Just docco to 127.0.0.1 and more notes for the
  ScriptInterpreterSource registry directive under Win3.

PR:
Obtained from:
Submitted by:
Reviewed by:


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86347 13f79535-47bb-0310-9956-ffa450edef68

security bug in some mass virtual hosting configurations
that can allow a remote attacker to retrieve some files
on the system that should be inaccessible. The problem
occured with requests including the line "Host: ..." --
the last dot is stripped and the remaining ".." then
reveals a parent directory.

Reported by: Peter Christoffersen <pch@mindpass.com>
Message-ID: <8quts6$2el$1@news.inet.tele.dk>
Newsgroups: comp.infosystems.www.servers.unix


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86346 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86345 13f79535-47bb-0310-9956-ffa450edef68

Submitted by:	Brad Nicholes
Reviewed by:	Bill Stoddard


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86340 13f79535-47bb-0310-9956-ffa450edef68

  Fixes * returning an error via SetLastError(), we never want to report
            an error from the error log code, flipped the sequence.
        * complete support for HSE_REQ_MAP_URL_TO_PATH_EX
        * new directives to control behavior, and react to those directives


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86336 13f79535-47bb-0310-9956-ffa450edef68

  Durned typo... no more commits for me tonight :-/


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86332 13f79535-47bb-0310-9956-ffa450edef68

  Based on Brian's and my observations, the <Directory '/'> default root
  patch should now be complete for WIN32, OS2 and NETWARE.
  Still some disagreement if '/' is canonical for Win32/OS2, but we will
  thrash that out.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86331 13f79535-47bb-0310-9956-ffa450edef68

  Backing out one piece of the prior change.  I'm not satisfied with
  lowercasing the non-filespec portion of the canonical name
  (//server/share/ will still be lowercased.)  This introduced more
  potential problems than it solved.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86330 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86328 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86327 13f79535-47bb-0310-9956-ffa450edef68

tree instead of /usr/local equivalents).
Add Darwin (Mac OS X) layout.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86326 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86325 13f79535-47bb-0310-9956-ffa450edef68

  Catching up to date


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86323 13f79535-47bb-0310-9956-ffa450edef68

  As long as I was fixing 2.0's copyright...


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86322 13f79535-47bb-0310-9956-ffa450edef68

  Cleaner feature tests and new -d -m -s -p options for crypt, MD5, SHA1
  and plaintext password cyphers.  Not certain what the $^O tag for
  NETWARE really is, so this may need to be fixed.

PR:
Obtained from:
Submitted by:
Reviewed by:


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86319 13f79535-47bb-0310-9956-ffa450edef68

  An error with 'umph' instead of silence.

PR:
Obtained from:
Submitted by:
Reviewed by:


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86312 13f79535-47bb-0310-9956-ffa450edef68

ap_os_canonical_filename().


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86305 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86301 13f79535-47bb-0310-9956-ffa450edef68

This doesn't change any behaviour, just improves the code quality.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86300 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86299 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86297 13f79535-47bb-0310-9956-ffa450edef68

If the result of a RewriteRule is a filename that contains expansion
specifiers, especially regexp backreferences $0..$9 and %0..%9, then it
may be possible for an attacker to access any file on the web server.
The fix replaces a multi-pass string expander with a one-pass expander.

Message-Id: <E13OQB5-0004Xs-00@hand.dotat.at>


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86296 13f79535-47bb-0310-9956-ffa450edef68

containing the same broken code. This is just a cosmetic improvement
in preparation for fixing the code.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86295 13f79535-47bb-0310-9956-ffa450edef68

  Fix the test to walk through directory blocks '/', '//', '//machine', and
  '//machine/share', without trying to touch the .htaccess file in the
  unsafe cases.  This allows <Directory /> to match d:/, or <Directory //>
  to match the UNC path of any network drive.
  [William Rowe, Tim Costello]

  Warning: Review the NETWARE artifacts -very- carefully, and also look at
  message <000801c024c3$31f66d70$92c0b0d0@roweclan.net> on new-httpd,
  subject: [patch NETWARE] http_core.c - please comment
  for possibly -required- associated patch.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86293 13f79535-47bb-0310-9956-ffa450edef68

  Fix util_win32 to accept '/', '//', '//machine/', and '//machine/share/'
  for url parsing in order to accept those <Directory > blocks.

  Big warning: remove the assumption that *~* is the alias name, and always
  walk the tree for aliasing.  This test is flawed, because NT can be, and
  Novell always follows different conventions.  It is only safe to always
  test, but the old test remains with a scary symbol to include it.

  There is some other optimization available, to perhaps flag that the url
  has already been walked/translated, but that isn't incorporated [yet].


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86292 13f79535-47bb-0310-9956-ffa450edef68

  Modify ap_make_dirstr_prefix, platforms with HAVE_DRIVE_LETTERS or NETWARE
  can request 0 elements, returning the '/' root.
  [William Rowe, Tim Costello]


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86291 13f79535-47bb-0310-9956-ffa450edef68

  Fix a closing endif comment, and point out a NETWARE concern.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86290 13f79535-47bb-0310-9956-ffa450edef68

  Correction to relative path test for Novell... disallow ':'.

PR:
Obtained from:
Submitted by:
Reviewed by:


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86289 13f79535-47bb-0310-9956-ffa450edef68

  Document a concern


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86288 13f79535-47bb-0310-9956-ffa450edef68

  Assure colon is followed by a slash to confirm an absolute path in OS2...
  ignore the test advisory in the prior commit to os.h


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86287 13f79535-47bb-0310-9956-ffa450edef68

  Add the platform test HAVE_UNC_PATHS and carefully authenticate that
  colon is -followed- by a slash for an absolute path under Win32 [Please
  check OS2 on this point  as well!]


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86286 13f79535-47bb-0310-9956-ffa450edef68

  Document a concern.

PR:
Obtained from:
Submitted by:
Reviewed by:


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86285 13f79535-47bb-0310-9956-ffa450edef68

  Missed a command-line build release option - now all models build.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86277 13f79535-47bb-0310-9956-ffa450edef68

  New file for mod_auth_dbm/win32 - sorry, missed it on the first go.

PR:
Obtained from:
Submitted by:
Reviewed by:


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86276 13f79535-47bb-0310-9956-ffa450edef68

  Final change - refresh the entire .mak file set based on .dsp and
  new project changes.  Once again, little .dsp changes result in
  hundereds of worthless changes to .mak files.  Please feel free to
  ignore (or read, but it's pretty dry.)

PR:
Obtained from:
Submitted by:
Reviewed by:


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86275 13f79535-47bb-0310-9956-ffa450edef68

  Last docco-like itch to scratch.  They darned well better be following
  these two files, if nothing else.  Just added STATUS and CHANGES as docs
  for Win32 IDE folks.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86274 13f79535-47bb-0310-9956-ffa450edef68

  This nearly docco commit (no behavior/code change) should make the
  Apache project more readable in the IDE environment.  Collapses a number
  of folders and better organizes header files by the project .dsp that
  'owns' them.  I hope this makes the Apache project more approachable for
  Win32 coders who haven't looked at Apache before.

PR:
Obtained from:
Submitted by:
Reviewed by:


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86273 13f79535-47bb-0310-9956-ffa450edef68

  Build mod_auth_dbm using SDBM for Win32.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86272 13f79535-47bb-0310-9956-ffa450edef68

  sdbm from mod_dav 1.0 added to accomodate Win32 and other DBM-less
  platforms.  Required by mod_auth_dbm in the core distro for Win32.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86271 13f79535-47bb-0310-9956-ffa450edef68

at least it isn't quite so hot today


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86269 13f79535-47bb-0310-9956-ffa450edef68