example to the build system.
     [Tony Finch]

  *) APR: Add ap_xlate_conv_byte() to convert one char between single-
     byte character sets. [Jeff Trawick]

  *) Pick up various EBCDIC fixes from 1.3 (from Martin
     Kraemer and Oliver Reh originally according to the change log).
     [Jeff Trawick]

  *) Fix a couple of problems in RFC1413 support (controlled by the
     IdentityCheck directive).  Apache did not build the request string
     properly and more importantly Apache would loop forever if the 
     would-be ident server dropped the connection before sending a
     properly terminated response. [Jeff Trawick]

  *) apxs works in 2.0.
     [Ryan Bloom]

  *) Reliable piped logs work in 2.0.
     [Ryan Bloom]

  *) Introduce a hash table implementation into APR to be used for
     replacing tables and other random data structures in Apache.
     [Tony Finch]

  *) Add some more error reporting to htpasswd in the case of problems
     generating or accessing the temporary file.  Also, pass in a
     buffer if the implementation knows how to use it (i.e., if L_tmpnam
     is defined).  [Ken Coar]

  *) Configure creates config.nice now containing your configure
     options. Syntax: ./config.nice [--more-options]
     [Sascha Schumann]

  *) Fix various return code problems in APR on Win32.  For most of
     these, APR was returning APR_EEXIST instead of GetLastError()/
     WSAGetLastError().  [Jeff Trawick]

  *) Make piped logs work again in version 2.0
     [Ryan Bloom]

  *) Add VPATH support to UNIX build system of Apache and APR.
     [Sascha Schumann]

  *) Fix ap_tokenize_to_argv to respect the const arguments that are
     passed to it.
     [Ryan Bloom]

  *) Fix mm's memcpy/memset macros, pointer arithmetic was broken.
     Patch submitted to author.
     [Sascha Schumann]

  *) Fix mm configuration on Solaris 8 x86 and OS/390.  Don't require
     /sbin in PATH on FreeBSD (all submitted to rse previously) 
     [Jeff Trawick]

  *) Fix building Pthread-based MPMs on OpenBSD
     [Sascha Schumann] PR#26

  *) Fix ap_readdir() problem on systems where d_name[] field in
     struct dirent is declared with only one byte.  (This problem only 
     affected multithreaded builds.)  This caused a segfault during
     pool cleanup with mod_autoindex on Solaris (Solaris 8 x86, at 
     least). [Jeff Trawick]

  *) Fix some make-portability problems on at least Tru64, Irix
     and UnixWare.
     [Sascha Schumann] PR#18, PR#39

  *) Add ap_sigwait() to support old-style sigwait() on systems
     like OS/390 and UnixWare.
     [Sascha Schumann] 

  *) Add POSIX-thread flags for more platforms.
     [Sascha Schumann]

  *) Fix some minor bugs in ap_strerror().  Teach ap_strerror()
     (on Unix, at least) to handle resolver errors.  Fix a bug in
     the definition of APR_ENOMEM so that ap_strerror() can spit
     out the correct error message for it.
     [Jeff Trawick]

Changes with Apache 2.0a3

  *) mod_so reports ap_os_dso_error() if ap_dso_load() fails
     [Doug MacEachern]

  *) API: *HOOK* macros now have an AP_ prefix
     [Doug MacEachern]

  *) Win32: Eliminate redundant calls to initialize winsock.
     [Tim Costello <timcostello ozemail.com.au>]

  *) Fix bugs initializing ungetchar for pipes. 
     [Chia-liang Kao <clkao CirX.ORG>]

  *) The ab program in the src/support directory is now portable using
     APR.
     [Ryan Bloom]

  *) Support directory is being compiled when the server is built
     [Ryan Bloom]

  *) The configure option --with-program-name has been added to allow
     developers to rename the executable at configure time.  This also
     changes the name of the config files to match the executable's name.
     [Ryan Bloom]

  *) mod_autoindex: Add `IndexOptions +VersionSort', to nicely sort filenames
     containing version numbers. [Martin Pool]

  *) ap_open(..,APR_OS_DEFAULT,..) uses perms 0666 instead of 0777 on
     Unix; access_log and error_log now created with these perms; non-
     Unix is unaffected [Jeff Trawick]
     
  *) Finished move of ap_md5 routines to apr_md5.  Removed ap_md5.h.
     Replaced more magic numbers with MD5_DIGESTSIZE.
     [William Rowe, Roy Fielding]

  *) Win32: Get mod_auth_digest compiling and added to the Windows
     build environment. Not tested and I'd be suprised if it 
     actually works. [Bill Stoddard]

  *) Revamp the Win32 make environment. Makefiles have been removed and
     Apache.dsw created to bring together all the pieces. Create new file
     os/win32/BaseAddr.ref to define module base addresses (to prevent
     dll relocation at start-up).
     [William Rowe, Greg Marr, Tim Costello, Bill Stoddard]

  *) [EBCDIC] Port Paul Gilmartin's CRLF patch from 1.3.  This replaces most
     of the \015, \012, and \015\012 constants with macros.
     [Greg Ames]
     
  *) Add ap_xlate_open() et al for translation of text between different 
     character sets.  The initial implementation requires iconv().
     [Jeff Trawick]

  *) More FAQs and answers from comp.infosystems.www.servers.unix.
     [Joshua Slive <slive finance.commerce.ubc.ca>]

  *) CGI output is being timed out now.
     [Ryan Bloom]

  *) Fix the problem with dieing quietly.  dupfile now takes a pool which
     is used by the new apr file.  There is no reason to create a new file
     with the same lifetime as the original file.
     [Ryan Bloom] 

  *) Win32: Attempt to eliminate dll relocation at start-up by specifying
     module base addresses. This will help shooting seg faults
     in the field. [William Rowe <wrowe lnd.com>]

  *) Update Apache on Windows documentation. Add new document
     describing how to compile Apache on Windows.
     [William Rowe <wrowe lnd.com>]

  *) ap_set_pipe_timeout(), ap_poll(), and APR_SO_TIMEOUT now take 
     microseconds instead of seconds.  Some storage leaks and other
     minor bugs in related code were fixed.  [Jeff Trawick]

  *) Win32: First cut at getting mod_isapi working under 2.0
     [William Rowe <wrowe lnd.com>]

  *) First stab at getting mod_auth_digest working under 2.0
     quick change summary:
     - moved the random byte generation (ap_generate_random_bytes) into APR
     - now uses ap_time_t
     - compiles and runs on linux
     - tested with amaya
     [Brian Martin <bmartin penguincomputing.com>]

  *) Win32: Move the space stripping of physical service names
     fix up from Apache 1.3. #include'ing "ap_mpm.h" fixes up an
     unresolved symbol. Add dependency checking to the
     CreateService call to ensure TCPIP and AFP (winsock) is started
     before Apache.
     [William Rowe <wrowe lnd.com>]

  *) Win32: Add code to perform latebinding on functions that may
     not exist on all levels of Windows where Apache runs. This
     is needed to allow Apache to start-up on Win95/98. All calls
     to non portable functions should be protected with
     ap_oslevel checks to prevent runtime segfaults. 
     [William Rowe <wrowe lnd.com>]

  *) Fix fallback default values for SHM_R and SHM_W [Martin Kraemer]

  *) Get lingering_close() working again. [Dean Gaudet, Jeff Trawick]

  *) Win32: Get non-blocking CGI pipe reads working under Windows NT.
     This addresses PR 1623. Still need to address timing out runaway
     CGI scripts. [Bill Stoddard]
 
  *) Win32: Make ap_stat Windows 95/98 friendly
     [William Rowe <wrowe lnd.com>]                                            

  *) Win32: Fix a bug in ap_get_oslevel which causes GetVersionEx() to 
     always fail. Need to initialise the dwOSVersionInfoSize member of the 
     OSVERSIONINFO struct before calling GetVersionEx, so GetVersionEx 
     always fails. 

     The patch also enhances ap_get_oslevel (and the associated enum) to 
     handle selected service packs for NT4, and adds recognition for 
     Windows 2000. This is useful, eg. if we can recognise NT4 SP2 then 
     we can use ReadFileScatter and WriteFileGather in readwrite.c. 
     [Tim Costello <Tim.Costello BTFinancialgroup.com>]

  *) Get mod_rewrite building and running, and mod_status building for Win NT
     [Allan Edwards <ake raleigh.ibm.com>]

  *) Patch to port mod_auth_db to the 2.0 api and also to support 
     Berlekey DB 3.0. It works for me with both Berkeley DB 3.0.55 and 
     2.7.7.  It should work with version 1 as well but I haven't tested it.  
     [Brian Martin <bmartin penguincomputing.com>]

  *) Get APR DSO code working under Windows. Includes cross platform
     fixes to mod_so.c.
     [<Tim.Costello BTFinancialgroup.com>]

  *) Fix some of the Windows APR time functions.
     [William Rowe]

  *) FAQ changes related to tidying up historical documents on the web site.
     [Joshua Slive <slive finance.commerce.ubc.ca>]

  *) Move Windows DSO code into APR.
     [Bill Stoddard]

  *) Eliminate apr_win.h and apr_winconfig.h (and the ugly #ifdefs they cause).
     Now, apr.h and apr_config.h are generated from apr.hw and apr_config.hw
     at build time. At this point, the server will not compile on Windows because
     of the recent DSO commits. Fixing those next.
     [Bill Rowe & Bill Stoddard]

  *) Added error checking for file I/O APR routines.
     [Jon Travis <jtravis covalent.net>]

  *) APR: Don't use the values of resolver error codes for the 
     corresponding APR error codes.  On Unix and Win32, return the 
     proper APR error code after a resolver error. [Jeff Trawick]

Changes with Apache 2.0a2

  *) Renamed the executable back to httpd on all platforms other 
     than Win32
     [Ryan Bloom]

  *) Allow BeOS to survive restarts, log properly and a few
     small things it had problems with due to the way it setup
     users and groups. [David Reid]

  *) Get mod_rewrite working with APR locks
     [Paul Reder <rederpj raleigh.ibm.com>]

  *) Actually remove the sempahore when the lock cleanup routine
     is called on BeOS. [David Reid]

  *) Clear hook registrations between reads of the config file.
     When DSOs are unloaded and re-loaded the old hook pointers may
     no longer be valid. This fix eliminates potential segfaults.
     [Allan Edwards <ake raleigh.ibm.com>]

  *) Fix a problem with Sigfunc not being defined or bypassed
     if sigaction() wasn't found. [Jim Jagielski]

  *) Fix the locking mechanism on BSD variants.  They now use fcntl
     locks.  This allows the server to start and serve pages.
     [Ryan Bloom]

  *) First cut at getting the Win32 installer to work
     [William Rowe <wrowe lnd.com>]

  *) Get htpasswd compiling under Windows
     [William Rowe <wrowe lnd.com>]

  *) Change the log message for a bind() failure to show the
     interface and port number. [Jeff Trawick]

  *) Import the documentation from 1.3.12 and bring parts of it
     up-to-date with respect to the changes that have occurred
     in 2.0.
     [Tony Finch]

  *) BeOS MPM updated.  CGI bug on BeOS fixed.  IP addresses
     now logged correctly on BeOS.
     [David Reid]

  *) Create one makefile for all Win32 distributions (NT/2000/95/98).
     Makefile.win includes the same user interface as the old 
     Makefile.nt 
     [William Rowe <wrowe lnd.com>, Jeff Trawick <trawick us.ibm.com>]

  *) Win32 exec now uses COMSPEC environment string for command 
     shell path resolution.
     [William Rowe <wrowe lnd.com>] PR#3715

  *) Win32: ap_connect() was not returning correct error condition
     PR5866
     [Allen Prescott <allen clanprescott.com>]

  *) Win32: ap_open() was broken on Win9x because an NT-specific
     flag was passed to CreateFile.  ap_puts() added an unnecessary
     '\n'.
     [Jeff Trawick <trawick us.ibm.com>]

  *) Put in Korean and Norwegian index.html pages (2.0 and 1.3)
     which where donated by Lee Kuk Hyun and Lorant Czaran. 'Fixed'
     confusing ee/et name and made all extensions language/dialect
     rather than country reflecting. Changed example files to
     explicit reflect the ISO charset and added a few common 
     ones to the example config [dirkx]

  *) Extend external module capability.  To use this, you call
     configure with --with-module=path/to/mod1,path/to/mod2,etc.
     [Ryan Bloom]

  *) Backported the various "default charset" fixes from 1.3.12,
     including the AddDefaultCharset directive. [Jim Jagielski]

  *) Added the capability to do ${ENVVAR} constructs in the
     config file. E.g. 'ServerAdmin ${POSTMASTER}'. As commited
     it does this on a line by line basis; i.e. if the envvar
     expands to something with spaces you have to protect it
     by adding quotes around it (Unless of course you expect it
     to contains more than one argument. Alternatively you
     can compile it on a per token basis; which is what people
     usually expect by setting RESOLVE_ENV_PER_TOKEN. But this
     hampers fancier hacks.
     [Dirk-Willem van Gulik]

  *) Changed the 'ErrorDocument' syntax in that it NO longer
     supports the asymetric

                ErrorDocument 301 "Some message

     Note the opening " quote, without a closing quote. It now
     has either the following syntaxes

                ErrorDocument XXX /local/uri
                ErrorDocument XXX http://valid/url
                ErrorDocument XXX "Some Message"

     The recognition heuristic is: if it has a space it
     is a message. If it has no spaces and starts with a /
     or is a valid URL then treat it that way. Otherwise it
     is assumed to be a message.

     This breaks backward compatibility but makes live a hell
     of a lot easier for GUI's and config file parsers.
     [Dirk-Willem van Gulik]

  *) Changed 'CacheNegotiatedDocs' from its present/not-present
     syntax into a 'on' or 'off' syntax. As it currently is the
     only non nesting token which uses NO_ARGS and thus is an
     absolute pain for any config interface automation. This
     breaks backward compatibility. [Dirk-Willem van Gulik]

  *) Add ability to add external modules to the build process.  This is
     done with --with-module=/path/to/module.  Modules can only be added
     as static modules at this point.
     [Ryan Bloom]

Changes with Apache 2.0a1

  *) Fix FreeBSD 3.3 core dump.
     Basically, ap_initialize() needs to get called before 
     create_process(), since create_process() passes op_on structure
     to semop() to get a lock, but op_on isn't initialized until 
     ap_initialize() calls setup_lock().  Here is a slight
     rearrangement to main() which calls ap_initialize() earlier...
     [Jeff Trawick <trawick us.ibm.com>]

  *) Enable Apache to use sendfile/TransmitFile API
     [Bill Stoddard, David Reid, Paul Reder]

  *) Re-Implement Win32 APR network I/O APIs and most of the file I/O
     APIs.
     [Bill Stoddard]

  *) Make file I/O and network I/O writev/sendv APIs consistent.
     Eliminate use of ap_iovec_t and use Posix struct iovec.
     Use seperate variable on ap_writev to set the number of iovecs
     passed in and number of bytes written.
     [Bill Stoddard]

  *) Adapt file iol to use APR functions. Replaced ap_open_file() 
     with ap_create_file_iol(). ap_create_file_iol() requires that 
     the file be opened prior to the call using ap_open().
     [Bill Stoddard]

  *) Port mod_include and mod_cgi to 2.0
     [Paul Reder, Bill Stoddard]

  *) ap_send{,v}, ap_recv, ap_sendfile API clarification --
     bytes_read/bytes_written is always valid (never -1).  Plus
     some fixes to buff.c to correct problems introduced by the
     errno => ap_status_t changes a while back.  Plus a fix to
     chunked encoding introduced right at the beginning of 2.0.
     [Dean Gaudet]

  *) Revamped UNIX build system to use autoconf and libtool.
     [Manoj Kasichainula, Sascha Schumann]

  *) port mod_rewrite to 2.0. [Paul J. Reder <rederpj raleigh.ibm.com>]

  *) SECURITY: More rigorous checking of Host: headers to fix security 
     problems with mass name-based virtual hosting (whether using mod_rewrite
     or mod_vhost_alias).
     [Ben Hyde, Tony Finch]
  
  *) Add back support for UseCanonicalName in <Directory> containers.
     [Manoj Kasichainula]

  *) Added APLOG_STARTUP log type.  This allows us to write an error
     message without any of the date and time information.  As a part
     of this change, I also removed all of the calls to fprintf(stderr
     and replaced them with calls to ap_log_error using APLOG_STARTUP
     writing to stderr is no longer portable, because we don't direct 
     stderr to the error log on all platforms.
     [Ryan Bloom] 
 
  *) Convert error logging functions to take errno as an argument.
     This makes our error logs more portable, because some Windows API's 
     don't set errno.  This change allows us to still output a valid
     message on all of our platforms.
     [Ryan Bloom]

  *) mod_mime_magic runs in 2.0-dev now.
     [Paul Reder <rederpj raleigh.ibm.com>]

  *) sendfile has been added to APR.
     [John Zedlewski <zedlwski Princeton.EDU>]

  *) buff.c has been converted to no longer use errno.
     [Manoj Kasichainula]

  *) mod_speling runs in 2.0-dev now: a bug in readdir_r handling and
     interface adaption to APR functions did it. [Martin Kraemer]

  *) Support DSOs properly on 32-bit HP-UX 11.0
     [Dilip Khandekar <dilip cup.hp.com>]

  *) Updated MM in APR source tree from version 1.0.8 to 1.0.11
     [Ralf S. Engelschall]

  *) Cleaned APR build environment integration and bootstrap APR 
     automatically for developers from src/Configure.
     [Ralf S. Engelschall]

  *) Fixed building of src/support/htpasswd.c
     [Ralf S. Engelschall]

  *) When generating the Location: header, mod_speling forgot
     to escape the spelling-fixed uri. (Forw-Port from 1.3)
     [Martin Kraemer]

  *) Moved mod_auth_digest.c from experimental to standard. [Roy Fielding]

  *) Change all pools to APR contexts.  This is the first step to
     incorporating APR into Apache. [Ryan Bloom]

  *) Move "handler not found" warning message to below the check
     for a wildcard handler.  [Dirk <dirkm teleport.com>, Roy Fielding]
     PR#2584, PR#2751, PR#3349, PR#3436, PR#3548, PR#4384, PR#4795, PR#4807

  *) Support line-continuation feature in config.option file and
     allow the loading of multiple option sections at once via
     ``--with-option=<section1>,<section2>,...''
     [Ralf S. Engelschall]

  *) Rebuilt CVS repository with Apache 1.3.9 as basis.  [Roy Fielding]

Changes with Apache MPM

  *) Use asynchronous AcceptEx() and a completion port to accept and
     dispatch connections to threads in Windows NT/2000. 
     [Bill Stoddard]

  *) Implement WINNT Win32 MPM from original Win32 code in http_main.c
     [Bill Stoddard]  

  *) Implement the APACI --with-option facility 
     (per default used the config.option file).
     [Ralf S. Engelschall]

  *) MPM BEOS port.  [David Reid <abb37 dial.pipex.com>]

  *) Start to implement module-defined hooks that are a) fast and b) typesafe.
     Replace pre_connection module call with a register_hook call and
     implement pre_connection as a hook. The intent is that these hooks will
     be extended to allow Apache to be multi-protocol, and also to allow the
     calling order to be specified on a per-hook/per-module basis.
     [Ben Laurie]

  *) Implement mpm_* methods as "modules". Each method gets its own
     subdir in src/modules (eg: src/modules/prefork). Selection
     of method uses Rule MPM_METHOD.  [Jim Jagielski]

  *) Port the hybrid server from the apache-apr repository as
     mpm_mpmt_pthread.  [Manoj Kasichainula]

  *) os/unix/unixd.[ch]: detach, setuid, setgid, stuff which will be common
     amongst the unix MPMs.

  *) mpm_prefork: throw away all the alarm/timeout crud; and clean up the
     signal handling for the new world order.  [Dean Gaudet]

  *) Crude ap_thread_mutex abstraction so that we get the pthread stuff out
     of alloc.c for now.  [Dean Gaudet]

  *) Handle partial large writes correctly.  [Ben Laurie]

  *) Eliminate conn_rec's pointer to server. All it knows is the base server
     based on IP/port.  [Ben Laurie]

  *) Port a bunch of modules to the new module structure.
     ["Michael H. Voase" <mvoase midcoast.com.au>]

  *) I/O layering and BUFF revamp.  See docs/buff.txt.  [Dean Gaudet]

  *) Basic restructuring to introduce the MPM concept; includes various
     changes to the module API... better described by
     docs/initial_blurb.txt.  [Dean Gaudet]

Changes with Apache pthreads

  *) New buff option added: BO_TIMEOUT. It describes the timeout for
     buff operations (generally over a network).
     [Dean Gaudet, Ryan Bloom, Manoj Kasichainula]

  *) Created http_accept abstraction. Added 4 new functions (not exported):
     init_accept(), begin_accepting_requests(), get_request(), 
     stop_accepting_requests() [Bill Stoddard]

  *) Fix to ap_rprintf call that allows mod_info to work properly.
     [James Morris <jmorris intercode.com.au>]

  *) user and ap_auth_type fields were moved from connection_rec to 
     request_rec. [Ryan Bloom] 

  *) Removed the ap_block_alarms and ap_unblock_alarm calls.  These aren't
     needed in a threaded server.

  *) Initial pthread implementation from from Dean's apache-nspr code.
     [Bill Stoddard, Ryan Bloom]


Changes with Apache 1.3.9

  *) Remove bogus error message when a redirect doesn't set Location.
     Instead, use an empty string to avoid coredump if the error message
     was supposed to include a location.  [Roy Fielding]

  *) Don't allow configure to include mod_auth_digest unless it is
     explicitly requested, even if the user asked for all modules.
     [Roy Fielding]

  *) Translate module names to dll names for OS/2 so that they are no more
     than 8 characters long and have an extension of "dll" instead of "so".
     [Brian Havard]

  *) Print out pointer to Rule DEV_RANDOM when truerand lib not found.
     Fix test-compile check to check for randbyte instead of trand32.
     Use ap_base64encode_binary/decode instead of copy in mod_auth_digest.c
     and tweak to make Amaya happier.  [Ronald Tschalär]

  *) Ensure that the installed expat include files are world readable,
     just like the other header files.  [Martin Kraemer]

  *) Fixed generated AddModule adjustments in APACI's `configure' script
     in order to allow (new) modules like mod_vhost_alias to be handled
     correctly (which was touched by the adjustments for mod_alias).
     [Ralf S. Engelschall]

  *) For binary builds, add -R flag to apachectl to work around the lack of
     an absolute path to the ./libexec directory where the libhttp.ep file
     is needed for SHARED_CORE architectures.  [Randy Terbush]

  *) WIN32: Create the CGI script process as DETACHED.  This may solve the
     problem observed by some Win95/98 users where they get CGI script
     output sent to the console.  [Bill Stoddard]

  *) Fix (re)naming in the uuencode/decode section. The ap/ap_
     routines are now called ap_base64* and are 'plain' (i.e., no 
     pool access or anything clever). Inside util.c the routines acting
     like pstrdup are called ap_pbase64encode() and ap_pbase64decode().
     The oddly named ap_uuencode(), ap_uudecode() are kept around for
     now but deprecated.  [dirkx]

  *) Clean up the base64 and SHA1 additions and make sure they are
     represented in the ApacheCore.def, ApacheCoreOS2.def, and httpd.exp
     files.  [Roy Fielding]

  *) WIN32: Migrate to InstallShield 5.5 and provide a bit more error
     checking.  Allow compiling on VS 6.0.  [Randy Terbush]

  *) Fixed assumption of absolute paths in binbuild.sh.  [Tony Finch]

  *) Use TestCompile to search for the truerand library (rather than blindly
     assuming its existence). If it is not found, complain (but do not
     exit - yet).  [Martin Kraemer]

  *) We forgot to add the new exported function names to
     src/support/httpd.exp.  [Bill Stoddard, Randy Terbush]

  *) Add description of -T command-line option to usage().
     [Ralf S. Engelschall]

  *) For "some" platforms (notably, EBCDIC based ones), libos needs to be
     searched only AFTER libap has been searched, because libap needs
     some symbols from libos.  [Martin Kraemer]

  *) Fix conflict with original mod_digest related to the symbol of the
     module dispatch list (which has to be unique for DSO and follow the
     usual conventions for the installation procedure).
     [Ralf S. Engelschall]

  *) Add a dbm-library check for the "usual places" (-ldbm, -lndbm, -ldb)
     for other platforms as well.  [Martin Kraemer]

  *) Make ap_sha1.c compile for EBCDIC platforms: replace remaining LONG
     types by AP_LONG and replace reference to renamed variable 'ubuf'
     by 'buffer'.  [Martin Kraemer]

Changes with Apache 1.3.8 [not released]

  *) Flush the output buffer immediately after sending an error or redirect
     response, since the result may be needed by the client to abort a
     long data transfer or restart a series of pipelined requests.
     [Tom Vaughan <tvaughan aventail.com>, Roy Fielding]

  *) PORT: Improved compilation and DSO support on Sequent DYNIX/ptx.
     [Ian Turner <iant sequent.com>] PR#4735

  *) Local struct mmap in http_core.c conflicted with system structure
     name on DYNIX -- changed to mmap_rec.  [Roy Fielding] PR#4735

  *) Added updated mod_digest as modules/experimental/mod_auth_digest.
     [Ronald Tschalär <ronald innovation.ch>]

  *) Fix a memory leak where the module counts were getting messed
     up across restarts.  [David Harris <dharris drh.net>]

  *) CIDR addresses such as a.b.c.d/24 where d != 0 weren't handled
     properly in mod_access.
     ["Paul J. Reder" <rederpj raleigh.ibm.com>] PR#4770

  *) RewriteLock/RewriteMap didn't work properly with virtual hosts.
     [Dmitry Khrustalev <dima bog.msu.su>] PR#3874

  *) PORT: Support for compaq/tandem/com.
     [Michael Ottati <michael.ottati compaq.com>, dirkx]

  *) Added SHA1 password encryption support to easy migration from 
     Netscape servers. See support/SHA1 for more information.
     Caused the separation of ap_md5.c into md5, sha1 and a general
     ap_checkpass.c with just a validate_passwd routine. Added a
     couple of flags to support/htpasswd. Some reuse of the to64()
     function; hence renamed to ap_to64().
     [Dirk-Willem van Gulik, Clinton Wong <clintdw netcom.com>]

  *) Change for EBCDIC platforms (TPF and BS2000) to correctly deal
     with ASCII/EBCDIC conversions in "ident" query.
     [David McCreedy <McCreedy us.ibm.com>]

  *) Get rid of redefinition warning on MAC_OS_X_SERVER platform.
     Change "Power Macintosh" to Power* so if uname prints "Power Book"
     we're still happy on Rhapsody platforms.  [Wilfredo Sanchez]

  *) Fix SIGSEGV on some systems because the Vary fix below included
     a call to table_do with a variable argument list that was not
     NULL terminated.  Replaced with better implementation. [Roy Fielding]

Changes with Apache 1.3.7 [not released]

  *) The "Vary" response header field is now sanitised right before
     the header is sent back to the client.  Multiple "Vary" fields
     are combined, and duplicate tokens (e.g., "Vary: host, host" or
     "Vary: host, negotiate, host, accept-language") are reduced to
     single instances.  This is a better solution than the force-no-vary
     one (which is still valid for clients that can't cope with Vary
     at all).  PR#3118 [Dean Gaudet, Roy Fielding, Ken Coar]

  *) Portability changes for BeOS. [David Reid <abb37 dial.pipex.com>]

  *) Link DSO's with "gcc -shared" instead of "ld -Bshareable" at 
     least on Linux and FreeBSD for now.  
     [Rasmus Lerdorf]

  *) Win32: More apache -k restart work. Restarts are now honored
     immediately and connections in the listen queue are -not- lost.
     This is made possible by the use of the WSADuplicateSocket()
     call.  The listeners are opened in the parent, duplicated, then
     the duplicates are passed to the child. The original listen sockets 
     are not closed by the parent across a restart, thus the listen queue 
     is preserved.
     [Bill Stoddard <stoddard raleigh.ibm.com>]

  *) Fix handling of case when a client has sent "Expect: 100-continue"
     and we are going to respond with an error, but get stuck waiting to
     discard the body in the pointless hope of preserving the connection.
     [Roy Fielding, Joe Orton <jeo101 york.ac.uk>] PR#4499, PR#3806

  *) Fix 'configure' to work correctly with SysV-based versions of
     'tr' (consistent with Configure's use as well). [Jim Jagielski]

  *) apxs: Add "-S var=val" option which allows for override of CFG_*
     built-in values. Add "-e" option which works like -i but doesn't
     install the DSO; useful for editing httpd.conf with apxs. Fix
     editing code so that multiple invocations of apxs -a will not
     create duplicate LoadModule/AddModule entries; apxs can now be
     used to re- enable/disable a module.  [Wilfredo Sanchez]

  *) Win32: Update the server to use Winsock 2. Specifically, link with
     ws2_32.lib rather than wsock32.lib.  This gives us access to 
     WSADuplcateSocket() in addition to some other enhanced comm APIs.
     Win 95 users may need to update their TCP/IP stack to pick up
     Winsock 2. (See http://www.microsoft.com/windows95/downloads/)
     [Bill Stoddard <stoddard raleigh.ibm.com>]

  *) Win32: Redirect CGI script stderr (script debug info) into the 
     error.log when CGI scripts fail. This makes Apache on Win32 
     behave more like Unix.      
     [Bill Stoddard <stoddard raleigh.ibm.com>]

  *) Fixed `httpd' usage display: -D was missing.
     [Ralf S. Engelschall] PR#4614

  *) Fix `make r' test procedure in src/regex/: ap_isprint was not found.
     [Ralf S. Engelschall] PR#4561, PR#4562

  *) OS/2: Fix problem with accept lock semaphores where server would die with
     "OS2SEM: Error 105 getting accept lock. Exiting!" 
     [Brian Havard] PR#4505

  *) Add DSO support for DGUX 4.x using gcc. Tested on x86 platforms.
     [Randy Terbush <randy covalent.net>]
 
  *) Add the new mass-vhost module (mod_vhost_alias.c) developed and
     used by Demon Internet, Ltd. [Tony Finch <fanf demon.net>]

  *) Better GCC detection for DSO flags under Solaris 2 where the `cc' 
     command potentially _is_ GCC. [Ralf S. Engelschall]

  *) Fix apxs build issues on AIX 
     [Rasmus Lerdorf <rasmus raleigh.ibm.com>]

  *) DocumentRoot Checking: Under previous versions, when Apache
     first started up, it used to do a stat of each DocumentRoot to
     see if it existed and was a directory. If not, then an error
     message was printed. THIS HAS BEEN DISABLED. If DocumentRoot
     does not exist, you will get error messages in error_log. If
     the '-t' command line option is used (to check the configuration)
     the check of DocumentRoot IS performed. An additional command
     line option, '-T', has been added if you want to avoid the
     DocumentRoot check even when checking the configuration.
     [Jim Jagielski]

  *) Win32: The query switch "apache -S" didn't exit after showing the
     vhost settings. That was inconsistent with the other query functions.
     [Bill Stoddard - Fixed by Martin on Unix in 1.3.4]

  *) Win32: Changed behaviour of apache -k restart. 
     Previously, the server would drain all connections in the stack's
     listen queue before honoring the restart. On a busy server, this
     could take hours.  Now, a restart is honored almost immediately. 
     All connections in Apache's queues are handled but connections in 
     the stack's listen queue are discarded. Restart triggered by 
     MaxRequestPerChild is unchanged.
     [Bill Stoddard <stoddard raleigh.ibm.com>]

  *) Win32: Eliminated unnecessary call to wait_for_multiple_objects in
     the accept loop. Good for a 5% performance boost. Cleaned up 
     parent/child process management code. 
     [Bill Stoddard <stoddard raleigh.ibm.com>]

  *) Added ceiling on file size for memory mapped files.
     [John Giannandrea <jg meer.net>] PR#4122

  *) Fix ndbm.h include problems with brain-dead glibc >= 2.1 which 
     has ndbm.h in a non-standard db1/ subdir. PR#4431, PR#4528
     [Henri Gomez <gomez slib.fr>, Ralf S. Engelschall] 

  *) Determine AP_BYTE_ORDER for ap_config_auto.h and already
     use this at least for Expat. [Ralf S. Engelschall]

  *) Allow .module files to specify libraries with Lib:.
     [Ben Laurie]

  *) Allow SetEnvIf[NoCase] to test environment variables as well
     as header fields and request attributes.  [Ken Coar]

  *) Fix mod_autoindex's handling of ScanHTMLTitles when file
     content-types are "text/html;parameters".  PR#4524  [Ken Coar]

  *) Remove "mxb" support from mod_negotiation -- it was a draft feature
     never accepted into any standard, and it opens up certain DoS
     attacks.  [Koen Holtman <Koen.Holtman cern.ch>]

  *) TestCompile updated. We can now run programs and output the
     results during the Configure process. [ Jim Jagielski]

  *) The source is now quad (long long) aware as needed. Specifically,
     the Configure process determines the correct size of off_t and
     *void. When the OS/platform/compiler supports quads, ap_snprintf()
     provides for the 'q' format qualifier (if quads are not available,
     'q' is silently "demoted" to long). [Jim Jagielski]

  *) When the username or password fed to htpasswd is too long, include the
     size limit in the error message.  Also report illegal characters
     (currently only ':') in the username.  Add the size restrictions
     to the man page.  [Ken Coar]

  *) Fixed the configure --without-support option so it doesn't result in
     an infinite loop.  [Marc Slemko]