Skip to content
CHANGES 102 KiB
Newer Older
                                                         -*- coding: utf-8 -*-
Changes with Apache 2.3.16
Stefan Fritsch's avatar
Stefan Fritsch committed
  *) core: Limit line length in .htaccess to 8K like in 2.2.x, to avoid
     additional DoS potential. [Stefan Fritsch]

  *) core, all modules: Add unique tag to most error log messages. [Stefan
     Fritsch]

  *) mod_socache_memcache: Change provider name from "mc" to "memcache" to
     match module name. [Stefan Fritsch]

  *) mod_slotmem_shm: Change provider name from "shared" to "shm" to match
     module name. [Stefan Fritsch]

Stefan Fritsch's avatar
Stefan Fritsch committed
  *) mod_ldap: Fix segfault with Solaris LDAP when enabling ldaps. This
     requires an apr-util fix in which is available in apr-util >= 1.4.0.
     PR 42682. [Stefan Fritsch]

Graham Leggett's avatar
Graham Leggett committed
  *) mod_rewrite: Add the AllowNoSlash RewriteOption, which makes it possible
     for RewriteRules to be placed in .htaccess files that match the directory
     with no trailing slash. PR 48304.
     [Matthew Byng-Maddick <matthew byng-maddick bbc.co.uk>]

Graham Leggett's avatar
Graham Leggett committed
  *) mod_session_crypto: Add a SessionCryptoPassphraseFile directive so that
     the administrator can hide the keys from the configuration. [Graham
     Leggett]

Graham Leggett's avatar
Graham Leggett committed
  *) Introduce a per request version of the remote IP address, which can be
     optionally modified by a module when the effective IP of the client
     is not the same as the real IP of the client (such as a load balancer).
     Introduce a per connection "peer_ip" and a per request "client_ip" to
     distinguish between the raw IP address of the connection and the effective
     IP address of the request. [Graham Leggett]

Jim Jagielski's avatar
Jim Jagielski committed
  *) ap_pass_brigade_fchk() function added. [Jim Jagielski]

  *) core: Pass ap_errorlog_info struct to error log hook. [Stefan Fritsch]

Graham Leggett's avatar
Graham Leggett committed
  *) mod_cache_disk: Make sure we check return codes on all writes and
     attempts to close, and clean up after ourselves in these cases.
     PR43589. [Graham Leggett]

Graham Leggett's avatar
Graham Leggett committed
  *) mod_cache_disk: Remove the unnecessary intermediate brigade while
     writing to disk. Fixes a problem where mod_disk_cache was leaving
     buckets in the intermediate brigade and not passing them to out on
     exit. [Florian S. <f_los_ch yahoo.com>, Graham Leggett]
Graham Leggett's avatar
Graham Leggett committed

Kaspar Brand's avatar
Kaspar Brand committed
  *) mod_ssl: use a shorter setting for SSLCipherSuite in the default
     default configuration file, and add some more information about
     configuring a speed-optimized alternative.
     [Kaspar Brand]

Kaspar Brand's avatar
Kaspar Brand committed
  *) mod_ssl: drop support for the SSLv2 protocol. [Kaspar Brand]

Eric Covener's avatar
Eric Covener committed
  *) mod_lua: Stop losing track of all but the most specific LuaHook* directives
     when multiple per-directory config sections are used.  Adds LuaInherit 
     directive to control how parent sections are merged.  [Eric Covener]

Jeff Trawick's avatar
Jeff Trawick committed
  *) Server directive display (-L): Include directives of DSOs.
     [Jeff Trawick]

Graham Leggett's avatar
Graham Leggett committed
  *) mod_cache: Make sure we merge headers correctly when we handle a
     non cacheable conditional response. PR52120. [Graham Leggett]

Rainer Jung's avatar
Rainer Jung committed
  *) Pre GA removal of components that will not be included:
     - mod_noloris was superseded by mod_reqtimeout
  *) core: Set MaxMemFree 2048 by default. [Stefan Fritsch]

  *) mpm_event: Fix assertion failure during very high load. [Stefan Fritsch]

  *) configure: Additional modules loaded by default: mod_headers.
     Modules moved from module set "few" to "most" and no longer loaded
     by default: mod_actions, mod_allowmethods, mod_auth_form, mod_buffer,
     mod_cgi(d), mod_include, mod_negotiation, mod_ratelimit, mod_request,
     mod_userdir. [Rainer Jung]

  *) mod_lua: Use the right lua scope when used as a hook. [Rainer Jung]

  *) configure: Only load the really imporant modules (i.e. those enabled by
     the 'few' selection) by default. Don't handle modules enabled with
     --enable-foo specially. [Stefan Fritsch]

  *) end-generation hook: Fix false notification of end-of-generation for
     temporary intervals with no active MPM children.  [Jeff Trawick]

  *) mod_ssl: Add support for configuring persistent TLS session ticket
     encryption/decryption keys (useful for clustered environments).
     [Paul Querna, Kaspar Brand]
  *) mod_usertrack: Use random value instead of remote IP address.
     [Stefan Fritsch]
Jim Jagielski's avatar
Jim Jagielski committed
Changes with Apache 2.3.15

  *) SECURITY: CVE-2011-3348 (cve.mitre.org)
     mod_proxy_ajp: Respond with HTTP_NOT_IMPLEMENTED when the method is not
     recognized.  [Jean-Frederic Clere]

  *) SECURITY: CVE-2011-3192 (cve.mitre.org)
     core: Fix handling of byte-range requests to use less memory, to avoid
     denial of service. If the sum of all ranges in a request is larger than
     the original file, ignore the ranges and send the complete file.
     PR 51714. [Stefan Fritsch, Jim Jagielski, Ruediger Pluem, Eric Covener,
     <lowprio20 gmail.com>]
  *) SECURITY: CVE-2011-3607 (cve.mitre.org)
     core: Fix integer overflow in ap_pregsub. This can be triggered e.g.
     with mod_setenvif via a malicious .htaccess. [Stefan Fritsch]

  *) configure: Load all modules in the generated default configuration
     when using --enable-load-all-modules. [Rainer Jung]

  *) mod_reqtimeout: Change the default to set some reasonable timeout
     values. [Stefan Fritsch]

  *) core, mod_dav_fs: Change default ETag to be "size mtime", i.e. remove
     the inode. PR 49623. [Stefan Fritsch]

  *) mod_lua: Expose SSL variables via r:ssl_var_lookup().  [Eric Covener]

  *) mod_lua: LuaHook{AccessChecker,AuthChecker,CheckUserID,TranslateName}
     can now additionally be run as "early" or "late" relative to other modules.
     [Eric Covener]

  *) configure: By default, only load those modules that are either required
     or explicitly selected by a configure --enable-foo argument. The
     LoadModule statements for modules enabled by --enable-mods-shared=most
     and friends will be commented out. [Stefan Fritsch]

  *) mod_lua: Prevent early Lua hooks (LuaHookTranslateName and 
     LuaHookQuickHandler) from being configured in <Directory>, <Files>, 
     and htaccess where the configuration would have been ignored.
     [Eric Covener]

  *) mod_lua: Resolve "attempt to index local 'r' (a userdata value)" errors
     in LuaMapHandler scripts [Eric Covener]

  *) mod_log_debug: Rename optional argument from if= to expr=, to be more
     in line with other config directives. [Stefan Fritsch]

  *) mod_headers: Require an expression to be specified with expr=, to be more
     in line with other config directives. [Stefan Fritsch]

  *) mod_substitute: To prevent overboarding memory usage, limit line length
     to 1MB. [Stefan Fritsch]

  *) mod_lua: Make the query string (r.args) writable. [Eric Covener]

  *) mod_include: Add support for application/x-www-form-urlencoded encoding
     and decoding. [Graham Leggett]

  *) rotatelogs: Add -c option to force logfile creation in every rotation 
     interval, even if empty.  [Jan Kaluža <jkaluza redhat.com>]
 
  *) core: Limit ap_pregsub() to 64K, add ap_pregsub_ex() for longer strings.
     [Stefan Fritsch]

  *) mod_session_crypto: Refactor to support the new apr_crypto API.
     [Graham Leggett]

  *) http: Add missing Location header if local URL-path is used as
     ErrorDocument for 30x. [Stefan Fritsch]

  *) mod_buffer: Make sure we step down for subrequests, but not for internal
     redirects triggered by mod_rewrite. [Graham Leggett]

  *) mod_lua: add r:construct_url as a wrapper for ap_construct_url.
     [Eric Covener]
 
  *) mod_remote_ip: Fix configuration of internal proxies. PR 49272.
     [Jim Riggs <jim riggs me>]

William A. Rowe Jr's avatar
 
William A. Rowe Jr committed
  *) mpm_winnt: Handle AcceptFilter 'none' mode correctly; resolve specific
     server IP endpoint and remote client IP upon connection.  [William Rowe]

  *) mod_setenvif: Remove OID match which is obsoleted by SetEnvIfExpr with
     PeerExtList(). [Stefan Fritsch]

  *) mpm_prefork, mpm_worker, mpm_event: If a child is created just before
     graceful restart and then exits because of a missing lock file, don't
     shutdown the whole server. PR 39311. [Shawn Michael
     <smichael rightnow com>]

  *) mpm_event: Check the return value from ap_run_create_connection.
     PR: 41194. [Davi Arnaut]

  *) mod_mime_magic: Add signatures for PNG and SWF to the example config.
     PR: 48352. [Jeremy Wagner-Kaiser <jwagner-kaiser adknowledge com>]

  *) core, unixd: Add -D DUMP_RUN_CFG option to dump some configuration items
     from the parsed (or default) config. This is useful for init scripts that
     need to setup temporary directories and permissions. [Stefan Fritsch]

  *) core, mod_actions, mod_asis: Downgrade error log messages which accompany
     a 404 request status from loglevel error to info. PR: 35768. [Stefan
Loading full blame...