CHANGES

Changes with Apache 2.1.0-dev

  [Remove entries to the current 2.0 section below, when backported]

  *) mod_ext_filter: Set additional environment variables for use by
     the external filter.  PR 20944.  [Andrew Ho, Jeff Trawick]

  *) mod_actions: Introduce the "virtual" modifier to the Action directive,
     which allows the use of handlers for virtual locations. PR 8431.
     [André Malo]

  *) mod_speling: Recognize AcceptPathInfo setting for the particular
     location. Default is to reject path information. PR 21059.
     [André Malo]

  *) Update the header token parsing code to allow LWS between the
     token word and the ':' seperator.  [PR 16520]
     [submitted: Kris Verbeeck <kris.verbeeck@advalvas.be> and
                 Nicel KM <mnicel@yahoo.com>]
     [Reviewed: <coad@measurement-factory.com> and
                Paul J. Reder]

  *) mod_ext_filter: Add the ability to filter request bodies.
     [Philipp Reisner <philipp.reisner@linbit.com>]

  *) Correct the code in ap_check_cache_feshness to check max_age,
     smax_age, and expires correctly. Patch submitted by Thomas
     Castelle [Paul J. Reder]

  *) mod_cgid: Restart the cgid daemon if it crashes.  PR 19849
     [Glenn Nielsen <glenn@apache.org>]

  *) Unix: Handle permissions settings for flock-based mutexes in 
     unixd_set_global|proc_mutex_perms().  Allow the functions to be
     called for any type of mutex.  PR 20312  [Jeff Trawick]

  *) Fix some broken log messages in WinNT MPM.  
     [Juan Rivera <Juan.Rivera@citrix.com>]

  *) Add support for IMT minor-type wildcards (e.g., text/*) to
     ExpiresByType.  PR#7991  [Ken Coar]

  *) mod_rewrite: Fix LA-U variable look ahead which didn't work correctly
     in directory context. Related to PR 8493.  [André Malo]

  *) Ensure that ssl-std.conf is generated at configure time, and switch
     to using the expanded config variables to work the same as
     httpd-std.conf PR 19611
     [Thom May]

  *) Fix a problem with namespace mappings being dropped in mod_dav_fs; 
     if any property values were set which defined namespaces these 
     came out mangled in the PROPFIND response.  PR 11637.
     [Amit Athavale <amit_athavale@persistent.co.in>]

  *) prefork MPM: Use the right permissions for the directory created 
     for gprof support.  [Jim Carlson <jcarlson@jnous.com>]

  *) Fix the inability to log errors like exec failure in
     mod_ext_filter/mod_cgi script children.  This was broken after 
     such children stopped inheriting the error log handle.  
     [Jeff Trawick]

  *) Fix a compile failure with recent OpenSSL and picky compilers
     (e.g., OpenSSL 0.9.7a and xlc_r on AIX).  [Jeff Trawick]

  *) OpenSSL headers should be included as "openssl/ssl.h", and not rely on
     the INCLUDE path to be defined properly.
     PR 11310. [Geoff Thrope <geoff@geoffthorpe.net>]

  *) Modify APACHE_CHECK_SSL_TOOLKIT to detect SSL-C. [Madhusudan Mathihalli]

  *) Replace the APACHE_CHECK_SSL_TOOLKIT method with a cleaner one, using
     autoconf tools (AC_CHECK_HEADER, AC_CHECK_LIB etc). 
     [Geoff Thorpe <geoff@geoffthorpe.net>]

  *) change directive name from 'compressionlevel' to 'deflatecompressionlevel'
     [Ian Holsman, André Malo]

  *) mod_negotiation: quality values are now parsed independent from
     the current locale. level values are now really parsed as integers.
     PR 17564.  [André Malo]

  *) Added the WindowsSocketsWorkaround directive for Windows NT/2000/XP
     to work around problems with certain VPN and Firewall products that 
     have buggy AcceptEx implementations.
     [Allan Edwards w/ suggestions from Bill Stoddard & Bill Rowe]

  *) Extend mod_negotiation to evaluate the environment variables
     no-gzip and gzip-only-text/html the same way as mod_deflate does.
     [André Malo]

  *) mod_rewrite: Fix some problems reporting errors with mapping
     programs (RewriteMap prg:/something).  [Jeff Trawick]

  *) Return 413 if chunk-ext-header is too long rather than reading from
     the truncated line.  PR 15857.  [Justin Erenkrantz]

  *) Allow restart of httpd to occur even with syntax errors in the config
     file.  PR 16813.  [Justin Erenkrantz]

  *) Use APR_LAYOUT instead of APACHE_LAYOUT in configure.  PR 15679.
     [Justin Erenkrantz]

  *) Remove files on 'make distclean' that should be.  PR 15592.
     [Justin Erenkrantz]

  *) Allow apachectl to perform status with links and elinks as well.
     [Justin Erenkrantz]

  *) Extend the SetEnvIf directive to capture subexpressions of the
     matched value.  [André Malo]

  *) mod_log_config change optional hook to return previous handler
     [Ian Holsman]

  *) Forward port of mod_actions' ability to handle arbitrary methods
     with the Script directive.  [André Malo]

  *) Let suexec send a message to stderr, if it failed or its policy
     was violated. This message appears in the error log and allows
     for easier debugging. PR 5381, 7638, 8255, 10773.  [André Malo]

  *) Modify buildconf to copy all required files into httpd's tree.
     [Thom May <thom@planetarytramp.net>]

  *) Allow mod_dav to do weak entity comparison functions.
     [Justin Erenkrantz]

  *) Move RFC 1413 ident requests from core to new module mod_ident.
     [André Malo]

  *) Add mod_authz_owner - a forward port of "Require file-owner"
     and "Require file-group", which was already present in version
     1.3.21.  [André Malo]

  *) Add mod_dav_lock - a generic subset of the DAV locking implementation.
     [Justin Erenkrantz]

  *) Replace some of the mutex locking in the worker MPM with
     atomic operations for higher concurrency.  [Brian Pane]

  *) Allow 'make depend' to work with non-GCC compilers.
     [Justin Erenkrantz]

  *) If an httpd.conf has commented out AddModule directives, 
     apxs -i -a will add an un-commented AddModule directive for 
     the new module, which breaks the config.
     PR: 11212 [Joe Orton]

  *) Fix mod_proxy handling of filtered input bodies.  [Justin Erenkrantz]

  *) Move the check of the Expect request header field after the hook
     for ap_post_read_request, since that is the only opportunity for
     modules to handle Expect extensions.  [Justin Erenkrantz]

  *) Rewrite of aaa modules to an authn/authz model.
     [Dirk-Willem van Gulik, Justin Erenkrantz]


  [Apache 2.1.0-dev includes those bug fixes and changes with the
   Apache 2.0.xx tree as documented, and except as noted, below.]

Changes with Apache 2.0.48

  *) Added FreeBSD directory layout. PR 21100.
     [Sander Holthaus <info@orangexl.com>, André Malo]

  *) Fix NULL-pointer issue in ab when parsing an incomplete or non-HTTP
     response. PR 21085. [Glenn Nielsen <glenn@apache.org>, André Malo]

  *) mod_rewrite: Perform child initialization on the rewrite log lock.
     This fixes a log corruption issue when flock-based serialization
     is used (e.g., FreeBSD).  [Jeff Trawick]

  *) Don't respect the Server header field as set by modules and CGIs.
     As with 1.3, for proxy requests any such field is from the origin 
     server; otherwise it will have our server info as controlled by
     the ServerTokens directive.  [Jeff Trawick]

Changes with Apache 2.0.47

  *) SECURITY [CAN-2003-0192]: Fixed a bug whereby certain sequences
     of per-directory renegotiations and the SSLCipherSuite directive
     being used to upgrade from a weak ciphersuite to a strong one
     could result in the weak ciphersuite being used in place of the
     strong one.  [Ben Laurie]

  *) SECURITY [CAN-2003-0253]: Fixed a bug in prefork MPM causing
     temporary denial of service when accept() on a rarely accessed port
     returns certain errors.  Reported by Saheed Akhtar
     <S.Akhtar@talis.com>.  [Jeff Trawick]

  *) SECURITY [CAN-2003-0254]: Fixed a bug in ftp proxy causing denial
     of service when target host is IPv6 but proxy server can't create
     IPv6 socket.  Fixed by the reporter.  [Yoshioka Tsuneo
     <tsuneo.yoshioka@f-secure.com>]

  *) SECURITY [VU#379828] Prevent the server from crashing when entering
     infinite loops. The new LimitInternalRecursion directive configures