Commits · 2963a5d9075d7b44019f830d9a43855468eac6fc · CYBER - Cyber Security / TS 103 523 MSP / TLMSP / TLMSP Apache Httpd

31 Dec, 2007 5 commits

To a user, explanation of r607668 is pretty simple. · 2963a5d9

William A. Rowe Jr authored Dec 31, 2007

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@607670 13f79535-47bb-0310-9956-ffa450edef68

2963a5d9

On win32, we must never, never close the parent's copy of the · cc0a70a1

William A. Rowe Jr authored Dec 31, 2007

child's read end for a reliable piped logger. The child runs
and manages it's own logs, and even if the parent did instead,
the mpm would be adjusted to pass down the child write ends
without read ends to the pipes, so this forever makes no sense.

Backport: r607666

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@607668 13f79535-47bb-0310-9956-ffa450edef68

cc0a70a1

Offer the *particular* patch which applies to *this* branch - heh · d5094d7b
William A. Rowe Jr authored Dec 31, 2007
```
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@607648 13f79535-47bb-0310-9956-ffa450edef68
```
d5094d7b

Offer a patch which applies · 610c3df6

William A. Rowe Jr authored Dec 31, 2007


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@607647 13f79535-47bb-0310-9956-ffa450edef68

610c3df6

Propose · 335b323f

William A. Rowe Jr authored Dec 31, 2007


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@607642 13f79535-47bb-0310-9956-ffa450edef68

335b323f

29 Dec, 2007 1 commit

Fix winnt bucket_alloc to borrow memory from the transaction · fe131caf

William A. Rowe Jr authored Dec 29, 2007

pool, instead of exhausting pchild memory over a number of
connections.

PR: 11427
Submitted by: Alex Varju <alex varju.ca>
Backport: r607393

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@607395 13f79535-47bb-0310-9956-ffa450edef68

fe131caf

28 Dec, 2007 9 commits

Backport a patch similar to r580433, but similar to the apr-1.2 · c80e1930

William A. Rowe Jr authored Dec 28, 2007

specific server/log.c r602467, take into account the fact that 
apr's flags could not be adjusted.

Backports: 2.2.x branch r607311

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@607312 13f79535-47bb-0310-9956-ffa450edef68

c80e1930

Refactor releasing the child processes by eliminating the · 8537ecfc

William A. Rowe Jr authored Dec 28, 2007

time lookup, eliminating the bogus/misimplemented function,
and introducing fairness to release any dead threads before
getting hung up on releasing longer lived threads.

Also pick up the time-to-wait from the server global timeout.

And finally, axe a completely bogus internal helper function.

Backports: r573103, r573105

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@607310 13f79535-47bb-0310-9956-ffa450edef68

8537ecfc

Correct the approach to std file handles by simplifying the approach · 8bfbc4bc

William A. Rowe Jr authored Dec 28, 2007

and taking better advantage of apr's now-proper support.

Already verified by Randy Kobes and Tom Donovan

Sync to trunk r580433

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@607302 13f79535-47bb-0310-9956-ffa450edef68

8bfbc4bc

* This is 2.0.x and not 2.2.x. · 81805963

Ruediger Pluem authored Dec 28, 2007


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@607284 13f79535-47bb-0310-9956-ffa450edef68

81805963

* Add two proposals. · 0458e7eb

Ruediger Pluem authored Dec 28, 2007


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@607283 13f79535-47bb-0310-9956-ffa450edef68

0458e7eb

* Backport 102870; PR 17217; stop linking OpenSSL .so's to support/* · 71765b53

Jim Jagielski authored Dec 28, 2007

      binaries (especially when compiled --with-static-support (!)) and
          fix mod_ssl.so to compile against .a openssl archives.
                http://svn.apache.org/viewcvs.cgi?rev=102870&view=rev
                    adjusted patch without distcache complexity and accomodating the
                        changes for pkgconfig info from ssl
                              http://people.apache.org/~wrowe/httpd-2.0-limit-ssl-binding.patch
                                  +1: wrowe, colm, rpluem



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@607260 13f79535-47bb-0310-9956-ffa450edef68

71765b53

* Initialize all algorithms in OpenSSL; PRs 35469, 42035 · 702b1ee6

Jim Jagielski authored Dec 28, 2007

    Trunk:
      http://svn.apache.org/viewvc?view=rev&revision=226777
    2.0.x:
      Patch submitted via PR 42035 by Dominique Quatravaux 
      http://issues.apache.org/bugzilla/attachment.cgi?id=19901
    +1: trawick, rpluem, wrowe



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@607257 13f79535-47bb-0310-9956-ffa450edef68

702b1ee6

Remove existing showstopper · 95dcc0e6

Jim Jagielski authored Dec 28, 2007


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@607255 13f79535-47bb-0310-9956-ffa450edef68

95dcc0e6

Vote and intent · a35812a9

Jim Jagielski authored Dec 28, 2007


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@607253 13f79535-47bb-0310-9956-ffa450edef68

a35812a9

27 Dec, 2007 1 commit

fixed type mismatch between OpenSSL 0.9.7 <-> 0.9.8 and later. · 3978dfbc

Guenter Knauf authored Dec 27, 2007


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@607132 13f79535-47bb-0310-9956-ffa450edef68

3978dfbc

25 Dec, 2007 1 commit

Rolled back as part of PR 43890 · 903288bd

Tony Stevenson authored Dec 25, 2007

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@606750 13f79535-47bb-0310-9956-ffa450edef68

903288bd

24 Dec, 2007 1 commit

* Remove obsolete comment, vote, promote · ec2500eb

Ruediger Pluem authored Dec 24, 2007


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@606688 13f79535-47bb-0310-9956-ffa450edef68

ec2500eb

22 Dec, 2007 1 commit

Solve service status handle leak on multi-service ApacheMonitor · 373c9bea

William A. Rowe Jr authored Dec 22, 2007

instances, and disconnect computer function on multi-system
applications of ApacheMonitor.

PR: 33803
Reported by: K.W.Schick <drax sawebs.com>
Backport: 606481


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@606483 13f79535-47bb-0310-9956-ffa450edef68

373c9bea

19 Dec, 2007 2 commits

vote and promote · 0bc76927

William A. Rowe Jr authored Dec 19, 2007

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@605408 13f79535-47bb-0310-9956-ffa450edef68

0bc76927

If compiled for WinNT, CommandLineToArgvW must resolve. · 1fed5125

William A. Rowe Jr authored Dec 19, 2007

Backports r605397


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@605401 13f79535-47bb-0310-9956-ffa450edef68

1fed5125

17 Dec, 2007 1 commit

Correct statements in OPENSSL-README when building the · 6f46c8ce

William A. Rowe Jr authored Dec 17, 2007

httpd+openssl binary.

Backport: r604940

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@604945 13f79535-47bb-0310-9956-ffa450edef68

6f46c8ce

15 Dec, 2007 4 commits

update transformation · c524a0ce

Andre Malo authored Dec 15, 2007


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@604506 13f79535-47bb-0310-9956-ffa450edef68

c524a0ce

* Wrong order, Security changes first. · ea3118ba

Ruediger Pluem authored Dec 15, 2007


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@604441 13f79535-47bb-0310-9956-ffa450edef68

ea3118ba

merge r603346 from trunk: · c9e36102

Jeff Trawick authored Dec 15, 2007

http_protocol: Escape request method in 405 error reporting.
This has no security impact since the browser cannot be tricked
into sending arbitrary method strings.

Reviewed by: wrowe, rpluem

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@604426 13f79535-47bb-0310-9956-ffa450edef68

c9e36102

merge r600645 from trunk: · d451045a

Jeff Trawick authored Dec 15, 2007

 http_protocol: Escape request method in 413 error reporting.
 Determined to be not generally exploitable, but a flaw in any case.
 PR 44014

Submitted by: Victor Stinner <victor.stinner inl.fr>
Reviewed by: wrowe, rpluem, trawick


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@604425 13f79535-47bb-0310-9956-ffa450edef68

d451045a

14 Dec, 2007 4 commits

* Vote and promote · 685ee90f

Ruediger Pluem authored Dec 14, 2007


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@604322 13f79535-47bb-0310-9956-ffa450edef68

685ee90f

Accomodate Jim's objection · 1eec0d39

William A. Rowe Jr authored Dec 14, 2007


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@604294 13f79535-47bb-0310-9956-ffa450edef68

1eec0d39

Yes please, that too. · 70b7cb62

William A. Rowe Jr authored Dec 14, 2007


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@604292 13f79535-47bb-0310-9956-ffa450edef68

70b7cb62

vote/promote/propose · aafec266

Jeff Trawick authored Dec 14, 2007


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@604289 13f79535-47bb-0310-9956-ffa450edef68

aafec266

13 Dec, 2007 2 commits

Merge r580437 from trunk: · 29314043

Jim Jagielski authored Dec 13, 2007

Share a single write-pipe handle for piped stderr logging, this
prevents an extra logging process from hanging around after the
initial config-phase.

Reviewed by: rpluem, wrowe
Submitted by: wrowe
Reviewed by: jim


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@603921 13f79535-47bb-0310-9956-ffa450edef68

29314043

cast it · 944339cd

Jim Jagielski authored Dec 13, 2007


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@603920 13f79535-47bb-0310-9956-ffa450edef68

944339cd

12 Dec, 2007 6 commits

Revert r603712 which was prematurely committed (leave the STATUS · d181e85f

William A. Rowe Jr authored Dec 12, 2007

mop-up in place)


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@603714 13f79535-47bb-0310-9956-ffa450edef68

d181e85f

Hmmm. Once patched, silly that this would hang around :) · cec254ec

William A. Rowe Jr authored Dec 12, 2007


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@603713 13f79535-47bb-0310-9956-ffa450edef68

cec254ec

Merge r603282 from trunk: · 119330a7

Joe Orton authored Dec 12, 2007

Fix CVE-2007-5000:

* modules/mappers/mod_imap.c (menu_header): Fix cross-site-scripting
  issue by escaping the URI, and ensure that a charset parameter is 
  sent in the content-type to prevent autodetection by broken browsers.

Reported by: JPCERT
Reviewed by: jorton, rpluem, trawick


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@603619 13f79535-47bb-0310-9956-ffa450edef68

119330a7

+1, promote · ea35bc75

Jeff Trawick authored Dec 12, 2007


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@603616 13f79535-47bb-0310-9956-ffa450edef68

ea35bc75

* Cast a vote. · 191d2c7a

Ruediger Pluem authored Dec 12, 2007


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@603613 13f79535-47bb-0310-9956-ffa450edef68

191d2c7a

Propose 2.0.x rediff of CVE-2007-5000. · 00b60ff4

Joe Orton authored Dec 12, 2007


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@603591 13f79535-47bb-0310-9956-ffa450edef68

00b60ff4

07 Dec, 2007 2 commits

Make the recipe match the statement of the problem. · d1787bf0

Richard Bowen authored Dec 07, 2007


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@602180 13f79535-47bb-0310-9956-ffa450edef68

d1787bf0

Make the recipe match the problem description. · fb077670

Richard Bowen authored Dec 07, 2007


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@602174 13f79535-47bb-0310-9956-ffa450edef68

fb077670