CHANGES

                                                         -*- coding: utf-8 -*-

Changes with Apache 2.3.9

  *) SECURITY: CVE-2010-1623 (cve.mitre.org)
     Fix a denial of service attack against mod_reqtimeout.
     [Stefan Fritsch]

  *) mod_cache: Support the caching of HEAD requests. [Graham Leggett]

  *) htcacheclean: Allow the option to round up file sizes to a given
     block size, improving the accuracy of disk usage. [Graham Leggett]

  *) mod_ssl: Add authz providers for use with mod_authz_core and its
     RequireAny/RequireAll containers: 'ssl' (equivalent to SSLRequireSSL),
     'ssl-verify-client' (for use with 'SSLVerifyClient optional'), and
     'ssl-require' (expressions with same syntax as SSLRequire).
     [Stefan Fritsch]

  *) mod_ssl: Make the ssl expression parser thread-safe. It now requires
     bison instead of yacc. [Stefan Fritsch]

  *) mod_disk_cache: Change on-disk header file format to support the
     link of the device/inode of the data file to the matching header
     file, and to support the option of not writing a data file when
     the data file is empty. [Graham Leggett]

  *) core/mod_unique_id: Add generate_log_id hook to allow to use
     the ID generated by mod_unique_id as error log ID for requests.

  *) mod_cache: Make sure that we never allow a 304 Not Modified response
     that we asked for to leak to the client should the 304 response be
     uncacheable. PR45341 [Graham Leggett]

  *) mod_cache: Add the cache_status hook to register the final cache
     decision hit/miss/revalidate. Add optional support for an X-Cache
     and/or an X-Cache-Detail header to add the cache status to the
     response. PR48241 [Graham Leggett]

  *) mod_authz_host: Add 'local' provider that matches connections originating
     on the local host. PR 19938. [Stefan Fritsch]

  *) Event MPM: Fix crash accessing pollset on worker thread when child
     process is exiting.  [Jeff Trawick]

  *) core: For process invocation (cgi, fcgid, piped loggers and so forth)
     pass the system library path (LD_LIBRARY_PATH or platform-specific
     variables) along with the system PATH, by default.  Both should be 
     overridden together as desired using PassEnv etc; see mod_env.
     [William Rowe]

  *) mod_cache: Introduce CacheStoreExpired, to allow administrators to
     capture a stale backend response, perform If-Modified-Since requests
     against the backend, and serving from the cache all 304 responses.
     This restores pre-2.2.4 cache behavior.  [William Rowe]

  *) mod_rewrite: Introduce <=, >= string comparison operators, and integer
     comparators -lt, -le, -eq, -ge, and -gt.  To help bash users and drop
     the ambiguity of the symlink test "-ltest", introduce -h or -L as
     symlink test operators.  [William Rowe]

  *) mod_cache: Give the cache provider the opportunity to choose to cache
     or not cache based on the buckets present in the brigade, such as the
     presence of a FILE bucket.
     [Graham Leggett]

  *) mod_authz_core: Allow authz providers to check args while reading the
     config and allow to cache parsed args. Move 'all' and 'env' authz
     providers from mod_authz_host to mod_authz_core. Add 'method' authz
     provider depending on the HTTP method.  [Stefan Fritsch]

  *) mod_include: Move the request_rec within mod_include to be
     exposed within include_ctx_t. [Graham Leggett]

  *) mod_include: Reinstate support for UTF-8 character sets by allowing a
     variable being echoed or set to be decoded and then encoded as separate
     steps. PR47686 [Graham Leggett]

  *) mod_cache: Add a discrete commit_entity() provider function within the
     mod_cache provider interface which is called to indicate to the
     provider that caching is complete, giving the provider the opportunity
     to commit temporary files permanently to the cache in an atomic
     fashion. Replace the inconsistent use of error cleanups with a formal
     set of pool cleanups attached to a subpool, which is destroyed on error.
     [Graham Leggett]

  *) mod_cache: Change the signature of the store_body() provider function
     within the mod_cache provider interface to support an "in" brigade
     and an "out" brigade instead of just a single input brigade. This
     gives a cache provider the option to consume only part of the brigade
     passed to it, rather than the whole brigade as was required before.
     This fixes an out of memory and a request timeout condition that would
     occur when the original document was a large file. Introduce
     CacheReadSize and CacheReadTime directives to mod_disk_cache to control
     the amount of data to attempt to cache at a time. [Graham Leggett]

  *) core: Add ErrorLogFormat to allow configuring error log format, including
     additional information that is logged once per connection or request. Add
     error log IDs for connections and request to allow correlating error log
     lines and the corresponding access log entry. [Stefan Fritsch]

  *) core: Disable sendfile by default. [Stefan Fritsch]

  *) mod_cache: Check the request to determine whether we are allowed
     to return cached content at all, and respect a "Cache-Control:
     no-cache" header from a client. Previously, "no-cache" would
     behave like "max-age=0". [Graham Leggett]

  *) mod_cache: Use a proper filter context to hold filter data instead
     of misusing the per-request configuration. Fixes a segfault on trunk
     when the normal handler is used. [Graham Leggett]

  *) mod_cgid: Log a warning if the ScriptSock path is truncated because
     it is too long. PR 49388.  [Stefan Fritsch]

  *) vhosts: Do not allow _default_ in NameVirtualHost, or mixing *
     and non-* ports on NameVirtualHost, or multiple NameVirtualHost
     directives for the same address:port, or NameVirtualHost
     directives with no matching VirtualHosts, or multiple ip-based
     VirtualHost sections for the same address:port.  These were
     previously accepted with a warning, but the behavior was
     undefined.  [Dan Poirier]

  *) mod_remoteip: Fix a segfault when using mod_remoteip in conjunction with
     Allow/Deny. PR 49838.  [Andrew Skalski <voltara gmail.com>]

  *) core: DirectoryMatch can now match on the end of line character ($),
     and sub-directories of matched directories are no longer implicitly
     matched.  PR49809 [Eric Covener]

  *) Regexps: introduce new higher-level regexp utility including parsing
     and executing perl-style regexp ops (e.g s/foo/bar/i) and regexp memory
     [Nick Kew]

Changes with Apache 2.3.8

  *) suexec: Support large log files. PR 45856. [Stefan Fritsch]

  *) core: Abort with sensible error message if no or more than one MPM is
     loaded. [Stefan Fritsch]

  *) mod_proxy: Rename erroronstatus to failonstatus.
     [Daniel Ruggeri <DRuggeri primary.net>]

  *) mod_dav_fs: Fix broken "creationdate" property.
     Regression in version 2.3.7. [Rainer Jung]

Changes with Apache 2.3.7

  *) SECURITY: CVE-2010-1452 (cve.mitre.org)
     mod_dav, mod_cache, mod_session: Fix Handling of requests without a path 
     segment. PR: 49246 [Mark Drayton, Jeff Trawick]

  *) mod_ldap: Properly check the result returned by apr_ldap_init. PR 46076.
     [Stefan Fritsch]

  *) mod_rewrite: Log errors if rewrite map files cannot be opened. PR 49639.
     [Stefan Fritsch]

  *) mod_proxy_http: Support the 'ping' property for backend HTTP/1.1 servers
     via leveraging 100-Continue as the initial "request".
     [Jim Jagielski]

  *) core/mod_authz_core: Introduce new access_checker_ex hook that enables
     mod_authz_core to bypass authentication if access should be allowed by
     IP address/env var/... [Stefan Fritsch]
 
  *) core: Introduce note_auth_failure hook to allow modules to add support
     for additional auth types. This makes ap_note_auth_failure() work with
     mod_auth_digest again. PR 48807. [Stefan Fritsch]

  *) socache modules: return APR_NOTFOUND when a lookup is not found [Nick Kew]

  *) mod_authn_cache: new module [Nick Kew]

  *) configure: Add reallyall option for --enable-mods-shared. [Stefan Fritsch]

  *) Fix Windows build when using VC6. [Gregg L. Smith <lists glewis com>]

  *) mod_rewrite: Allow to set environment variables without explicitly
     giving a value. [Rainer Jung]

  *) mod_rewrite: Remove superfluous EOL from rewrite logging. [Rainer Jung]

  *) mod_include: recognise "text/html; parameters" as text/html
     PR 49616 [Andrey Chernov <ache nagual.pp.ru>]

  *) CGI vars: allow PATH to be set by SetEnv, consistent with LD_LIBRARY_PATH
     PR 43906 [Nick Kew]

  *) Core: Extra robustness: don't try authz and segfault if authn
     fails to set r->user.  Log bug and return 500 instead.
     PR 42995 [Nick Kew]

  *) HTTP protocol filter: fix handling of longer chunk extensions
     PR 49474 [<tee.bee gmx.de>]

  *) Update SSL cipher suite and add example for SSLHonorCipherOrder.
     [Lars Eilebrecht, Rainer Jung]