git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86421 13f79535-47bb-0310-9956-ffa450edef68

  Correct new bugs introduced with the mod_isapi overhaul.

Submitted by:	Jesse Pelton [jsp@PKC.com]
Reviewed by:	William Rowe


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86407 13f79535-47bb-0310-9956-ffa450edef68

  Bring some notes up to date

Submitted by:	Mark Bixby [mark_bixby@hp.com]


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86393 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86386 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86383 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86382 13f79535-47bb-0310-9956-ffa450edef68

directory, ala /etc/rc.d/init. Basically, if any of the
config "files" are actually directories, all files in
that directory (and in subdirectories) will be parsed as
config files. Thus you can add new config directives with
no file edits at all, simply file additions.
PR: 6397
Obtained from:
Submitted by:	Lionel Clark <bishop@platypus.bc.ca> (concept + initial patch)
Reviewed by:	William A. Rowe, Jr


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86377 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86354 13f79535-47bb-0310-9956-ffa450edef68

  Updating the MPE DSO code to be compatible with an OS patch fixing an
  earlier DSO problem.

  Refining how MPE deals with UID/GID management and dealing with some MPE
  limitations in this area.

  First-time support for mod_proxy.

  #include tweakage required for using apxs to build modules without access
  to the full source tree.

  Other minor tweaks.

PR:            6587
Obtained from: <87FB8F5CE210D311B60500A0C9F4871C073DA372@xcup01.cup.hp.com>
Submitted by:  [Mark Bixby <mark_bixby@hp.com>]
Reviewed by:   William Rowe


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86348 13f79535-47bb-0310-9956-ffa450edef68

  Just docco to 127.0.0.1 and more notes for the
  ScriptInterpreterSource registry directive under Win3.

PR:
Obtained from:
Submitted by:
Reviewed by:


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86347 13f79535-47bb-0310-9956-ffa450edef68

security bug in some mass virtual hosting configurations
that can allow a remote attacker to retrieve some files
on the system that should be inaccessible. The problem
occured with requests including the line "Host: ..." --
the last dot is stripped and the remaining ".." then
reveals a parent directory.

Reported by: Peter Christoffersen <pch@mindpass.com>
Message-ID: <8quts6$2el$1@news.inet.tele.dk>
Newsgroups: comp.infosystems.www.servers.unix


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86346 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86345 13f79535-47bb-0310-9956-ffa450edef68

Submitted by:	Brad Nicholes
Reviewed by:	Bill Stoddard


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86340 13f79535-47bb-0310-9956-ffa450edef68

  Fixes * returning an error via SetLastError(), we never want to report
            an error from the error log code, flipped the sequence.
        * complete support for HSE_REQ_MAP_URL_TO_PATH_EX
        * new directives to control behavior, and react to those directives


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86336 13f79535-47bb-0310-9956-ffa450edef68

  Durned typo... no more commits for me tonight :-/


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86332 13f79535-47bb-0310-9956-ffa450edef68

  Based on Brian's and my observations, the <Directory '/'> default root
  patch should now be complete for WIN32, OS2 and NETWARE.
  Still some disagreement if '/' is canonical for Win32/OS2, but we will
  thrash that out.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86331 13f79535-47bb-0310-9956-ffa450edef68

  Backing out one piece of the prior change.  I'm not satisfied with
  lowercasing the non-filespec portion of the canonical name
  (//server/share/ will still be lowercased.)  This introduced more
  potential problems than it solved.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86330 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86328 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86327 13f79535-47bb-0310-9956-ffa450edef68

tree instead of /usr/local equivalents).
Add Darwin (Mac OS X) layout.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86326 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86325 13f79535-47bb-0310-9956-ffa450edef68

  Catching up to date


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86323 13f79535-47bb-0310-9956-ffa450edef68

  As long as I was fixing 2.0's copyright...


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86322 13f79535-47bb-0310-9956-ffa450edef68

  Cleaner feature tests and new -d -m -s -p options for crypt, MD5, SHA1
  and plaintext password cyphers.  Not certain what the $^O tag for
  NETWARE really is, so this may need to be fixed.

PR:
Obtained from:
Submitted by:
Reviewed by:


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86319 13f79535-47bb-0310-9956-ffa450edef68

  An error with 'umph' instead of silence.

PR:
Obtained from:
Submitted by:
Reviewed by:


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86312 13f79535-47bb-0310-9956-ffa450edef68

ap_os_canonical_filename().


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86305 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86301 13f79535-47bb-0310-9956-ffa450edef68

This doesn't change any behaviour, just improves the code quality.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86300 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86299 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86297 13f79535-47bb-0310-9956-ffa450edef68

If the result of a RewriteRule is a filename that contains expansion
specifiers, especially regexp backreferences $0..$9 and %0..%9, then it
may be possible for an attacker to access any file on the web server.
The fix replaces a multi-pass string expander with a one-pass expander.

Message-Id: <E13OQB5-0004Xs-00@hand.dotat.at>


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86296 13f79535-47bb-0310-9956-ffa450edef68

containing the same broken code. This is just a cosmetic improvement
in preparation for fixing the code.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86295 13f79535-47bb-0310-9956-ffa450edef68

  Fix the test to walk through directory blocks '/', '//', '//machine', and
  '//machine/share', without trying to touch the .htaccess file in the
  unsafe cases.  This allows <Directory /> to match d:/, or <Directory //>
  to match the UNC path of any network drive.
  [William Rowe, Tim Costello]

  Warning: Review the NETWARE artifacts -very- carefully, and also look at
  message <000801c024c3$31f66d70$92c0b0d0@roweclan.net> on new-httpd,
  subject: [patch NETWARE] http_core.c - please comment
  for possibly -required- associated patch.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86293 13f79535-47bb-0310-9956-ffa450edef68

  Fix util_win32 to accept '/', '//', '//machine/', and '//machine/share/'
  for url parsing in order to accept those <Directory > blocks.

  Big warning: remove the assumption that *~* is the alias name, and always
  walk the tree for aliasing.  This test is flawed, because NT can be, and
  Novell always follows different conventions.  It is only safe to always
  test, but the old test remains with a scary symbol to include it.

  There is some other optimization available, to perhaps flag that the url
  has already been walked/translated, but that isn't incorporated [yet].


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86292 13f79535-47bb-0310-9956-ffa450edef68

  Modify ap_make_dirstr_prefix, platforms with HAVE_DRIVE_LETTERS or NETWARE
  can request 0 elements, returning the '/' root.
  [William Rowe, Tim Costello]


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86291 13f79535-47bb-0310-9956-ffa450edef68

  Fix a closing endif comment, and point out a NETWARE concern.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86290 13f79535-47bb-0310-9956-ffa450edef68

  Correction to relative path test for Novell... disallow ':'.

PR:
Obtained from:
Submitted by:
Reviewed by:


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86289 13f79535-47bb-0310-9956-ffa450edef68

  Document a concern


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86288 13f79535-47bb-0310-9956-ffa450edef68

  Assure colon is followed by a slash to confirm an absolute path in OS2...
  ignore the test advisory in the prior commit to os.h


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86287 13f79535-47bb-0310-9956-ffa450edef68

  Add the platform test HAVE_UNC_PATHS and carefully authenticate that
  colon is -followed- by a slash for an absolute path under Win32 [Please
  check OS2 on this point  as well!]


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@86286 13f79535-47bb-0310-9956-ffa450edef68