CHANGES

     'q' is silently "demoted" to long). [Jim Jagielski]

  *) When the username or password fed to htpasswd is too long, include the
     size limit in the error message.  Also report illegal characters
     (currently only ':') in the username.  Add the size restrictions
     to the man page.  [Ken Coar]

  *) Fixed the configure --without-support option so it doesn't result in
     an infinite loop.  [Marc Slemko]

  *) Piped error logs could cause a segfault if an error occured
     during configuration after a restart.
     [Aidan Cully <aidan@panix.com>] PR#4456

  *) If a "Location" field was stored in r->err_headers_out rather
     than r->headers_out, redirect processing wouldn't find it and
     the server would core dump on ap_escape_html(NULL).  Check both
     tables and raise HTTP_INTERNAL_SERVER_ERROR with a log message
     if Location isn't set.  [Doug MacEachern, Ken Coar]

  *) Add RULE_EXPAT, the src/lib/ directory structure, and a modified copy
     of the Expat 1.0.2 distribution. [Greg Stein]

  *) Replace regexec() calls with calls to a new API stub function
     ap_regexec().  This solves problems with DSO modules which use the regex
     library. [Jens-Uwe Mager <jum@helios.de>, Ralf S. Engelschall]

  *) Add 'Request_Protocol' special keyword to mod_setenvif so that
     environment variables can be set according to the protocol version
     (e.g., HTTP/0.9 or HTTP/1.1) of the request.  [Ken Coar]

  *) Add DSO support for OpenStep (Mach 4.2) platform.
     [Ralf S. Engelschall, Rex Dieter <rdieter@math.unl.edu>] PR#3997

  *) Fix sed regex for generating ap_config_auto.h in src/Configure.
     [Jan Gallo <gallo@pvt.sk>] PR#3690, PR#4373
 
  *) Switch to /bin/sh5 in APACI on Ultrix and friends to avoid problems with
     their brain-dead /bin/sh. [Ralf S. Engelschall] PR#4372

  *) Better DSO flags recognition on NetBSD platforms using ELF.
     [Todd Vierling <tv@pobox.com>] PR#4310

  *) Always log months in english format for %t in mod_log_config.
     [Petr Lampa <lampa@fee.vutbr.cz>] PR#4366, 679

  *) Support for server-parsed and multiview-determined ReadmeName and
     HeaderName files in mod_autoindex. Removed the restriction on
     "/"s in ReadmeName and HeaderName directives since the *sub_req*
     routines will deal with the access issues. (It's now possible to
     have {site|group|project|customer|...} wide readmes and headers.)
     [Raymond S Brand <rsbx@rsbx.net>, Ken Coar] PR#1574, 3026, 3529,
     3569, 4256

  *) When stat() fails, don't assume anything about the contents of
     the struct stat.  [Ed Korthof <ed@bitmechanic.com>]

  *) It's OK for a semop to return EINTR, just loop around and try
     again.  [Dean Gaudet]

  *) Fix configuration engine re-entrant hangups, which solve a
     handful of problems seen with mod_perl <Perl> configuration sections
     [Salvador Ortiz Garcia <sog@msg.com.mx>]

  *) Mac OS and Mac OS X Server now use the appropriate custom layout
     by default when building with APACI; allow for platform-specific
     variable defaults in configure. [Wilfredo Sanchez]

  *) Do setgid() before initgroups() in http_main; some platforms
     zap the grouplist when setgid() is called.  This was fixed in
     suexec earlier, but the main httpd code missed the change.
     [Rob Saccoccio <robs@InfiniteTechnology.com>]  PR#2579

  *) Add recognition of .tgz as a gzipped tarchive.
     [Bertrand de Singly <bertrand.de-singly@polytechnique.fr>]  PR#2364

  *) mod_include's fsize/flastmod should allow only relative paths, just
     like "include file".  [Jaroslav Benkovsky <benkovsk@pha.pvt.cz>]

  *) OS/2: Add support for building loadable modules using DLLs.
     [Brian Havard]

  *) Add iconsdir, htdocsdir, and cgidir to config.layout.
     [Wilfredo Sanchez]

  *) Fix minor but annoying bug with the test for Configuration.tmpl
     being newer than Configuration so that it is less likely to fail
     when using APACI and shadow sources. [Wilfredo Sanchez]

  *) PORT: Add initial support for Mac OS (versions 10.0 and
     greater). Use Mac OS X Server layout for now. Clean up dyld code
     in unix/os.c, and don't install the dyld error handlers, which
     are no longer needed in Mac OS. [Wilfredo Sanchez]

  *) Rename Rhapsody layout to "Mac OS X Server". Change install
     locations to appropriate ones for user-built (as opposed to
     system) installs. [Wilfredo Sanchez]

  *) Modify mod_autoindex's handling of AddDescription so that the
     behaviour matches the documentation.  [Ken Coar] PR#1898, 3072.

  *) Add functionality to the install-bindist.sh script created by
     binbuild.sh to use tar when copying distribution files to the
     serverroot. This allows upgrading an existing installation
     without nesting the new distribution in the old.

     install-bindist.sh now detects the local perl5 path to install
     apxs and dbmmanage with proper path to perl interpreter.

     Add an install-binsupport target which copies the source files
     for apxs and dbmmanage to bindist to allow these scripts to
     be properly installed relative to the destination serverroot.
     [Randy Terbush, Covalent Technologies, randy@covalent.net]

  *) Fix intermittent SEGV in ap_proxy_cache_error() in
     src/modules/proxy_util.c where a NULL filepointer and
     temporary filename were closed and unlinked.
     [Graham Leggett <minfrin@sharp.fm>,
     Tim Costello <tjcostel@socs.uts.edu.au>] PR#3178

  *) Fix inconsistent error messages reported by mod_proxy.
     [Graham Leggett <minfrin@sharp.fm>]

  *) OS/2: Fix terminating CGIs that aren't compiled by EMX GCC when a 
     connection is aborted.  [Brian Havard]

  *) Force the LANG envariable to the known state of "C" so that we
     have assurance about how string manipulators (e.g., tr) will
     function.  [Ken Coar]  PR#1630

  *) Add a directive to allow customising of the tracking cookie name.
     [Ken Coar]  PR#2921, 4303

  *) Add "force-no-vary" envariable to allow servers to work around
     clients that choke on "Vary" fields in the response header.
     [Ken Coar, Dmitry Khrustalev <dima@zippy.machaon.ru>]  PR#4118

  *) Fixed a bug in mod_dir that causes a child process will infinitely
     recurse when it attemps to handle a request for a directory wnd the
     value of the DirectoryIndex directive is a single dot. Also likely
     to happen for anyother values of DirectoryIndex that will map back
     to the same directory. The handler now only considers regular files
     as being index candidates. No PR#s found.
     [Raymond S Brand <rsbx@rsbx.net>]

  *) Ease configuration debugging by making TestCompile fall back to
     using "make" if the $MAKE variable is unset [Martin Kraemer]

  *) Fixed the ServerSignature directive to work as documented.
     [Raymond S Brand <rsbx@rsbx.net>] PR#4248

  *) Add "opt" (SysV-style) layout to config.layout. [Raymond S Brand
     <rsbx@rsbx.net>]

  *) Add APACI --without-execstrip option which can be used to disable the
     stripping of executables on installation.  This is very important for DSO
     and debugging situations. [Ralf S. Engelschall]

  *) Add support for OS/2 (case insenstive filesystem, .exe suffix, etc)
     to APACI files and related scripts. 
     [Yitzchak Scott-Thoennes <sthoenna@efn.org>, Ralf S. Engelschall] PR#4269

  *) Add support for standalone mode in TPF
     [Joe Moenich <moenich@us.ibm.com>]

  *) Fix number of bytes copied by read_connection() in src/support/ab.c
     [Jim Cox <jc@superlink.net>] PR#4271

  *) Fix special RewriteCond "-s" pattern matching.
     [Bob Finch <bob@nas.com>]

  *) Fix value quoting in src/Configure script for ap_config_auto.h 
     [Paul Sutton <paul@awe.com>]

  *) Make sure RewriteLock can be used only in the global context, (i.e.
     outside of any <VirtualHost> sections) because it's a global facility of
     the rewrite engine. [Ralf S. Engelschall]

  *) Fix the ownership delegation for proxy directory under `make install'.
     [Ralf S. Engelschall]

  *) APACI would not correctly build suexec. [Maria Verina
     <mariav@icgeb.trieste.it>] PR#4260

  *) mod_mime_magic passed only the first 4k of a file to
     uncompress/gzip, but those tools sometimes do not produce
     any output unless a sufficient portion of the compressed
     file is input.  Change to pass the entire file -- but
     only read 4k of output.
     [Marcin Cieslak <saper@system.pl>] PR#4097

  *) "IndexOptions None" generated extra spaces at the end of each
     line.  [inkling@firstnethou.com] PR#3770

  *) The "100 Continue" response wasn't being sent after internal
     redirects. [Jose KAHAN <kahan@w3.org>] PR#3910, 3806, 3575

  *) When padding the name with spaces for display, mod_autoindex would
     count &, <, and > in their escaped width, messing up the display.
     [Dean Gaudet] PR#4075, 3758

  *) PORT: fixed a compilation problem on NEXT.
     [Jacques Distler <distler@golem.ph.utexas.edu>] PR#4130

  *) r->request_time wasn't being set properly in certain error conditions.
     [Dean Gaudet] PR#4156

  *) PORT: deal with UTS compiler error in http_protocol.c
     [Dave Dykstra <dwd@bell-labs.com>] PR#4189

  *) Add ap_vrprintf() function.  [John Tobey <jtobey@banta-im.com>] PR#4246

  *) Fix the mod_mime hash table to work properly with locales other
     than C.  [Dean Gaudet] PR#3427

  *) Fix a memory leak which is exacerbated by certain configurations.
     [Dean Gaudet] PR#4225

  *) Prevent clobbering saved IFS values in APACI. [Jim Jagielski]

  *) Fix buffer overflows in ap_uuencode and ap_uudecode pointed out
     by "Peter 'Luna' Altberg <peter@altberg.nu>" and PR#3422
     [Peter 'Luna' Altberg <peter@altberg.nu>, Ronald Tschalär]

  *) Make {Set,Unset,Pass}Env per-directory instead of per-server.
     [Ben Laurie]

  *) Correct an apparent typo: on the Windows and MPE platforms, the
     htpasswd utility was limiting passwords to only 8 characters.
     [Ken Coar]

  *) EBCDIC platforms: David submitted patches for two bugs in the
     MD5 digest port for EBCDIC machines:
     a) the htdigest utility overwrote the old contents of the digest file
     b) the Content-MD5 header value (ContentDigest directive) was wrong
     when the returned file was not converted from EBCDIC, but was a
     binary (e.g., image file) in the first place.
     [David McCreedy <mccreedy@us.ibm.com>]

  *) support/htpasswd now permits the password to be specified on the
     command line with the '-b' switch.  This is useful when passwords
     need to be maintained by scripts -- particularly in the Win32
     environment.  [Ken Coar]

  *) Win32: Win32 multiple services patch. Added capability to install and
     run multiple copies of apache as individual services.

     Example 1:
     apache -n apache1 -i -f c:/httpd.conf
        Installs apache as service 'apache1' and associates c:/httpd.conf
        with that service.
     net start apache1
        Starts apache1 service.
     net stop apache1
        Stops apache1 service

     Example 2:
     apache -n apache2 -i
        Installs apache as service 'apache2'. httpd.conf is located under
        the default server root (/apache/conf/httpd.conf).
     net start apache2
        Starts apache2 service.

     Example 3:
     apache -n apache3 -i -d c:/program files/apache
        Install apache as service 'apache3' and sets server root to
        c:/program files/apache.

     Example 4:
     apache -n apache2 -k restart
        Restart apache2 service 

     [Keith Wannamaker, Ken Parzygnat, Bill Stoddard]

  *) Correct the signed/unsigned character handling for the MD5 routines;
     mismatches were causing compilation problems with gcc -pedantic and
     in the TPF cross-compilation.  [Ken Coar]

  *) OS/2: Rework CGI handling to use spawn*() instead of fork/exec, achieving
     a roughly 5 fold speed up. [Brian Havard]

  *) proxy ftp: instead of using the hardwired string "text/plain" as
     a fallback type for files served by the ftp proxy, use the
     ap_default_type() function to determine the configured type.
     This allows for special configurations like
        <Directory proxy:ftp://some.host>
        DefaultType gargle/blurb
        </Directory>
     Additionally, add the Content-Encoding: header to FTP proxy replies
     when the encoding is defined (by the AddEncoding directive).
     Because it was missing, it was almost impossible to browse compressed
     files using the FTP proxy (works now perfectly in Communicator).
     The ftp proxy now also returns the Date: and Server: header lines (if not
     much else... This code is "somewhat" broken) like normal requests do.
     [Martin Kraemer]

  *) Be more smart in APACI's configure script when determining the UID/GID
     for User/Group directives and use the determined UID/GID to initialize
     the permissions on the proxycachedir.
     [Dirk-Willem van Gulik, Ralf S. Engelschall]

  *) Changed the forking-prior-to-cleanup in the proxy module to first
     check wether it actually needs to collect garbage. This reduces 
     the number of fork()s from one/request to just the odd one an hour.
     [Dirk-Willem van Gulik]

  *) Added proxy, auth and header support to src/support/ab.c. Added a
     README file to src/support/
     [Dirk-Willem van Gulik]

  *) Don't hard-code the path to AWK in --shadow bootstrapping Makefile.
     [Ralf S. Engelschall] PR#4050

  *) Add support for DSO module compilation on BSD/OS 3.x.
     [Randy Terbush, Covalent Technologies]

  *) Fix sed-substitutions in `make install': path elements like `httpd/conf'
     (for instance from an APACI configure --sysconfdir=/etc/httpd/conf
     option) were substituted with $(TARGET).conf, etc. Same for other strings
     with dots where the dot wasn't matched as plain text. 
     [Ralf S. Engelschall]

  *) PORT: Add support for FreeBSD 4.x [Ralf S. Engelschall]

  *) Fix verbose output of APACI configure (option -v) 
     [Martin Kraemer, Ralf S. Engelschall]

Changes with Apache 1.3.6

  *) Removed new PassAllEnv code due to DSO problems. [Lars Eilebrecht]

Changes with Apache 1.3.5 [not released]

  *) M_INVALID needed a value within the scope of METHODS so that unknown
     methods can be access controlled.  [Roy Fielding] PR#3821

  *) Added PassAllEnv; makes server's entire environment available
     to CGIs and SSIs executed within directive's scope.  [Ken Coar]

  *) ap_uuencode() always added two trailing '='s and encoding of
     8 bit characters on a machine with signed char may produced
     incorrect results. Additionally ap_uuencode() should now
     work correctly on EBCDIC platforms.
     [Ronald Tschalär <ronald@innovation.ch>] PR#3411

  *) WIN32: Binary installer now runs the configuration DLL before
     the reboot prompt (which is only given if MSVCRT.DLL system
     DLL is new or updated). This should avoid the configuration
     directory being empty after installation. [Paul Sutton]
     PR#3767, 3800, 3827, 3850, 3900, 3953, 3988

  *) WIN32: Binary installer now creates Start menu options to start
     and stop Apache as a console application and to uninstall
     the Apache service on NT. [Paul Sutton] PR#3741

  *) WIN32: Apache.exe now contains an icon. [Paul Sutton]

  *) PORT: Switch back to using fcntl() locking on Linux -- instabilities
     have been reported with flock() locking (probably related to kernel
     version).  [Dean Gaudet] PR#2723, 3531

  *) Using APACI, the main config file (usually httpd.conf) was
     not being adjusted as $(TARGET).conf. [Wilfredo Sanchez
     <wsanchez@apple.com>]

  *) PORT: AIX does not require the SHARED_CODE "hack"
     [Ryan Bloom <rbb@raleigh.ibm.com>]

  *) Set-Cookie headers were being doubled up for some CGIs by the O(n^2)
     avoidance code added in 1.3.3.
     [Dean Gaudet, Jeff Lewis <lewis@stanford.edu>] PR#3872

  *) ap_isxdigit was somehow neglected when adding the ap_isfoo() macros
     for 8-bit safeness.  [Dean Gaudet]

  *) PORT: Use -fPIC instead of -fpic on Solaris and SunOS for compiling DSOs
     because SPARCs have a small machine-specific maximum size for the Global
     Offset Table which is often exceeded when compiling one of the larger
     third-party modules with Apache. [Peter Urban <Peter.Urban@epfl.ch>] PR#3977

  *) Move the directive `ExtendedStatus' in httpd.conf-dist-win _after_ the
     DSO/DLL section because it's a directive from mod_status and isn't
     available before the DLL of mod_status is loaded.
     [Martin POESCHL <mpoeschl@gmx.net>] PR#3936

  *) SECURITY: Fix a bug in the calculation of the buffer size for the line 
     continuation facility in Apache's configuration files which could 
     lead to a buffer overflow situation.
     [Thomas Devanneaux <Thomas.Devanneaux@enst.fr>] PR#3617

  *) Make documentation and error messages of APACI's --activate-module=FILE 
     option more clear. [Jan Wolter <janc@wwnet.net>] PR#3995

  *) Fix the gcc version check (for enabling the `inline' facility) to 
     really support all future gcc versions >= 2.7 until we know more.
     [John Tobey <jtobey@banta-im.com>] PR#3983

  *) Let APACI's configure script correctly complain for unknown --enable-XXX
     and --disable-XXX options. [Ralf S. Engelschall] PR#3958

  *) Link the shared core bootstrap program (``Rule SHARED_CORE=yes'') also
     against libap.a and use its ap_snprintf() instead of sprintf() to avoid
     possible buffer overflows. [Ralf S. Engelschall]

  *) Remove no longer used non-API function ap_single_module_init().
     [Ralf S. Engelschall]

  *) Add Apple's Mac OS X Server Layout "Rhapsody" to config.layout.
     [Wilfredo Sanchez]

  *) Add cgidir, htdocsdir, iconsdir variables to Makefile.tmpl in order
     to make platform installations easier.  [Wilfredo Sanchez]

  *) In configure, do not append the target name to the directory path if
     the path already contains "apache".  [Ralf S. Engelschall]

  *) SIGPIPE is now ignored by the server core.  The request write routines
     (ap_rputc, ap_rputs, ap_rvputs, ap_rwrite, ap_rprintf, ap_rflush) now
     correctly check for output errors and mark the connection as aborted.
     Replaced many direct (unchecked) calls to ap_b* routines with the
     analogous ap_r* calls.  [Roy Fielding]

  *) Enhanced mod_rewrite's mapfile handling: The in-core cache for text and
     DBM format mapfiles now uses a 4-way hash table with LRU functionality.
     Furthermore map lookups for non-existent keys are now cached as well.
     Additionally "txt" maps are now parsed with simple string functions
     instead of using ap_pregcomp(). As a side effect a bug that prevented
     the usage of keys containing the "," character was fixed.
     The changes drastically improve the performance when large rewrite maps
     are in use.
     [Michael van Elst <mlelstv@serpens.swb.de>, Lars Eilebrecht] PR#3160

  *) Added ap_sub_req_method_uri() for doing a subrequest with a method
     other than GET, and const'd the definition of method in request_rec.
     [Greg Stein]

  *) Use proper pid_t type for saving PIDs in alloc.c.  [John Bley]

  *) Replaced use of WIN32 define with HAVE_DRIVE_LETTERS to indicate
     when the OS allows a DOS drive letter within pathnames.  [Brian Havard]

  *) Add %V to mod_log_config, this logs the hostname according to the
     UseCanonicalName setting (this is the pre-1.3.4 behaviour of
     %v).  Useful for mass vhosting.  [Tony Finch <dot@dotat.at>]

  *) Add support for \n and \t to mod_log_config, can be used to produce
     more reliable logs with multiline entries.  [Tony Finch <dot@dotat.at>]

  *) Fixed a few compiler nits.  [John Bley <jbb6@acpub.duke.edu>]

  *) Added informative error messages for failed munmap() and fseek() calls
     in http_core.c. [John Bley, Roy Fielding]

  *) Added some informative error messages for some failed malloc()
     calls. [John Bley <jbb6@acpub.duke.edu>, Jim Jagielski]

  *) OS/2 ap_os_canonical_filename()'s behaviour is improved: ap_assert()
     is removed. This allows <Directory proxy:*> directives to work and
     prevents invalid requests from killing the process.
     [Brian Havard <brianh@kheldar.apana.org.au>]

  *) Reorganised FAQ document.
     [Joshua Slive <slive@finance.commerce.ubc.ca>] PR#2497

  *) src/support/: The ApacheBench benchmark program was overhauled by
     David N. Welton: you can now have it generate an HTML TABLE, presumably
     for integration into other HTML sources. David updated the ab man page
     as well and added some missing descriptions. Thanks!
     [David N. Welton <davidw@prosa.it>]

  *) Win32: The filename validity checker now allows filenames containing
     characters in the range 0x80 to 0xff (for example accented characters).
     [Paul Sutton] PR#3890

  *) Added conditional logging based upon environment variables to
     mod_log_config.  mod_log_referer and mod_log_agent
     are now deprecated.  [Ken Coar]

  *) Allow apache acting as a proxy server to relay the real
     reason of a failure to a client rather than the "internal
     server error" it does currently. The general exposure mechanism
     can be triggered by any module by setting the "verbose-error-to"
     note to "*"; this allows more than just proxy errors to be exposed.
     [Cliff Skolnick, Roy Fielding, Martin Kraemer] Related to PR#3455, 4086

  *) Moved man pages for ab and apachectrl to section 8.
     [Wilfredo Sanchez, Roy Fielding]

  *) Added -S option to install.sh so that options can be passed to
     strip on some platforms. [Ralf S. Engelschall, Wilfredo Sanchez]

  *) Tweak modules Makefile generated by Configure so that it handles
     the test case of no modules being selected. [chaz@reliant.com]

  *) Added a <LimitExcept method ...> sectioning directive that allows
     the user to assign authentication control to any HTTP method that
     is *not* given in the argument list; i.e., the logical negation
     of the <Limit> directive.  This is particularly useful for controlling
     access on methods unknown to the Apache core, but perhaps known by
     some module or CGI script. [Roy Fielding, Tony Finch]

  *) Prevent apachectl from complaining if the PIDFILE exists but
     does not contain a process id, as might occur if the server is
     being rapidly restarted. [Wilfredo Sanchez]

  *) Win32: Add global symbols missing from ApacheCore.def. [Carl Olsen]

  *) Entity tag comparisons for If-Match and If-None-Match were not being
     performed correctly -- weak tags might cause false positives.  Also,
     strong comparison wasn't properly enforced in all cases.
     [Roy Fielding, Ken Coar, Dean Gaudet] PR#2065, 3657

  *) OS/2: Supply OS/2 error code instead of errno on semaphore errors.
     [Brian Havard]

  *) Work around a bug in Lynx regarding its sending "Negotiate: trans"
     even though it doesn't understand TCN.  [Koen Holtman, Roy Fielding]

  *) Added ap_size_list_item(), ap_get_list_item(), and ap_find_list_item()
     to util.c for parsing an HTTP header field value to extract the next
     list item, taking into account the possible presence of nested comments,
     quoted-pairs, and quoted-strings. ap_get_list_item() also removes
     insignificant whitespace and lowercases non-quoted tokens.
     [Roy Fielding] PR#2065

  *) proxy: The various calls to ap_proxyerror() can return HTTP/1.1 status
     code different from 500. This allows the proxy to, e.g., return
     "403 Forbidden" for ProxyBlock'ed URL's. [Martin Kraemer] Related to PR#3455

  *) Fix ordering of language variants for the case where the traditional
     negotiation algorithm is being used with multiple language variants
     and no Accept-Language. [James Treacy <treacy@debian.org>] PR#3299, 3688

  *) Do not round the TCN quality calculation to 5 decimal places,
     unlike RFC 2296, because the calculation might need 12 decimal places
     to get the right result.  [Roy Fielding]

  *) Remove unused code to disable transparent negotiation when
     negotiating on encoding only, as we now handle encoding too
     (though this is nonstandard for TCN), remove charset=ISO-8859-1
     fiddle from the fiddle-averse RVSA comparison, and fix bugs in
     some debugging statements within mod_negotiation. [Koen Holtman]

  *) Fixed a rare memory corruption possibility in mod_dir if the index
     file is negotiable and no acceptable variant can be found.
     [Dean Gaudet, Roy Fielding, Martin Kraemer]

  *) Win32: Add new config directive, ScriptInterpreterSource, to enable
     searching the Win32 registry for script interpreters.
     [Bill Stoddard]

  *) Win32: The compiled-in default filename for the error log is now
     error.log, which matches the default in the distributed httpd.conf.
     [Paul Sutton]

  *) Win32: Any error messages from -i or -u command line options are now
     displayed on the console output rather than sent to the error log.
     Also the "Running Apache..." message is not output unless Apache is
     going to serve requests. [Paul Sutton]

  *) Rework the MD5 authentication scheme to use FreeBSD's algorithm,
     and use a private significator ('$apr1$') to mark passwords as
     being smashed with our own algorithm.  Also abstract the password
     checking into a new ap_validate_password() routine.  [Ken Coar]

  *) Win32: The filename validity checker now allows "COM" but refuses 
     access to "COM1" through "COM4". This allows filenames such
     as "com.name" to be served. [Paul Sutton] PR#3769.

  *) BS2000: Adapt to the new ufork() system call interface which will
     make subtasking easier on the OSD/POSIX mainframe environment.
     [Martin Kraemer]

  *) Add a compatibility define for escape_uri() -> ap_escape_uri() to
     ap_compat.h. [David White <david@persimmon.com>] PR#3725

  *) Make NDBM file suffix determination for mod_rewrite more accurate, i.e.
     use `.db' instead of `.pag' not only for FreeBSD, but also when
     the NDBM library looks like Berkeley-DB based.
     [Ralf S. Engelschall] PR#3773

  *) Add ability to handle DES or MD5 authentication passwords.
     [Ryan Bloom <rbb@Raleigh.IBM.Com>]

  *) Fix O(n^2) memory consumption in mod_speling.  [Dean Gaudet]

  *) SECURITY: Avoid some buffer overflow problems when escaping
     quoted strings.  (This overflow was on the heap and we believe
     impossible to exploit.)  [Rick Perry <perry@ece.vill.edu>]

  *) Let src/Configure be aware of CFLAGS options starting with plus
     signs as it's the case for the HP/UX compiler.
     [Doug Yatcilla <yatcilda@umdnj.edu>] PR#3681

  *) Remove the hard-wire of TAR=tar (we now check for gtar and gnutar first)
     and check to see if the tar we wind up with supports '-h'.
     [Jim Jagielski] PR#3671

  *) A consistent and conservative style for all shell scripts has been
     implemented. Basically, all shell string tests use the traditional
     hack of 'if [ "x$var" != "x" ]' or 'if [ "x$var" = "xstring" ]'
     to protect against bare null variable strings (ie: wrapping both
     sides with double quotes and prepending 'x'). 'x' was chosen
     because it's more universal and hopefully easier for old shell
     prgrammers, as well as being easier to search for in 'vi' (/x\$) :)
     [Jim Jagielski]

  *) The status module now prints out both the main server generation as
     well as the generation of each process. Also, the vhost info is
     printed with '?notable'. [Jim Jagielski]

  *) Move src/main/md5c.c to src/ap/ap_md5c.c; it's httpd-neutral
     and this makes its functions available to things in src/support.
     [Ken Coar]

Changes with Apache 1.3.4

  *) Renamed macros status_drops_connection to ap_status_drops_connection
     and vestigial scan_script_header to ap_scan_script_header_err,
     mostly for aesthetic reasons. [Roy Fielding]

  *) The query switch "httpd -S" didn't exit after showing the
     vhost settings. That was inconsistent with the other query functions.
     [Martin Kraemer]

  *) Moved the MODULE_MAGIC_COOKIE from before the versions and
     filename to the end of the STANDARD_MODULE_STUFF.  Its
     presence at the beginning prevented reporting of the filename
     for modules compiled before 1 January 1999.  [Ken Coar]

  *) SECURITY: ap_os_is_filename_valid() has been added to Win32
     to detect and prevent access to special DOS device file names.
     [Paul Sutton, Ken Parzygnat]
     
  *) WIN32: Created new makefiles Makefile_win32.txt (normal build)
     and Makefile_win32_debug.txt (debug build) that work on Win95.
     Run each of the following from the src directory:
        nmake /f Makefile_win32.txt           # compiles normal build
        nmake /f Makefile_win32.txt install   # compiles and installs
        nmake /f Makefile_win32.txt clean     # removes compiled junk
        nmake /f Makefile_win32_debug.txt     # compiles debug build
        nmake /f Makefile_win32_debug.txt install
        nmake /f Makefile_win32_debug.txt clean
     [Roy Fielding]

  *) Added binbuild.sh and findprg.sh helpers to make it easier for us
     to build binary distributions. [Lars Eilebrecht]

  *) IndexOptions SuppressColumnSorting only turned off making
     the column headers anchors; you could still change the display
     order by manually adding a '?N=A' or similar query string to the
     URL.  Now SuppressColumnSorting locks in the sort order so
     it can't be overridden this way.  [Ken Coar]

  *) Added IndexOrderDefault directive to supply a default sort order
     for FancyIndexed directory listings.  [Ken Coar] PR#1699

  *) Change the ap_assert macro to a variant that works on all platforms.
     [Richard Prinz <richard.prinz@cso.net>] PR#2575

  *) Make sure under ELF-based NetBSD (now) and OpenBSD (future) we don't
     search for an underscore on dlsym() (as it's already the case
     for FreeBSD 3.0). [Todd Vierling <tv@pobox.com>] PR#2462
  
  *) Small fix for mod_env.html: The module was documented as to be _not_
     compiled into Apache per default, although it _IS_ compiled into 
     Apache per default. [Sim Harbert <sim@mindspring.com>] PR#3572

  *) Instead of fixing a bug in the generation procedure for config.status (a
     backslash was missing) we remove the bug together with it's complete
     context because the special cases of the past can now no longer occur
     because of the recent magic for the --with-layout default.
     [Ralf S. Engelschall] PR#3590
 
  *) Make top-level Makefile aware of a parallel build procedures (make -j) by
     making sure the src/support/ tools are _forced_ to be build last (they
     depend on other libraries).
     [Markus Theissinger <markus.theissinger@gmx.de>]

  *) Fix installation procedure: Now that os-inline.c is actually used (a
     recently fixed bug prevented this) we need to also install os-include.c
     in addition to os.h into the PREFIX/include/ location or building of
     module DSOs with APXS fails. [Ralf S. Engelschall] PR#3527

  *) Added MODULE_MAGIC_COOKIE as the first field in a module structure to
     allow us to distinguish between a garbled DSO (or even a file which isn't
     an Apache module DSO at all) and a DSO which doesn't match the current
     Apache API. [Ralf S. Engelschall] PR#3152
 
  *) Two minor enhancements to mod_rewrite: First RewriteRule now also
     supports the ``nocase|NC'' flag (as RewriteCond already does for ages) to
     match case insensitive (this especially avoids nasty patterns like
     `[tT][eE][sS][tT]'). Second two additional internal map functions
     `escape' and `unescape' were added which can be used to escape/unescape
     to/from hex-encodings in URLs parts (this is especially useful in
     combination with map lookups). 
     [Magnus Bodin, Ian Kallen, Ralf S. Engelschall]

  *) Renamed the macro escape_uri() to ap_escape_uri() which was
     forgotten (because it was a macro) in the symbol renaming process.
     [Ralf S. Engelschall]

  *) Fix some inconsistencies related to the scopes of directives. The only
     user visible change is that the directives `UseCanonicalName' and
     `ContentDigest' now use the (more correct) `Options' scope instead of
     (less correct) `AuthConfig' scope.  [Ralf S. Engelschall]

  *) Using DSO, the Server token was being mangled. Specifically, the
     module's token was being added first before the Apache token. This
     has been fixed. [Jim Jagielski]

  *) Major overhaul of mod_negotiation.c, part 2.
     - properly handle "identity" within Accept-Encoding.
     - allow encoded variants in RVSA negotiation and let them appear in
       the Alternates field using the non-standard "encoding" tag-list.
     - fixed both negotiation algorithms so that an explicitly accepted
       encoding is preferred over no encoding if "identity" is not
       included within Accept-Encoding.
     - added ap_array_pstrcat() to alloc.c for efficient concatenation
       of large substring sequences.
     - replaced O(n^2) memory hogs in mod_negotiation with ap_array_pstrcat.
     [Roy Fielding]

  *) Major overhaul of mod_negotiation.c, part 1.
     - cleanups to mod_negotiation comments and code structure
     - made compliant with HTTP/1.1 proposed standard (rfc2068) and added
       support for everything in the upcoming HTTP/1.1
       revision (draft-ietf-http-v11-spec-rev-06.txt).
         - language tag matching also handles tags with more than 2
           levels like x-y-z
         - empty Accept, Accept-Language, Accept-Charset headers are
           processed correctly; previously an empty header would make all
           values acceptable instead of unacceptable.
         - allowed for q values in Accept-Encoding
     - added support for transparent content negotiation (rfc2295 and
       rfc2296) (though we do not implement all features in these drafts,
       e.g. no feature negotiation).  Removed old experimental version.
     - implemented 'structured entity tags' for better cache correctness
       (structured entity tags ensure that caches which can deal with Vary
       will (eventually) be updated if the set of variants on the server
       is changed)
         - this involved adding a vlist_validator element to request_rec
         - this involved adding the ap_make_etag() function to the global API
     - modified guessing of charsets used by Apache negotiation algorithm 
       to guess 'no charset' if the variant is not a text/* type
     - added code to sort multiviews variants into a canonical order so that
       negotiation results are consistent across backup/restores and mirrors
     - removed possibility of a type map file resolving to another type map
       file as its best variant
     [Koen Holtman, Roy Fielding, Lars Eilebrecht] PR#3451, 3299, 1987

  *) RFC2396 allows the syntax http://host:/path (with no port number)
     but the proxy disallowed it (ap_proxy_canon_netloc()).
     [David Kristol <dmk@bell-labs.com>] PR#3530

  *) When modules update/modify the file name in the configfile_t structure,
     syntax errors will report the updated name, not the original one.
     [Fabien Coelho <coelho@cri.ensmp.fr>] PR#3573

  *) Correct some filename case assumptions from WIN32 to
     CASE_BLIND_FILESYSTEM.  [Brian Havard <brianh@kheldar.apana.org.au>]

  *) For %v log ServerName regardless of the UseCanonicalName
     setting (similarly for %p).  [Dean Gaudet]

  *) Configure was initializing the variables $OSDIR, $INCDIR and $SHELL
     rather late (too late for some invocations of TestCompile).
     This improves the make environment available to TestCompile and
     the *.module scripts. [Martin Kraemer]

  *) The hashbang emulation code in ap_execve.c would interpret
     #!/hashbang/scripts correctly, but failed to fall back to a
     standard shell for scripts which did NOT start with #!
     Now SHELL_PATH is started in these cases. [Martin Kraemer]

  *) PORT: Added the Cyberguard V2 port [Richard Stagg <stagg@lentil.org>]
     PR#3336

  *) Update APXS manual page: some -q option arguments were missing
     and another was incorrect. [Mark Anderson <mda@discerning.com>] PR#3553

  *) Cleanup the command line options: `-?' was documented to show
     the usage list but does it with an error because `?' is not a valid
     command. OTOH a lot of users expect `-h' to print such a usage list and
     instead are annoyed for ages by our huge unreadable list of directives.
     So we now changed the command line options this way:
     1. `-L' => `-R' 
        Intent: we need `-L' to be free, and `-R' for the DSO run-time path is
        very similar to the popular linker option.
     2. `-h' => `-L'
        Intent: while -l gives the small list of modules, -L now gives the
        large list of directives implemented by these modules.  This is also
        consistent with -v (short version info) and -V (large version info).
     3. `-?' => `-h' 
        Intent: it's now the expected option ;-)
     The manual page was adjusted accordingly. 
     [Ralf S. Engelschall] PR#2714

  *) Fixed problem of fclose() on an unopened file in suexec if LOG_EXEC
     wasn't defined.  [Rick Franchuk <rickf@transpect.net>]

  *) Removed recently introduced bugs and disfigurements in APACI:
     o fixed argument line processing: using $args was broken: It was not
       initialized and using args="$args $apc_option" and even args="$args
       \"$apc_option\"" fails in the second processing round for any arguments
       containing whitespaces. The only correct way is to use the construct
       "$@" (but not possible here) or iterate _both_ times over the implicit
       argument line (no argument to for-loop) which is what we now use.
     o make --with-layout=Apache the default without creating
       redundancy (copying the --with-layout block in the argument parsing
       loop).  We achieve this by using the "$@" construct together with the
       `set' command to prepend --with-layout=Apache to the command line in
       case --with-layout is not used.
     o fixed auto-suffix handling now that config.layout exists.
       Paths which are auto-suffixed are marked with a trailing plus sign in
       config.layout and every path now can be marked this way (not only the
       four paths for which we do it currently).  Additionally the suffix is
       no longer a static one. Instead it's now `/<target>' where <target> is
       the argument of the --target option or per default `httpd'.
     o allow also tabs (and only spaces) where we match whitespaces
     o various fixes and cleanups related to used shell coding style
     o made Jim happy by replacing `Written by' with `Initially written by' ;-)
     o trimmed output of --help to fit into 80 columns
     [Ralf S. Engelschall]

  *) Added two new core API functions, ap_single_module_configure() and
     ap_single_module_init(), which are now used by mod_so to configure a module
     after loading. [Ralf S. Engelschall]

  *) PORT: Add defines for USE_FLOCK_SERIALIZED_ACCEPT and
     SINGLE_LISTEN_UNSERIALIZED_ACCEPT to NetBSD/OpenBSD section
     of ap_config.h to allow serialized accept for multiport listens.
     [Roy Fielding, Curt Sampson] PR#3120

  *) PORT: Fixed a misplaced #endif for NetBSD/OpenBSD section
     of ap_config.h that would skip several defines if DEFAULT_GROUP
     was overridden. [Roy Fielding]

  *) PORT: The I86 version of DGUX has support for strncasecmp and 
     strcasecmp, so allow it in ap_config.h. [Amiel Lee Yee] PR#3247

  *) Fix ordering of definitions in ap_config.h so that ap_inline is
     defined before it might be used. [Victor Khimenko]

  *) PORT: Add Dynamic Shared Object (DSO) support for BSDI (v4.0).
     [Tom Serkowski <tks@bsdi.com>] PR#3453

  *) Make generation of src/Configuration.apaci more robust: It failed to
     differenciate between modules when one module name was a postfix of
     another (e.g. cgi vs. fastcgi). We now check for mod_XXX, libXXX and even
     just XXX (think about totally non-standard names like "apache_ssl", too).
     [Ralf S. Engelschall] PR#3380

  *) In src/Configure remove the SERVER_SUBVERSION support (already deprecated
     since 1.3b7) and make whitespace handling more robust (it failed horrible
     when whitespaces were present in the arguments of -D options).
     [Ralf S. Engelschall] PR#3240

  *) Add APACI --shadow=DIR variant (in addition to --shadow). This now first
     creates an external package shadow tree in DIR before the local build
     shadow tree is generated under DIR. This way one can have the extracted
     Apache distribution tree read-only on NFS or CDROM and still build Apache
     from these sources. An automatically triggered VPATH-like mechanism is
     provided through the TOP variable, too.
     [Ralf S. Engelschall, Wilfredo Sanchez <wsanchez@apple.com>]

  *) Fix negotiation so that a Vary response header is correctly 
     generated when, for a particular dimension, variants only vary
     in having or not having a value for that dimension. [Paul Sutton]

  *) Fix negotiation so that we prefer an encoded variant over an
     unencoded variant if the user-agent explicitly says it can
     accept that encoding. Previously we always preferred the unencoded
     variant.
     [Paul Ausbeck <paula@alumni.cse.ucsc.edu>, Paul Sutton] PR#3447
 
  *) Fix APXS tool: query variables LIBS_SHLIB and TARGET were not recognized
     and the usage page was inconsistent with the functionality and manpage.
     [Ralf S. Engelschall]

  *) Allow special options -Wc,xxx and -Wl,xxx on APXS compile/link command.
     They can occur multiple times and their arguments (`xxx') are passed AS
     IS to the compiler/linker command.  [Ralf S. Engelschall]

  *) Fixed possible (but harmless in practice) bug in the DBM lookup
     procedure of mod_rewrite: very long keys were truncated.
     [Ralf S. Engelschall]

  *) Added a generic --with-layout=[FILE:]ID option. ID here is a layout
     identifier, currently "Apache" and "GNU" are pre-defined in the file
     config.layout.  Custom layouts are possible by using FILE:ID as the
     argument where the layout ID is taken from FILE.

     The config.layout file consists of <Layout ID>..</Layout> sections
     where inside those sections "path_variable: path_value" pairs can be
     specified. These lines are converted to path_variable='path_value'.

  *) Add a DefaultLanguage directive so that files missing a language
     extension (e.g., .fr, .de) can be labelled as being some other
     default language. DefaultLanguage can appear in <Directory> and 
     <Files> containers as well as .htaccess files.  [Paul Sutton]
     PR#1180

  *) Fix TARGET configuration when configuring and installing using
     APACI configure. TARGET now defines the basename of the configuration
     file, startup script, manual page, etc. log_error_core() now reports
     the server binary name given by argv[0]. TARGET can now also be defined
     with --target=TARGET parameter passed to APACI configure.
     [Ralf Engelschall, Randy Terbush]

  *) mod_include.c:handle_perl() now properly tests for OPT_INCNOEXEC
     rather than OPT_INCLUDES [Rainer Schoepf <schoepf@uni-mainz.de>]

  *) ap_md5_binary() was using sprintf() rather than a table lookup
     to convert binary bytes to hex digits.
     [Ronald Tschalär <ronald@innovation.ch>] PR#3409

  *) Fix SEGV in TCN negotiation if no variants are acceptable.
     [Martin Plechsmid <plechsmi@karlin.mff.cuni.cz>] PR#1987

  *) API: ap_exists_config_define() function is now "public" [Doug MacEachern]

  *) Fix documentation of `Action' directive: It can activate a CGI script
     when either a handler or a MIME content type is triggered by the request.
     [Andrew Pimlott <pimlott@math.harvard.edu>] PR#3340

  *) Document the `add' command of `dbmmanage' in `dbmmanage.1' manpage.
     [David MacKenzie <djm@uu.net>] PR#3394

  *) Ignore a "ErrorDocument 401" directive with a full URL and write a
     notice to the error log. It is not possible to send a 401 response
     and a redirect at the same time.  [Lars Eilebrecht]

  *) Fallback to native compilers for IRIX-32 platform. It seems that
     a gcc 2.8.1 compiled apache is logging client addresses with all
     bits set (255.255.255.255). This is the second such problem caused
     by gcc 2.8.1 compiler. The first being broken semaphore locking.
     [Randy Terbush]

  *) Updated mime.types to reflect current Internet media types
     and include a URL to the registry.
     [Manoj Kasichainula, Roy Fielding] PR#2380, 2286, 2246

  *) SECURITY: Do a more complete check in mod_include to avoid 
     an infinite loop of recursive SSI includes.  [Marc Slemko] PR#3323

  *) Add APACI --suexec-docroot and --suexec-logfile options which can be
     used to set the document root directory (DOC_ROOT) and the suexec
     logfile (LOG_EXEC), respectively. Additionally the --layout option
     was changed to show more information about the suEXEC setup.
     [Lars Eilebrecht] PR#3316, 3357, 3361

  *) Added the last two WebDAV status codes of 424 (Failed Dependency)
     and 507 (Insufficient Storage) for use by third-party modules.
     [Roy Fielding]

  *) Enabled all of the WebDAV method names for use by third-party
     modules, Limit, and Script directives.  That includes PATCH,
     PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, LOCK, and UNLOCK.
     Improved mod_actions.c so that it can use any of the methods
     defined in httpd.h.  Added ap_method_number_of(method) for
     getting the internal method number.  [Roy Fielding]

  *) PORT: Add a port to the TPF OS. [Joe Moenich <moenich@us.ibm.com> and
     others at IBM]

  *) Fix problems with handling of UNC names (e.g., \\host\path)
     on Win32.  [Ken Parzygnat <kparz@us.ibm.com>]

  *) Rework os_canonical_*() on Win32 so it's simpler, more
     robust, and works.  [Ken Parzygnat <kparz@us.ibm.com>]
     PR#2555, 2915, 3064, 3232

  *) Work around incomplete implementation of strftime on Win32.
     [Manoj Kasichainula, Ken Parzygnat <kparz@us.ibm.com>]

  *) Move a typedef to fix compile problems on Linux with 1.x kernels.
     [Manoj Kasichainula] PR#3177

  *) PORT: Add a port to the Concurrent PowerMAX OS. [Tom Horsley
     <Tom.Horsley@mail.ccur.com>]

  *) WIN32: Log more explicit error messages if spawning an interpreted 
     script failed, including the command line used to attempt to execute 
     the interpreter and the Win32 error code returned.  [Marc Slemko]

  *) Disable sending of error-notes on a 500 (Internal Server Error) response
     since it often includes file path info.  Enable sending of error-notes
     on a 501 (Method Not Implemented).  [Roy Fielding] PR#3173

  *) http_config.c would respond with 501 (Method Not Implemented) if a
     content type handler was specified but could not be found, which
     should have been a 500 response.  Likewise, mod_proxy.c would responsd
     with a 501 if the URI scheme is unrecognized instead of the correct
     response of 403 (Forbidden).  [Roy Fielding]

  *) SECURITY: Eliminate DoS attack when a bad URI path contains what
     looks like a printf format escape.  [Marc Slemko, Studenten Net Twente]

  *) Fix in mod_autoindex: for files where the last modified time stamp was