git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@603729 13f79535-47bb-0310-9956-ffa450edef68

* modules/mappers/mod_imagemap.c (menu_header): Fix
  cross-site-scripting issue by escaping the URI, and ensure that a
  charset parameter is sent in the content-type to prevent
  autodetection by broken browsers.

Reported by: JPCERT

Backports: r603282
Submitted by: jorton
Reviewed by: rpluem, trawick, wrowe


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@603711 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@603617 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@603362 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@603306 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@603305 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@603231 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@603048 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@602864 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@602862 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@602801 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@602741 13f79535-47bb-0310-9956-ffa450edef68

* mod_substitute is no longer experimental.

Submitted by: rpluem
Reviewed by: rpluem


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@602738 13f79535-47bb-0310-9956-ffa450edef68

This corrects the error, bringing it in line with 581117
and the vote that was taken on that release.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@602715 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@602711 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@602708 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@602694 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@602688 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@602685 13f79535-47bb-0310-9956-ffa450edef68

mod_substitute: Added a new experimental output filter, which
performs inline response content pattern matching (including
regex) and substitution.

Submitted by: jim
Reviewed by: jim, rpluem, fuankg


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@602684 13f79535-47bb-0310-9956-ffa450edef68

* Apply patch for PR 41056 (19954) to fix chunk
  filter. Now flushes work better.

* Protect against any sort of non-block read that
  would block. If ap_get_brigade() shows that, return
  EAGAIN.

* Further refinement for PR41056 / PR 19954 (mostly-fixed in r480135.)
  We assume that a successful read but an empty brigade
  is NOT cause for EAGAIN. Testing may or may not
  confirm this assumption, in which case that test
  may be required as well.

* If no data is available at this point of time we need to switch into the
  BODY_CHUNK_PART state like we do several lines later in the code in the
  same situation.

* Case statements should go on their own line.  (No functional change.)

* modules/http/http_filters.c
  (ap_http_filter): Put case on its own line.

* Add missing Changelog entry for PR41056 / PR 19954. This was fixed in r480135.

PR: 41056 / 19954
Submitted by: jfclere, jim
Reviewed by: rpluem, jim, jerenkrantz


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@602679 13f79535-47bb-0310-9956-ffa450edef68

* Detabify and make spacing in HTML code the same as before r593816. This
  avoids that the autoindex test (t/modules/autoindex) fails. Adjusting
  the autoindex test would cause it to fail with older versions and would
  make it harder to recognize regressions.

Submitted by: rpluem
Reviewed by: rpluem, jim, fuankg


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@602678 13f79535-47bb-0310-9956-ffa450edef68

right section.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@602658 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@602578 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@602573 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@602551 13f79535-47bb-0310-9956-ffa450edef68

Prevent 1-byte overflow on 8192 boundary (see PR 43310)


Alternate fix... profiling indicates that the string
termination is completely unneeded and superflous. In
which case, the original allocation size is sufficient
since nothing external worries about a NULL nor
looks for it.

Reviewed by: jim


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@602536 13f79535-47bb-0310-9956-ffa450edef68

* Also set the Vary header if a rewrite condition is true and uses a HTTP
  header, but all remaining rewrite conditions are skipped due to the [OR]
  flag.


* Add the novary flag to RewriteCond in order to prevent the appending
  of HTTP headers used in a rewrite condition to the Vary header of
  the response.

Submitted by: rpluem
Reviewed by: jim


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@602535 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@602530 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@602528 13f79535-47bb-0310-9956-ffa450edef68

Add in SeeRequestTail directive, to handle the shortcoming
of only storing 63 bytes of the request, when the requests
are longer than that and only vary towards the end; eg:

   GET /disk1/storage/apache/htdocs/images/image-store1/food/fruits/seeded/apples.jpg
   GET /disk1/storage/apache/htdocs/images/image-store1/food/fruits/seeded/pears.jpg
   GET /disk1/storage/apache/htdocs/images/image-store1/food/fruits/seeded/plums.jpg

Submitted by: jim
Reviewed by: jim, rpluem, niq


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@602508 13f79535-47bb-0310-9956-ffa450edef68

Generate etags consistently across 32-bit and 64-bit platforms:

* modules/http/http_etag.c (etag_uint64_to_hex): Renamed from
etag_ulong_to_hex; take an apr_uint64_t argument.
(ap_make_etag): Adjust to use new function and macro names.
Pass arguments directly to etag_uint64_to_hex without casting
down to unsigned long.

* modules/http/http_etag.c (etag_uint64_to_hex): Fix maximum shift
size, thanks to Ruediger.

PR: 40064
Submitted by: jorton
Reviewed by: rpluem, jim, niq


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@602503 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@602501 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@602493 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@602485 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@602476 13f79535-47bb-0310-9956-ffa450edef68

http_protocol: Escape request method in 413 error reporting.
Determined to be not generally exploitable, but a flaw in any case.

PR: 44014
Submitted by: Victor Stinner <victor.stinner inl.fr>



Submitted by: wrowe
Reviewed by: jim


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@602473 13f79535-47bb-0310-9956-ffa450edef68

mod_filter: don't segfault on (unsupported) chained FilterProviders.
PR 43956


Since we don't support chained filters, and can't expect to while the
filter_init problem remains, we should make it clear to users at startup time.

Submitted by: niq
Reviewed by: jim


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@602472 13f79535-47bb-0310-9956-ffa450edef68

enable to build with OpenSSL 0.9.9

Submitted by: fuankg
Reviewed by: jim


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@602471 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@602470 13f79535-47bb-0310-9956-ffa450edef68