CHANGES

Changes with Apache 2.1.0-dev

  [Remove entries to the current 2.0 section below, when backported]

  *) Update the header token parsing code to allow LWS between the
     token word and the ':' seperator.  [PR 16520]
     [submitted: Kris Verbeeck <kris.verbeeck@advalvas.be> and
                 Nicel KM <mnicel@yahoo.com>]
     [Reviewed: <coad@measurement-factory.com> and
                Paul J. Reder]

  *) mod_ext_filter: Add the ability to filter request bodies.
     [Philipp Reisner <philipp.reisner@linbit.com>]

  *) Fix NULL-pointer issue in ab when parsing an incomplete or non-HTTP
     response. PR 21085. [Glenn Nielsen <glenn@apache.org>, André Malo]

  *) Added FreeBSD directory layout. PR 21100.
     [Sander Holthaus <info@orangexl.com>, André Malo]

  *) Correct the code in ap_check_cache_feshness to check max_age,
     smax_age, and expires correctly. Patch submitted by Thomas
     Castelle [Paul J. Reder]

  *) mod_cgid: Restart the cgid daemon if it crashes.  PR 19849
     [Glenn Nielsen <glenn@apache.org>]

  *) Unix: Handle permissions settings for flock-based mutexes in 
     unixd_set_global|proc_mutex_perms().  Allow the functions to be
     called for any type of mutex.  PR 20312  [Jeff Trawick]

  *) Fix some broken log messages in WinNT MPM.  
     [Juan Rivera <Juan.Rivera@citrix.com>]

  *) Add support for IMT minor-type wildcards (e.g., text/*) to
     ExpiresByType.  PR#7991  [Ken Coar]

  *) mod_rewrite: Fix LA-U variable look ahead which didn't work correctly
     in directory context. Related to PR 8493.  [André Malo]

  *) Ensure that ssl-std.conf is generated at configure time, and switch
     to using the expanded config variables to work the same as
     httpd-std.conf PR 19611
     [Thom May]

  *) Fix a problem with namespace mappings being dropped in mod_dav_fs; 
     if any property values were set which defined namespaces these 
     came out mangled in the PROPFIND response.  PR 11637.
     [Amit Athavale <amit_athavale@persistent.co.in>]

  *) prefork MPM: Use the right permissions for the directory created 
     for gprof support.  [Jim Carlson <jcarlson@jnous.com>]

  *) Fix the inability to log errors like exec failure in
     mod_ext_filter/mod_cgi script children.  This was broken after 
     such children stopped inheriting the error log handle.  
     [Jeff Trawick]

  *) Fix a compile failure with recent OpenSSL and picky compilers
     (e.g., OpenSSL 0.9.7a and xlc_r on AIX).  [Jeff Trawick]

  *) OpenSSL headers should be included as "openssl/ssl.h", and not rely on
     the INCLUDE path to be defined properly.
     PR 11310. [Geoff Thrope <geoff@geoffthorpe.net>]

  *) Modify APACHE_CHECK_SSL_TOOLKIT to detect SSL-C. [Madhusudan Mathihalli]

  *) Replace the APACHE_CHECK_SSL_TOOLKIT method with a cleaner one, using
     autoconf tools (AC_CHECK_HEADER, AC_CHECK_LIB etc). 
     [Geoff Thorpe <geoff@geoffthorpe.net>]

  *) change directive name from 'compressionlevel' to 'deflatecompressionlevel'
     [Ian Holsman, André Malo]

  *) mod_negotiation: quality values are now parsed independent from
     the current locale. level values are now really parsed as integers.
     PR 17564.  [André Malo]

  *) Added the WindowsSocketsWorkaround directive for Windows NT/2000/XP
     to work around problems with certain VPN and Firewall products that 
     have buggy AcceptEx implementations.
     [Allan Edwards w/ suggestions from Bill Stoddard & Bill Rowe]

  *) Extend mod_negotiation to evaluate the environment variables
     no-gzip and gzip-only-text/html the same way as mod_deflate does.
     [André Malo]

  *) mod_rewrite: Fix some problems reporting errors with mapping
     programs (RewriteMap prg:/something).  [Jeff Trawick]

  *) Return 413 if chunk-ext-header is too long rather than reading from
     the truncated line.  PR 15857.  [Justin Erenkrantz]

  *) Allow restart of httpd to occur even with syntax errors in the config
     file.  PR 16813.  [Justin Erenkrantz]

  *) Use APR_LAYOUT instead of APACHE_LAYOUT in configure.  PR 15679.
     [Justin Erenkrantz]

  *) Remove files on 'make distclean' that should be.  PR 15592.
     [Justin Erenkrantz]

  *) Allow apachectl to perform status with links and elinks as well.
     [Justin Erenkrantz]

  *) Extend the SetEnvIf directive to capture subexpressions of the
     matched value.  [André Malo]

  *) mod_log_config change optional hook to return previous handler
     [Ian Holsman]

  *) Forward port of mod_actions' ability to handle arbitrary methods
     with the Script directive.  [André Malo]

  *) Let suexec send a message to stderr, if it failed or its policy
     was violated. This message appears in the error log and allows
     for easier debugging. PR 5381, 7638, 8255, 10773.  [André Malo]

  *) Modify buildconf to copy all required files into httpd's tree.
     [Thom May <thom@planetarytramp.net>]

  *) Allow mod_dav to do weak entity comparison functions.
     [Justin Erenkrantz]

  *) Move RFC 1413 ident requests from core to new module mod_ident.
     [André Malo]

  *) Add mod_authz_owner - a forward port of "Require file-owner"
     and "Require file-group", which was already present in version
     1.3.21.  [André Malo]

  *) Add mod_dav_lock - a generic subset of the DAV locking implementation.
     [Justin Erenkrantz]

  *) Replace some of the mutex locking in the worker MPM with
     atomic operations for higher concurrency.  [Brian Pane]

  *) Allow 'make depend' to work with non-GCC compilers.
     [Justin Erenkrantz]

  *) If an httpd.conf has commented out AddModule directives, 
     apxs -i -a will add an un-commented AddModule directive for 
     the new module, which breaks the config.
     PR: 11212 [Joe Orton]

  *) Fix mod_proxy handling of filtered input bodies.  [Justin Erenkrantz]

  *) Move the check of the Expect request header field after the hook
     for ap_post_read_request, since that is the only opportunity for
     modules to handle Expect extensions.  [Justin Erenkrantz]

  *) Rewrite of aaa modules to an authn/authz model.
     [Dirk-Willem van Gulik, Justin Erenkrantz]


  [Apache 2.1.0-dev includes those bug fixes and changes with the
   Apache 2.0.xx tree as documented, and except as noted, below.]

Changes with Apache 2.0.48

  *) mod_rewrite: Perform child initialization on the rewrite log lock.
     This fixes a log corruption issue when flock-based serialization
     is used (e.g., FreeBSD).  [Jeff Trawick]

  *) Don't respect the Server header field as set by modules and CGIs.
     As with 1.3, for proxy requests any such field is from the origin 
     server; otherwise it will have our server info as controlled by
     the ServerTokens directive.  [Jeff Trawick]

Changes with Apache 2.0.47

  *) SECURITY [CAN-2003-0192]: Fixed a bug whereby certain sequences
     of per-directory renegotiations and the SSLCipherSuite directive
     being used to upgrade from a weak ciphersuite to a strong one
     could result in the weak ciphersuite being used in place of the
     strong one.  [Ben Laurie]

  *) SECURITY [CAN-2003-0253]: Fixed a bug in prefork MPM causing
     temporary denial of service when accept() on a rarely accessed port
     returns certain errors.  Reported by Saheed Akhtar
     <S.Akhtar@talis.com>.  [Jeff Trawick]

  *) SECURITY [CAN-2003-0254]: Fixed a bug in ftp proxy causing denial
     of service when target host is IPv6 but proxy server can't create
     IPv6 socket.  Fixed by the reporter.  [Yoshioka Tsuneo
     <tsuneo.yoshioka@f-secure.com>]

  *) SECURITY [VU#379828] Prevent the server from crashing when entering
     infinite loops. The new LimitInternalRecursion directive configures
     limits of subsequent internal redirects and nested subrequests, after
     which the request will be aborted.  PR 19753 (and probably others).
     [William Rowe, Jeff Trawick, André Malo]

  *) core_output_filter: don't split the brigade after a FLUSH bucket if
     it's the last bucket.  This prevents creating unneccessary empty
     brigades which may not be destroyed until the end of a keepalive
     connection.
     [Juan Rivera <Juan.Rivera@citrix.com>]

  *) Add support for "streamy" PROPFIND responses.