Newer
Older
9001
9002
9003
9004
9005
9006
9007
9008
9009
9010
9011
9012
9013
9014
9015
9016
9017
9018
9019
9020
9021
9022
9023
9024
9025
9026
9027
9028
9029
9030
9031
9032
9033
9034
9035
9036
9037
9038
9039
9040
9041
9042
9043
9044
9045
9046
9047
9048
9049
9050
9051
9052
9053
9054
9055
9056
9057
9058
9059
9060
9061
9062
9063
9064
9065
9066
9067
9068
9069
9070
9071
9072
9073
9074
9075
9076
9077
9078
9079
9080
9081
9082
9083
9084
9085
9086
9087
9088
9089
9090
9091
9092
9093
9094
9095
9096
9097
9098
9099
9100
9101
9102
9103
9104
9105
9106
9107
9108
9109
9110
9111
9112
9113
9114
9115
9116
9117
9118
9119
9120
9121
9122
9123
9124
9125
9126
9127
9128
9129
9130
9131
9132
9133
9134
9135
9136
9137
9138
9139
9140
9141
9142
9143
9144
9145
9146
9147
9148
9149
9150
9151
9152
9153
9154
9155
9156
9157
9158
9159
9160
9161
9162
9163
9164
9165
9166
9167
9168
9169
9170
9171
9172
9173
9174
9175
9176
9177
9178
9179
9180
9181
9182
9183
9184
9185
9186
9187
9188
9189
9190
9191
9192
9193
9194
9195
9196
9197
9198
9199
9200
9201
9202
9203
9204
9205
9206
9207
9208
9209
9210
9211
9212
9213
9214
9215
9216
9217
9218
9219
9220
9221
9222
9223
9224
9225
9226
9227
9228
9229
9230
9231
9232
9233
9234
9235
9236
9237
9238
9239
9240
9241
9242
9243
9244
9245
9246
9247
9248
9249
9250
9251
9252
9253
9254
9255
9256
9257
9258
9259
9260
9261
9262
9263
9264
9265
9266
9267
9268
9269
9270
9271
9272
9273
9274
9275
9276
9277
9278
9279
9280
9281
9282
9283
9284
9285
9286
9287
9288
9289
9290
9291
9292
9293
9294
9295
9296
9297
9298
9299
9300
9301
9302
9303
9304
9305
9306
9307
9308
9309
9310
9311
9312
9313
9314
9315
9316
9317
9318
9319
9320
9321
9322
9323
9324
9325
9326
9327
9328
9329
9330
9331
9332
9333
9334
9335
9336
9337
9338
9339
9340
9341
9342
9343
9344
9345
9346
9347
9348
9349
9350
9351
9352
9353
9354
9355
9356
9357
9358
9359
9360
9361
9362
9363
9364
9365
9366
9367
9368
9369
9370
9371
9372
9373
9374
9375
9376
9377
9378
9379
9380
9381
9382
9383
9384
9385
9386
9387
9388
9389
9390
9391
9392
9393
9394
9395
9396
9397
9398
9399
9400
9401
9402
9403
9404
9405
9406
9407
9408
9409
9410
9411
9412
9413
9414
9415
9416
9417
9418
9419
9420
9421
9422
9423
9424
9425
9426
9427
9428
9429
9430
9431
9432
9433
9434
9435
9436
9437
9438
9439
9440
9441
9442
9443
9444
9445
9446
9447
9448
9449
9450
9451
9452
9453
9454
9455
9456
9457
9458
9459
9460
9461
9462
9463
9464
9465
9466
9467
9468
9469
9470
9471
9472
9473
9474
9475
9476
9477
9478
9479
9480
9481
9482
9483
9484
9485
9486
9487
9488
9489
9490
9491
9492
9493
9494
9495
9496
9497
9498
9499
9500
9501
9502
9503
9504
9505
9506
9507
9508
9509
9510
9511
9512
9513
9514
9515
9516
9517
9518
9519
9520
9521
9522
9523
9524
9525
9526
9527
9528
9529
9530
9531
9532
9533
9534
9535
9536
9537
9538
9539
9540
9541
9542
9543
9544
9545
9546
9547
9548
9549
9550
9551
9552
9553
9554
9555
9556
9557
9558
9559
9560
9561
9562
9563
9564
9565
9566
9567
9568
9569
9570
9571
9572
9573
9574
9575
9576
9577
9578
9579
9580
9581
9582
9583
9584
9585
9586
9587
9588
9589
9590
9591
9592
9593
9594
9595
9596
9597
9598
9599
9600
9601
9602
9603
9604
9605
9606
9607
9608
9609
9610
9611
9612
9613
9614
9615
9616
9617
9618
9619
9620
9621
9622
9623
9624
9625
9626
9627
9628
9629
9630
9631
9632
9633
9634
9635
9636
9637
9638
9639
9640
9641
9642
9643
9644
9645
9646
9647
9648
9649
9650
9651
9652
9653
9654
9655
9656
9657
9658
9659
9660
9661
9662
9663
9664
9665
9666
9667
9668
9669
9670
9671
9672
9673
9674
9675
9676
9677
9678
9679
9680
9681
9682
9683
9684
9685
9686
9687
9688
9689
9690
9691
9692
9693
9694
9695
9696
9697
9698
9699
9700
9701
9702
9703
9704
9705
9706
9707
9708
9709
9710
9711
9712
9713
9714
9715
9716
9717
9718
9719
9720
9721
9722
9723
9724
9725
9726
9727
9728
9729
9730
9731
9732
9733
9734
9735
9736
9737
9738
9739
9740
9741
9742
9743
9744
9745
9746
9747
9748
9749
9750
9751
9752
9753
9754
9755
9756
9757
9758
9759
9760
9761
9762
9763
9764
9765
9766
9767
9768
9769
9770
9771
9772
9773
9774
9775
9776
9777
9778
9779
9780
9781
9782
9783
9784
9785
9786
9787
9788
9789
9790
9791
9792
9793
9794
9795
9796
9797
9798
9799
9800
9801
9802
9803
9804
9805
9806
9807
9808
9809
9810
9811
9812
9813
9814
9815
9816
9817
9818
9819
9820
9821
9822
9823
9824
9825
9826
9827
9828
9829
9830
9831
9832
9833
9834
9835
9836
9837
9838
9839
9840
9841
9842
9843
9844
9845
9846
9847
9848
9849
9850
9851
9852
9853
9854
9855
9856
9857
9858
9859
9860
9861
9862
9863
9864
9865
9866
9867
9868
9869
9870
9871
9872
9873
9874
9875
9876
9877
9878
9879
9880
9881
9882
9883
9884
9885
9886
9887
9888
9889
9890
9891
9892
9893
9894
9895
9896
9897
9898
9899
9900
9901
9902
9903
9904
9905
9906
9907
9908
9909
9910
9911
9912
9913
9914
9915
9916
9917
9918
9919
9920
9921
9922
9923
9924
9925
9926
9927
9928
9929
9930
9931
9932
9933
9934
9935
9936
9937
9938
9939
9940
9941
9942
9943
9944
9945
9946
9947
9948
9949
9950
9951
9952
9953
9954
9955
9956
9957
9958
9959
9960
9961
9962
9963
9964
9965
9966
9967
9968
9969
9970
9971
9972
9973
9974
9975
9976
9977
9978
9979
9980
9981
9982
9983
9984
9985
9986
9987
9988
9989
9990
9991
9992
9993
9994
9995
9996
9997
9998
9999
10000
*) Merged os/win32/mod_dll.c into modules/standard/mod_so.c to support
dynamic loading on Win32 and Unix via the same module. [Paul Sutton]
*) Now mod_rewrite no longer makes problematic assumptions on the characters
a username can contain when trying to expand it via /etc/passwd.
[Ralf S. Engelschall]
*) The mod_setenvif BrowserMatch backwards compatibility command did not
work properly with spaces in the regex. [Ronald Tschalaer] PR#1825
*) Add new RewriteMap types: First, `rnd' which is equivalent to the `txt'
type but with a special post-processing for the looked-up value: It
parses it into alternatives according to `|' chars and then only one
particular alternative is chosen randomly (this is an essential
functionality needed for balancing between backend-servers when using
Apache as a Reverse Proxy. The looked up value here is a list of
servers). Second, `int' with the built-in maps named `tolower' and
`toupper' which can be used to map URL parts to a fixed case (this is an
essential feature to fix the case of server names when doing mass
virtual-hosting with the help of mod_rewrite instead of using
<VirtualHost> sections). [Ralf S. Engelschall, parts based on code from
Jay Soffian <jay@cimedia.com>] PR#1631
*) Add a new directive to mod_proxy similar to ProxyPass: `ProxyPassReverse'.
This directive lets Apache adjust the URL in Location-headers on HTTP
redirect responses sent by the remote server. This way the virtually
mapped area is no longer left on redirects and thus by-passed which is
especially essential when running Apache as a reverse proxy.
[Ralf S. Engelschall]
*) Hide Proxy-Authorization from CGI/SSI/etc just like Authorization is
hidden. [Alvaro Martinez Echevarria]
*) Apache will, when started with the -X (single process) debugging flag,
honor the SIGINT or SIGQUIT signals again now. This capability got lost
a while ago during OS/2 signal handling changes.
*) [PORT] Work around the fact that NeXT runs on more than the
m68k chips in mod_status [Scott Anguish and Timothy Luoma
<luomat@peak.org>]
*) [PORT] Recognize FreeBSD versions so we can use the OS regex as well
as handling unsigned-chars for FreeBSD v3 and v2 [Andrey Chernov
<ache@nagual.pp.ru> and Jim] PR#1450
*) Use SA_RESETHAND or SA_ONESHOT when installing the coredump handlers.
In particular the handlers could trigger themselves into an infinite
loop if RLimitMem was used with a small amount of memory -- too small
for the signal stack frame to be set up. [Dean Gaudet]
*) Fix problems with absoluteURIs introduced during 1.3b4. [Dean Gaudet,
Alvaro Martinez Echevarria <alvaro@lander.es>]
*) Fix multiple UserDir problem introduced during 1.3b4-dev.
[Dean Gaudet] PR#1850
*) ap_cpystrn() had an off-by-1 error.
[Charles Fu <ccwf@klab.caltech.edu>] PR#1847
*) API: As Ken suggested the check_cmd_context() function and related
defines are non-static now so modules can use 'em. [Martin Kraemer]
*) mod_info would occasionally produce an unpaired <tt> in its
output. Fixed. [Martin Kraemer]
*) By default AIX binds a process (and it's children) to a single
processor. httpd children now unbind themselves from that cpu
and re-bind to one selected at random via bindprocessor()
[Doug MacEachern]
*) Linux 2.0 and above implement RLIMIT_AS, RLIMIT_DATA has almost no
effect. Work around it by using RLIMIT_AS for the RLimitMEM
directive. [Enrik Berkhan <enrik@inka.de>] PR#1816
*) mod_mime_magic error message should indicate the filename when
reads fail. ["M.D.Parker" <mdpc@netcom.com>] PR#1827
*) Previously Apache would permit </Files> to end <FilesMatch> (and
similary for Location and Directory), now this is diagnosed as an
error. Improve error messages for mismatched sections (<Files>,
<FilesMatch>, <Directory>, <DirectoryMatch>, ...).
[Dean Gaudet, Martin Kraemer]
*) <Files> is not permitted within <Location> (because of the
semantic ordering). [Dean Gaudet] PR#379
*) <Files> with wildcards was broken by the change in wildcard
semantics (* does not match /). To fix this, <Files> now
apply only to the basename of the request filename. This
fixes some other inconsistencies in <Files> semantics
(such as <Files a*b> not working). [Dean Gaudet] PR#1817
*) Removed bogus "dist.tar" target from Makefile.tmpl and make sure
backup files are removed on "clean" target [Ralf S. Engelschall]
*) PORT: Add -lm to LIBS for HPUX. [Dean Gaudet] PR#1639
*) Various errors from select() and accept() in child_main() would
result in an infinite loop. It seems these two tickle kernel
or library bugs occasionally, and result in log spammage and
a generally bad scene. Now the child exits immediately,
which seems to be a good workaround.
[Dean Gaudet] PR#1747, 1107, 588, 1787, 987, 588
*) Cleaned up some race conditions in unix child_main during
initialization. [Dean Gaudet]
*) SECURITY: "UserDir /abspath" without a * in the path would allow
remote users to access "/~.." and bypass access restrictions
(but note /~../.. was handled properly).
[Lauri Jesmin <jesmin@ut.ee>] PR#1701
*) API: os_is_path_absolute() now takes a const char * instead of a char *.
[Dean Gaudet]
Changes with Apache 1.3b5
*) Source file dependencies in Makefile.tmpl files throughout the
source tree were updated to accurately reflect reality.
[Dean Gaudet]
*) Preserve the content encoding given by the AddEncoding directive
when the client doesn't otherwise specify an encoding.
[Ronald Tschalaer <Ronald.Tschalaer@psi.ch>]
*) Sort out problems with canonical filename handling happening too late.
[Dean Gaudet, Ben Laurie]
Changes with Apache 1.3b4
*) The module structure was modified to include a *dynamic_load_handle
in the STANDARD_MODULE_STUFF portion, and the MODULE_MAGIC_NUMBER
has been bumped accordingly. [Paul Sutton]
*) All BrowserMatch directives mentioned in
htdocs/manual/known_client_problems.html are in the default
configuration files. [Lars Eilebrecht]
*) MiNT port update. [Jan Paul Schmidt]
*) HTTP/1.1 requires x-gzip and gzip encodings be treated
equivalent, similarly for x-compress and compress. Apache
now ignores a leading x- when comparing encodings. It also
preserves the encoding the client requests (for example if
it requests x-gzip, then Apache will respond with x-gzip
in the Content-Encoding header).
[Ronald Tschalaer <Ronald.Tschalaer@psi.ch>] PR#1772
*) Fix a memory leak on keep-alive connections. [Igor Tatarinov]
*) Added mod_so module to support dynamic loading of modules on Unix
(like mod_dld for Win32). This replaces mod_dld.c. Use SharedModule
instead of AddModule in Configuration to build shared modules
[Sameer Parekh, Paul Sutton]
*) Minor cleanups to r->finfo handling in some modules.
[Dean Gaudet]
*) Abstract read()/write() to ap_read()/ap_write().
Makes it easier to add other types of IO code such as SFIO.
[Randy Terbush]
*) API: Generalize default_port manipulations to make support of
different protocols easier. [Ben Laurie, Randy Terbush]
*) There are many cases where users do not want Apache to form
self-referential urls using the "canonical" ServerName and Port.
The new UseCanonicalName directive (default on), if set to off
will cause Apache to use the client-supplied hostname and port.
API: Part of this change required a change to the construct_url()
prototype; and the addition of get_server_name() and
get_server_port().
[Michael Douglass <mikedoug@texas.net>, Dean Gaudet]
PR#315, 459, 485, 1433
*) Yet another rearrangement of the source tree.. now all the common
header files are in the src/include directory. The -Imain -Iap
references in Makefiles have been changed to the simpler -Iinclude
instead. In addition to simplifying the build a little bit, this
also makes it clear when a module is referencing something in a
other than kosher manner (e.g., the proxy including mod_mime.h).
Module-private header files (the proxy, mod_mime, the regex library,
and mod_rewrite) have not been moved to src/include; nor have
the OS-abstraction files. [Ken Coar]
*) Fix a bug where r->hostname didn't have the :port stripped
from it. [Dean Gaudet]
*) Tweaked the headers_out table size, and the subprocess_env
table size guess in rename_original_environment(). Added
MAKE_TABLE_PROFILE which can help discover make_table()
calls that use too small an initial guess, see alloc.c.
[Dean Gaudet]
*) Options and AllowOverride weren't properly merging in the main
server setting inside vhosts (only an issue when you have no
<Directory> or other section containing an Options that affects
a request). Options +foo or -foo in the main_server wouldn't
affect the main_server's lookup defaults. [Dean Gaudet]
*) Variable 'cwd' was being used pointlessly before being set.
[Ken Coar] PR#1738
*) r->allowed handling cleaned up in the standard modules.
[Dean Gaudet]
*) Some case-sensitivity issues cleaned up to be consistent with
RFC2068. [Dean Gaudet]
*) SIGURG doesn't exist everywhere.
[Mark Andrew Heinrich <heinrich@tinderbox.Stanford.EDU>]
*) mod_unique_id was erroneously generating a second unique id when
an internal redirect occured. Such redirects occur, for example,
when processing a DirectoryIndex match. [Dean Gaudet]
*) API: table_add, table_merge, and table_set include implicit pstrdup()
of the key and value. But in many cases this is not required
because the key/value is a constant, or the value has been built
by pstrcat() or other similar means. New routines table_addn,
table_mergen, and table_setn have been added to the API, these
routines do not pstrdup() their arguments. The core code and
standard modules were changed to take advantage of these routines.
The resulting server is up to 20% faster in some situations.
Note that it is easy to get code subtly wrong if you pass a key/value
which is in a pool other than the pool of the table. The only
safe thing to do is to pass key/values which are in the pool of
the table, or in one of the ancestors of the pool of the table.
i.e. if the table is part of a subrequest, a value from the main
request's pool is OK since the subrequest pool is a sub_pool of the
main request's pool (and therefore has a lifespan at most as long as
the main pool). There is debugging code which can detect improper
usage, enabled by defining POOL_DEBUG. See alloc.c for more details.
[Dmitry Khrustalev <dima@bog.msu.su>, Dean Gaudet]
*) More mod_mime_magic cleanup: fewer syscalls; should handle "files"
which don't exist on disk more gracefully; handles vhosts properly.
Update documentation to reflect the code -- if there's no
MimeMagicFile directive then the module is not enabled.
[Dean Gaudet]
*) PORT: Some older *nix dialects cannot automatically start scripts
which begin with a #! interpreter line (the shell starts the scripts
appropriately on these platforms). Apache now supports starting of
"hashbang-scripts" when the NEED_HASHBANG_EMUL define is set.
[Martin Kraemer, with code from peter@zeus.dialix.oz.au (Peter Wemm)
taken from tcsh]
*) API: "typedef array_header table" removed from alloc.h, folks should
have been writing to use table as if it were an opaque type, but even
some standard modules got this wrong. By changing the definition
to "typedef struct table table" module authors will receive compile
time warnings that they're doing the wrong thing. This change
facilitates future changes with more sophisticated table
structures. Specifically, module authors should be using table_elts()
to get access to an array_header * for the table. [Dean Gaudet]
*) API: Renamed new_connection() to avoid namespace collision with LDAP
library routines. [Ken Coar, Rasmus Lerdorf]
*) WIN32: mod_speling is now available on the Win32 platform.
[Marc Slemko]
*) For clarity the following compile time definition was changed:
SAFE_UNSERIALIZED_ACCEPT -> SINGLE_LISTEN_UNSERIALIZED_ACCEPT
Also, for example, HAVE_MMAP would mean to use mmap() scoreboards
and not be a general notice that the OS has mmap(). Now the
HAVE_MMAP/SHMGET #defines strictly are informational that the
OS has that method of shared memory; the type to use for
the scoreboard is a seperate #define (USE_MMAP_SCOREBOARD
and USE_SHMGET_SCOREBOARD). This allows outside modules to
determine if shared memory is available and allows Apache
to determine the best method to use for the scoreboard.
[Jim Jagielski]
*) PORT: UnixWare 2.1.2 SMP appears to require USE_FCNTL_SERIALIZED_ACCEPT,
as do various earlier versions. It should be safe on all versions.
Unixware 1.x appears to have the same SIGHUP bug as solaris does with
the slack code. A few other cleanups for Unixware.
[Tom Hughes <thh@cyberscience.com>] PR#1082, PR#1282, PR#1499, PR#1553
*) PORT: A/UX can handle single-listen accepts without mutex
locking, so we add SINGLE_LISTEN_UNSERIALIZED_ACCEPT. [Jim Jagielski]
*) When die() happens we need to eat any request body if one exists.
Otherwise we can't continue with a keepalive session. This shows up
as a POST problem with MSIE 4.0, typically against pages which are
authenticated. [Roy Fielding] PR#1399
*) If you define SECURITY_HOLE_PASS_AUTHORIZATION then the Authorization
header will be passed to CGIs. This is generally a security hole, so
it's not a default. [Marc Slemko] PR#549
*) Fix Y2K problem with date printing in suexec log.
[Paul Eggert <eggert@twinsun.com>] PR#1343
*) WIN32 deserves a pid file. [Ben Hyde]
*) suexec errors now include the errno/description. [Marc Slemko] PR#1543
*) PORT: OSF/1 now uses USE_FLOCK_SERIALIZED_ACCEPT to solve PR#467.
The choice of flock vs. fcntl was made based on timings which showed that
even on non-NFS, non-exported filesystems fcntl() was an order of
magnitude slower. It also uses SINGLE_LISTEN_UNSERIALIZED_ACCEPT so
that single socket users will see no difference. [Dean Gaudet] PR#467
*) "File does not exist" error message was erroneously including the
errno. [Marc Slemko]
*) Improve the warning message generated when a client drops the
connection (hits stop button, etc.) during a send. [Roy Fielding]
*) Defining GPROF will disable profiling in the parent and enable it
in the children. If you're profiling under Linux this is pretty much
necessary because SIGPROF is lost across a fork(). [Dean Gaudet]
*) htdigest and htpasswd needed slight tweaks to work on OS/2 and WIN32.
[Brian Havard]
*) The NeXT cc (which is gcc hacked up) doesn't appear to support some
gcc functionality. Work around it.
[Keith Severson <keith@sssd.navy.mil>] PR#1613
*) Some linkers complain when .o files contain no functions.
[Keith Severson <keith@sssd.navy.mil>] PR#1614
*) Some const declarations in mod_imap.c that were added for debugging
purposes caused some compilers heartburn without adding any
significant value, so they've been removed. [Ken Coar]
*) The src/main/*.h header files have had #ifndef wrappers added to
insulate them against duplicate calls if they get included through
multiple paths (e.g., in .c files as well as other .h files).
[Ken Coar]
*) The libap routines now have a header file for their prototypes,
src/ap/ap.h, to ease their use in non-httpd applications. [Ken Coar]
*) mod_autoindex with a plaintext header file would emit the <PRE>
start-tag before the HTML preamble, rather than after the preamble
but before the header file contents. [John Van Essen <jve@gamers.org>]
PR#1667
*) SECURITY: Fix a possible buffer overflow in logresolve. This is
only an issue on systems without a MAXDNAME define or where
the resolver returns domain names longer than MAXDNAME. [Marc Slemko]
*) SECURITY: Eliminate possible buffer overflow in cfg_getline, which
is used to read various types of files such as htaccess and
htpasswd files. [Marc Slemko]
*) SECURITY: Ensure that the buffer returned by ht_time is always
properly null terminated. [Marc Slemko]
*) The "Connection" header could be sent back with multiple "close"
tokens. Not an error, but a waste.
[Ronald.Tschalaer@psi.ch] PR#1683
*) mod_rewrite's RewriteLog should behave like mod_log_config, it
shouldn't force hostname lookups. [Dean Gaudet] PR#1684
*) "basic" auth needs a case-insensitive comparison.
[Ronald.Tschalaer@psi.ch] PR#1666
*) For maximum portability, the environment passed to CGIs should
only contain variables whose names match the regex
/[a-zA-Z][a-zA-Z0-9_]*/. This is now enforced by stamping
underscores over any character outside the regex. This
affects HTTP_* variables, in a way that should be backward
compatible for all the standard headers; and affects variables
set with SetEnv/BrowserMatch and similar directives.
[Dean Gaudet]
*) mod_speling returned incorrect HREF's when an ambigous match
was found. Noticed by <robinton@amtrash.comlink.de> (Soeren Ziehe)
[robinton@amtrash.comlink.de (Soeren Ziehe), Martin Kraemer]
*) PORT: Apache now compiles & runs on an EBCDIC mainframe
(the Siemens BS2000/OSD family) in the POSIX subsystem
[Martin Kraemer]
*) PORT: Fix problem killing children when terminating. Allow ^C
to shut down the server. [Brian Havard]
*) pstrdup() is implicit in calls to table_* functions, so there's
no need to do it before calling. Clean up a few cases.
[Marc Slemko, Dean Gaudet]
*) new -C and -c command line arguments
usage:
-C "directive" : process directive before reading config files
-c "directive" : process directive after reading config files
example:
httpd -C "PerlModule Apache::httpd_conf"
[Doug MacEachern, Martin Kraemer]
*) WIN32: Fix the execution of CGIs that are scripts and called
with path info that does not have an '=' in.
(eg. http://server/cgi-bin/printenv?foobar)
[Marc Slemko] PR#1591
*) WIN32: Fix a call to os_canonical_filename so it doesn't try to
mess with fake filenames. This fixes proxy caching on
win32. PR#1265
*) SECURITY: General mod_include cleanup, including fixing several
possible buffer overflows and a possible infinite loop.
[Dean Gaudet, Marc Slemko]
*) SECURITY: Numerous changes to mod_imap in a general cleanup
including fixing a possible buffer overflow. [Dean Gaudet]
*) WIN32: overhaul of multithreading code. Shutdowns are now graceful
(connections are not dropped). Code can handle graceful restarts
(but there is as yet no way to signal this to Apache). Various
other cleanups. [Paul Sutton]
*) The aplog_error changes specific to 1.3 introduced a buffer
overrun in the (now legacy) log_printf function. Fixed.
[Dean Gaudet]
*) mod_digest didn't properly deal with proxy authentication. It
also lacked a case-insensitive comparision of the "Digest"
token. [Ronald Tschalaer <Ronald.Tschalaer@psi.ch>] PR#1599
*) A few cleanups in mod_status for efficiency. [Dean Gaudet]
*) A few cleanups in mod_info to make it thread-safe, and remove an
off-by-5 bug that could hammer \0 on the stack. [Dean Gaudet]
*) no2slash() was O(n^2) in the length of the input. Make it O(n).
[Dean Gaudet]
*) API: migration from strncpy() to our "enhanced" version called
ap_cpystrn() for performance and functionality reasons.
Located in libap.a. [Jim Jagielski]
*) table_set() and table_unset() did not deal correctly with
multiple occurrences of the same key.
[Stephen Scheck <sscheck@infonex.net>, Ben Laurie] PR#1604
*) The AuthName must now be enclosed in quotes if it is to contain
spaces. [Ken Coar] PR#1195
*) API: new function: ap_escape_quotes(). [Ken Coar] PR#1195
*) WIN32: Work around optimiser bug that killed ISAPI in release
versions. [Ben Laurie] PR#1533
*) PORT: Update the MPE port [Mark Bixby, Jim Jagielski]
*) Interim (slow) fix for p->sub_pool critical sections in
alloc.c (affects win32 only). [Ben Hyde]
*) non-WIN32 was missing destroy_mutex definition. [Ben Hyde]
*) send_fd_length() did not calculate total_bytes_sent properly.
[Ben Reser <breser@regnow.com>] PR#1366
*) The bputc() macro was not properly integrated with the chunking
code; in many cases modules using bputc() could cause completely
bogus chunked output. (Typically this will show up as problems
with Internet Explorer 4.0 reading a page, but other browsers
having no problem.) [Dean Gaudet]
*) Create LARGE_WRITE_THRESHOLD define which determines how many
bytes have to be supplied to bwrite() before it will consider
doing a writev() to assemble multiple buffers in one system
call. This is critical for modules such as mod_include,
mod_autoindex, mod_php3 which all use bputc()/bputs() of smaller
strings in some cases. The result would be extra effort
setting up writev(), and in many cases extra effort building
chunks. The default is 31, it can be overriden at compile
time. [Dean Gaudet]
*) Move the gid switching code into the child so that log files
and pid files are opened with the root gid.
[Gregory A Lundberg <lundberg@vr.net>]
*) WIN32: Check for binaries by looking for the executable header
instead of counting control characters.
[Jim Patterson <Jim.Patterson@Cognos.COM>] PR#1340
*) ap_snprintf() moved from main/util_snprintf.c to ap/ap_snprintf.c
so the functionality is available to applications other than the
server itself (like the src/support tools). [Ken Coar]
*) ap_slack() moved out of main/util.c into ap/ap_slack.c as part of
the libap consolidation work. [Ken Coar]
*) ap_snprintf() with a len of 0 behaved like sprintf(). This is not
useful, and isn't what the standards require. Now it returns 0
and writes nothing. [Dean Gaudet]
*) When an error occurs in fcntl() locking suggest the user look up
the docs for LockFile. [Dean Gaudet]
*) Eliminate some dead code from writev_it_all().
[Igor Tatarinov <tatarino@prairie.NoDak.edu>]
*) mod_autoindex had an fread() without checking the result code.
It also wouldn't handle "AddIconByType (TXT,/icons/text.gif text/*"
(note the missing closing paren) properly. [Dean Gaudet]
*) It appears the "257th byte" bug (see
htdocs/manual/misc/known_client_problems.html#257th-byte) can happen
at the 256th byte as well. Fixed. [Dean Gaudet]
*) PORT: Fix mod_mime_magic under OS/2, no support for block devices.
[Brian Havard]
*) Fix memory corruption caused by allocating auth usernames in the
wrong pool. [Dean Gaudet] PR#1500
*) Fix an off-by-1, and an unterminated string error in
mod_mime_magic. [Dean Gaudet]
*) Fix a potential SEGV problem in mod_negotiation when dealing
with type-maps. [Dean Gaudet]
*) Better glibc support under Linux. [Dean Gaudet] PR#1542
*) "RedirectMatch gone /" would cause a SIGSEGV. [Dean Gaudet] PR#1319
*) WIN32: avoid overflows during file canonicalisations.
[malcolm@mgdev.demon.co.uk] PR#1378
*) WIN32: set_file_slot() didn't detect absolute paths. [Ben Laurie]
PR#1511, 1508
*) WIN32: mod_status display header didn't match fields. [Ben Laurie]
*) The pthread_mutex_* functions return an error code, and don't
set errno. [Igor Tatarinov <tatarino@prairie.NoDak.edu>]
*) WIN32: Allow spaces to prefix the interpreter in #! lines.
[Ben Laurie] PR#1101
*) WIN32: Cure file leak in CGIs. [Peter Tillemans <pti@net4all.be>] PR#1523
*) proxy_ftp: the directory listings generated by the proxy ftp module
now have a title in which the path components are clickable and allow
quick navigation to the clicked-on directory on the currently listed
ftp server. This also fixes a bug where the ".." directory links would
sometimes refer to the wrong directory. [Martin Kraemer]
*) WIN32: Allocate the correct amount of memory for the scoreboard.
[Ben Hyde] PR#1387
*) WIN32: Only lowercase the part of the path that is real. [Ben Laurie]
PR#1505
*) Fix problems with timeouts in inetd mode and -X mode. [Dean Gaudet]
*) Fix the spurious "(0)unknown error: mmap_handler: mmap failed"
error messages. [Ben Hyde]
Changes with Apache 1.3b3
*) WIN32: Work around brain-damaged spawn calls that can't deal
with spaces and slashes. [Ben Laurie]
*) WIN32: Fix the code so CGIs can use socket calls on Windows.
The problem was that certain undocumented environment variables
needed for sockets to work under Win32 were not being passed.
[Frank Faubert <frank@sane.com>]
*) Add a "-V" command line flag to the httpd binary. This
flag shows some of the defines that Apache was compiled with.
It is useful for debugging purposes. [Martin Kraemer]
*) Start separating the ap_*() routines into their own library, so they
can be used by items in src/support among other things.
[Ken Coar] PR#512, 905, 1252, 1308
*) Give a more informative error when no AuthType is set.
[Lars Eilebrecht]
*) Remove strtoul() use from mod_proxy because it isn't available
on all platforms. [Marc Slemko] PR#1214
*) WIN32: Some Win32 systems terminated all responses after 16 kB.
This turns out to be a bug in Winsock - select() doesn't always
return the correct status. [Ben Laurie]
*) Directives owned by http_core can now use the new check_cmd_context()
routine to ensure that they're not being used within a container
(e.g., <Directory>) where they're invalid. [Martin Kraemer]
*) PORT: Recent changes made it necessary to add explicit prototype
for fgetc() and fgets() on SunOS 4.x. [Martin Kraemer, Ben Hyde]
*) It was necessary to distinguish between resources which are
allocated in the parent, for cleanup in the parent, and resources
which are allocated in each child, for cleanup in each child.
A new pool was created which is passed to the module child_init
and child_exit functions; modules are free to register per-child
cleanups there. This fixes a bug with reliable piped logs.
[Dean Gaudet]
*) mod_autoindex wasn't displaying the ReadmeName file at the bottom
unless it was also doing FancyIndexes, but it displayed the
HeaderName file at the top under all circumstances. It now shows
the ReadmeName file for simple indices, too, as it should.
[Ken Coar] PR#1373
*) http_core was mmap()ing even in cases where it wasn't going to
read the file. [Ben Hyde <bhyde@gensym.com>]
*) Complete rewrite ;-) of mod_rewrite's URL rewriting engine:
Now the rewriting engine (the heart of mod_rewrite) is organized more
straight-forward, first time well documented and reduced to the really
essential parts. All redundant cases were stripped off and processing now
is the same for both per-server and per-directory context with only a
minimum difference (the prefix stripping in per-dir context). As a
side-effect some subtle restrictions and two recently discovered problems
are gone: Wrong escaping of QUERY_STRING on redirects in per-directory
context and restrictions on the substitution URL on redirects.
Additionally some minor source cleanups were done.
[Ralf S. Engelschall]
*) Lars Eilebrecht wrote a whole new set of Apache Vhost Internals
documentation, examples, explanations and caveats. They live in a new
subdirectory htdocs/manual/vhost/. [Lars Eilebrecht <sfx@unix-ag.org>]
*) If ap_slack fails to allocate above the low slack line it's a good
indication that further problems will occur; it's a better indication
than many external libraries give us when we actually run out of
descriptors. So report it to the user once per restart.
[Dean Gaudet] PR#1181
*) Change mod_include and mod_autoindex to use Y2K-safe date formats
by default. [Ken Coar]
*) Add a "SuppressColumnSorting" option to the IndexOptions list,
which will keep the column heading from being links for sorting
the display. [Ken Coar, suggested by Brian Tiemann <btman@pacific.net>]
PR #1261
*) PORT: Update the LynxOS port. [Marius Groeger <mag@sysgo.de>]
*) Fix logic error when issuing a mmap() failed message
with a non-zero MMAP_THRESHOLD.
[David Chambers <davidc@flosun.salk.edu>] PR#1294
*) Preserve handler value on ProxyPass'ed requests by not
calling find_types on a proxy'd request; fixes problems
where some ProxyPass'ed URLs weren't actually passed
to the proxy.
[Lars Eilebrecht] PR#870
*) Fix a byte ordering problem in mod_access which prevented
the old-style syntax (i.e. "a.b.c." to match a class C)
from working properly. [Dean Gaudet] PR#1248, 1328, 1384
*) Fix problem with USE_FLOCK_SERIALIZED_ACCEPT not working
properly. Each child needs to open the lockfile instead
of using the passed file-descriptor from the parent.
[Jim Jagielski] PR#1056
*) Fix the error logging in mod_cgi; the recent error log changes
introduced a bug that prevented it from working correctly.
[M.D.Parker] PR#1352
*) Default to USE_FCNTL_SERIALIZED_ACCEPT on HPUX to properly
handle multiple Listen directives. [Marc Slemko] PR#872
*) Inherit a bugfix to fnmatch.c from FreeBSD sources.
["[KOI8-R] áÎÄÒÅÊ þÅÒÎÏ×" <ache@nagual.pp.ru>] PR#1311
*) When a configuration parse complained about a bad directive,
the logger would use whatever (unrelated) value was in errno.
errno is now forced to EINVAL first in this case. [Ken Coar]
*) A sed command in the Configure script pushed the edge of POSIXness,
breaking on some systems. [Bhaba R.Misra <system@vt.edu>] PR#1368
*) Solaris >= 2.5 was totally broken due to a mess up using pthread
mutexes. [Roy Fielding, Dean Gaudet]
*) OS/2 Port updated; it should be possible to build OS/2 from the same
sources as Unix now. [Brian Havard <brianh@kheldar.apana.org.au>]
*) Fix a year formatting bug in mod_usertrack.
[Paul Eggert <eggert@twinsun.com>] PR#1342
*) A mild SIGTERM/SIGALRM race condition was eliminated.
[Dean Gaudet] PR#1211
*) Warn user that default path has changed if /usr/local/etc/httpd
is found on the system. [Lars Eilebrecht]
*) Various mod_mime_magic bug fixes and cleanups: Uncompression
should work, it should work on WIN32, and a few resource
leaks and abort conditions are fixed.
[Dean Gaudet] PR#1205
*) PORT: On AIX 1.x files can't be named '@', fix the proxy cache
to use '%' instead of '@' in its encodings.
[David Schuler <schuld@btv.ibm.com>] PR#1317
*) Improve the warning message generated when the "server is busy".
[Dean Gaudet] PR#1293
*) PORT: All ports which don't otherwise define DEF_WANTHSREGEX will
get Spencer regex by default. This is to avoid having to
discover bugs in operating system libraries. [Dean Gaudet]
*) PORT: "Fix" PR#467 by generating warnings on systems which we have
not been able to get working USE_*_SERIALIZED_ACCEPT settings for.
Document this a bit more in src/PORTING. [Dean Gaudet] PR#467
*) Ensure that one copy of config warnings makes it to the
error_log. [Dean Gaudet]
*) Invent new structure and associated methods to handle config file
reading. Add "custom" hook to use config file cfg_getline() on
something which is not a FILE* [Martin Kraemer]
*) Make single-exe Windows install. [Ben Laurie and Eric Esselink]
*) WIN32: Make CGI work under Win95. [Ben Laurie and Paul Sutton]
*) WIN32: Make index.html and friends work under Win95. [Ben Laurie]
*) PORT: Solaris 2.4 needs Spencer regex, the system regex is broken.
[John Line <jml4@cam.ac.uk>] PR#1321
*) Default pathname has been changed everywhere to /usr/local/apache
[Sameer <sameer@c2.net>]
*) PORT: AIX now uses USE_FCNTL_SERIALIZED_ACCEPT.
[David Bronder <David-Bronder@uiowa.edu>] PR#849
*) PORT: i386 AIX does not have memmove.
[David Schuler <schuld@btv.ibm.com>] PR#1267
*) PORT: HPUX now defaults to using Spencer regex.
[Philippe Vanhaesendonck <pvanhaes@be.oracle.com>,
Omar Del Rio <al112263@academ01.lag.itesm.mx>] PR#482, 1246
*) PORT: Some versions of NetBSD don't automatically define
__NetBSD__. Workaround by defining NETBSD.
[Chris Craft <ccraft@cncc.cc.co.us>] PR#977
*) PORT: UnixWare 2.x requires -lgen for syslog.
[Hans Snijder <hs@meganet.nl>] PR#1249
*) PORT: ULTRIX appears to not have syslog.
[Lars Eilebrecht <Lars.Eilebrecht@unix-ag.org>]
*) PORT: Basic Gemini port (treat it like unixware212).
["Pavel Yakovlev (Paul McHacker)" <hac@tomcat.olly.ru>]
*) PORT: All SVR4 systems now use NET_SIZE_T = size_t, and
use USE_SHMGET_SCOREBOARD.
[Martin Kraemer]
*) Various improvements in detecting config file errors (missing closing
directives for <Directory>, <Files> etc. blocks, prohibiting global
server settings in <VirtualHost> blocks, flagging unhandled multiple
arguments to <Directory>, <Files> etc.)
[Martin Kraemer]
*) Add support to suexec wrapper program for mod_unique_id's UNIQUE_ID
variable to provide this one to suexec'd CGIs, too.
[M.D.Parker <mdpc@netcom.com>] PR#1284
*) New support tool: src/support/split-logfile, a sample Perl script which
splits up a combined access log into separate files based on the
name of the virtual host (listed first in the log records by "%v").
[Ken Coar]
Changes with Apache 1.3b2 (there is no 1.3b1)
*) TestCompile was not passing $LIBS [Dean Gaudet]
*) Makefile.tmpl was not using $CFLAGS in the link phase.
[Martin Kraemer]
*) Add debugging code to alloc.c. Defining ALLOC_DEBUG provides a
rudimentary memory debugger which can be used on live servers with
low impact -- it sets all allocated and freed memory bytes to 0xa5.
Defining ALLOC_USE_MALLOC will cause the alloc code to use malloc()
and free() for each object. This is far more expensive and should
only be used for testing with tools such as Electric Fence and
Purify. See main/alloc.c for more details. [Dean Gaudet]
*) Configure uses a sh trap and didn't set its exitcode properly.
[Dean Gaudet] PR#1159
*) Yet another vhost revamp. Add the NameVirtualHost directive which
explicitly lists the ip:port pairs that are to be used for name-vhosts.
From a given ip:port, regardless what the Host: header is, you can
only reach the vhosts defined on that ip:port. The precedence of
vhosts was reversed to match other precedences in the config --
the earlier vhosts override the later vhosts. All vhost matching was
moved into http_vhost.[ch]. [Dean Gaudet]
*) ap_inline can be used to force inlining. GNUC __attribute__() can
be used for whatever reason is appropriate (i.e. format() warnings
for printf style functions). Both are enabled only with
gcc >= 2.7.x (so that we have fewer support issues with older
versions). [Dean Gaudet]
*) Fix support for Proxy Authentication (we were testing the response
status too early). [Marc Slemko]
*) CoreDumpDirectory directive directs where the core file is
written when a SIGSEGV, SIGBUS, SIGABORT or SIGABRT are
received. [Marc Slemko, Dean Gaudet]
*) PORT: Support for Atari MINT.
[Jan Paul Schmidt <Jan.P.Schmidt@mni.fh-giessen.de>]
*) When booting, apache will now detach itself from stdin, stdout,
and stderr. stderr will not be detached until after the config
files have been read so you will be able to see initial error
messages. After that all errors are logged in the error_log.
This makes it more convenient to start apache via rsh, ssh,
or crontabs. [Dean Gaudet] PR#523
*) mod_proxy was sending HTTP/1.1 responses to ftp requests by mistake.
Also removed the auto-generated link to www.apache.org that was the
source of so many misdirected bug reports. [Roy Fielding, Marc Slemko]
*) send_fb would not detect aborted connections in some situations.
[Dean Gaudet]
*) mod_include would use uninitialized data when parsing certain
expressions involving && and ||. [Brian Slesinsky] PR#1139
*) mod_imap should only handle GET methods. [Jay Bloodworth]
*) suexec.c wouldn't build without -DLOG_EXEC. [Jason A. Dour]
*) mod_autoindex improperly counted &escapes; as more than one
character in the description. It also improperly truncated
descriptions that were exactly the maximum length.
[Martin Kraemer]
*) RedirectMatch was not properly escaping the result (PR#1155). Also
"RedirectMatch /advertiser/(.*) $1" is now permitted.
[Dean Gaudet]
*) mod_include now uses symbolic names to check for request success
and return HTTP errors, and correctly handles all types of
redirections (previously it only did temporary redirect correctly).
[Ken Coar, Roy Fielding]
*) mod_userdir was modifying r->finfo in cases where it wasn't setting
r->filename. Since those two are meant to be in sync with each other
this is a bug. ["Paul B. Henson" <henson@intranet.csupomona.edu>]
*) PORT: Support Unisys SVR4, whose uname returns mostly useless data.
["Kaufman, Steven E" <Steven.Kaufman@unisys.com>]
*) Inetd mode (which is buggy) uses timeouts without having setup the
jmpbuffer. [Dean Gaudet] PR#1064
*) Work around problem under Linux where a child will start looping
reporting a select error over and over.
[Rick Franchuk <rickf@transpect.net>] PR#1107, 987, 588
*) Fixed error in proxy_util.c when looping through multiple host IP
addresses. [Lars Eilebrecht] PR#974
*) If BUFFERED_LOGS is defined then mod_log_config will do atomic
buffered writes -- that is, it will buffer up to PIPE_BUF (i.e. 4k)
bytes before writing, but it will never split a log entry across a
buffer boundary. [Dean Gaudet]
*) API: the short_score record has been split into two pieces, one which
the parent writes on, and one which the child writes on. As part of
this change the get_scoreboard_info() function was removed, and
scoreboard_image was exported. This change fixes a race condition
in file based scoreboard systems, and speeds up changes involving the
scoreboard in earlier 1.3 development. [Dean Gaudet]
*) API: New register_other_child() API (see http_main.h) which allows
modules to register children with the parent for maintenance. It
is disabled by defining NO_OTHER_CHILD. [Dean Gaudet]
*) API: New piped_log API (see http_log.h) which implements piped logs,
and will use register_other_child to implement reliable piped logs
when it is available. The reliable piped logs part can be disabled
by defining NO_RELIABLE_PIPED_LOGS. At the moment reliable piped
logs is only available on Unix. [Dean Gaudet]
*) API: set_last_modified() broken into set_last_modified(), set_etag(), and
meets_conditions(). This allows conditional HTTP selection to be
handled separately from the storing of the header fields, and provides
the ability for CGIs to set their own ETags for conditional checking.
[Ken Coar, Roy Fielding] PR#895
*) Changes to mod_log_config to allow naming of format strings.
Format nicknames are defined with "LogFormat fmt nickname", and can
be used with "LogFormat nickname" and "CustomLog logtarget nickname".
[Ken Coar]
*) New module, "mod_speling", which can help find files even when
the URL is slightly misspelled. [Martin Kraemer, Alexei Kosut]
*) API: New function child_terminate() triggers the child process to
exit, while allowing the child finish what it needs to for the
current request first.
[Doug MacEachern, Alexei Kosut]
*) Windows now defaults to using full status reports with mod_status.
[Alexei Kosut] PR #1094
*) *Really* disable all mod_rewrite operations if the engine is off.
Some things (like RewriteMaps) were checked/performed even if they
weren't supposed to be. [Ken Coar] PR #991
*) Implement a new timer scheme which eliminates the need to call alarm() all
the time. Instead a counter in the scoreboard for each child is used to
show when the child has made forward progress. The parent samples this
counter every scoreboard maintenance cycle, and issues SIGALRM if no
progress has been made in the timeout period. This reduces the static
request best-case syscall count to 22 from 29. This scheme is only
used by systems with memory-based scoreboards. [Dean Gaudet]
*) The proxy now properly handles CONNECT requests which are sent
to proxy servers when using ProxyRemote. [Marc Slemko] PR#1024
*) A script called apachectl has been added to the support
directory. This script allows you to do things such as
"apachectl start" and "apachectl restart" from the command
line. [Marc Slemko]
*) Modules and core routines are now put into libraries, which
simplifies the link line tremendously (among other advantages).
[Paul Sutton]
*) Some of the MD5 names defined in Apache have been renamed to have
an `ap_' prefix to avoid conflicts with routines supplied by
external libraries. [Ken Coar]
*) Removal of mod_auth_msql.c from the distribution. There are many
other options for databases today. Rather than offer one option,
offer none at this time. mod_auth_msql and other SQL database
authentication modules can be found at the Apache Module Registry.
http://modules.apache.org/ It would be nice to offer a generic
mod_auth_sql option in the near future.
*) PORT: BeOS support added [Alexei Kosut]
*) Configure no longer accepts the -make option, since it creates
Makefile on the fly based on Makefile.tmpl and Configuration.
*) Apache now gracefully shuts down when it receives a SIGTERM, instead
of forcibly killing off all its processes and exiting without
cleaning up. [Alexei Kosut]
*) API: A new field in the request_rec, r->mtime, has been added to
avoid gratuitous parsing of date strings. It is intended to hold
the last-modified date of the resource (if applicable). An
update_mtime() routine has also been added to advance it if
appropriate. [Roy Fielding, Ken Coar]
*) SECURITY: If a htaccess file can not be read due to bad permissions,
deny access to the directory with a HTTP_FORBIDDEN. The previous
behavior was to ignore the htaccess file if it could not be read.
This change may make some setups with unreadable htaccess files
stop working. [Marc Slemko] PR#817
*) Add aplog_error() providing a mechanism to define levels of
verbosity to the server error logging. This addition also provides
the ability to log errors using syslogd. Error logging is configurable
on a per-server basis using the LogLevel directive. Conversion
of log_*() in progress. [Randy Terbush]
*) Further enhance aplog_error() to not log filename, line number, and
errno information when it isn't applicable. [Ken Coar, Dean Gaudet]
*) WIN32: Canonicalise filenames under Win32. Short filenames are
converted to long ones. Backslashes are converted to forward
slashes. Case is converted to lower. Parts of URLs that do not
correspond to files are left completely alone. [Ben Laurie]
*) PORT: 2 new OSs added to the list of ports:
Encore's UMAX V: Arieh Markel <amarkel@encore.com>
Acorn RISCiX: Stephen Borrill <sborrill@xemplar.co.uk>
*) Add the server version (SERVER_VERSION macro) to the "server
configured and running" entry in the error_log. Also build an
object file at link-time that contains the current time
(SERVER_BUILT global const char[]), and include that in the
message. [Ken Coar]
*) Set r->headers_out when sending responses from the proxy.
This fixes things such as the logging of headers sent from
the proxy. [Marc Slemko] PR#659
*) support/httpd_monitor is no longer distributed because the
scoreboard should not be file based if at all possible. Use