Commits · c805df985e4420de85c9ed053bf6c7b9b2ef2ea1 · CYBER - Cyber Security / TS 103 523 MSP / TLMSP / TLMSP Apache Httpd

Jul 14, 2003

mod_ext_filter: Set additional environment variables for use by · c805df98

Jeff Trawick authored Jul 14, 2003

the external filter.

PR:    20944

The missing code was identified by Andrew Ho, coded/tested by Jeff
Trawick, and verified yet again by Neil Fraser.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@100595 13f79535-47bb-0310-9956-ffa450edef68

c805df98

Introduce the "virtual" modifier to the Action directive, · 3521e6f0

Andre Malo authored Jul 14, 2003

which allows the use of handlers for virtual locations.

PR:	8431


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@100589 13f79535-47bb-0310-9956-ffa450edef68

3521e6f0

Jul 12, 2003

let mod_speling use the current AcceptPathInfo setting. · 327c3e49

Andre Malo authored Jul 12, 2003

Default is: reject

PR: 21059


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@100566 13f79535-47bb-0310-9956-ffa450edef68

327c3e49

sync · 9922f72a

Andre Malo authored Jul 12, 2003


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@100563 13f79535-47bb-0310-9956-ffa450edef68

9922f72a

Jul 09, 2003

Forward port patch for CAN-2003-0192 from 2.0. · cd2c6d3a

Sander Striker authored Jul 09, 2003

SECURITY [CAN-2003-0192]: Fixed a bug whereby certain sequences
of per-directory renegotiations and the SSLCipherSuite directive
being used to upgrade from a weak ciphersuite to a strong one
could result in the weak ciphersuite being used in place of the
strong one. [Ben Laurie]

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@100518 13f79535-47bb-0310-9956-ffa450edef68

cd2c6d3a

Forward port patch for CAN-2003-0253 from 2.0. · 9bc02aba

Sander Striker authored Jul 09, 2003

SECURITY [CAN-2003-0253]: Fixed a bug in prefork MPM causing
temporary denial of service when accept() on a rarely accessed port
returns certain errors.  Reported by Saheed Akhtar
<S.Akhtar@talis.com>.  [Jeff Trawick]


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@100517 13f79535-47bb-0310-9956-ffa450edef68

9bc02aba

Forward port security patch for CAN-2003-0254 from 2.0. · 46e359cd

Sander Striker authored Jul 09, 2003

SECURITY [CAN-2003-0254]: Fixed a bug in ftp proxy causing denial
of service when target host is IPv6 but proxy server can't create
IPv6 socket.  Fixed by the reporter.  [Yoshioka Tsuneo
<tsuneo.yoshioka@f-secure.com>]


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@100516 13f79535-47bb-0310-9956-ffa450edef68

46e359cd

Sync CHANGES entry for VU#379828 with 2.0 · 3f91f671

Sander Striker authored Jul 09, 2003


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@100515 13f79535-47bb-0310-9956-ffa450edef68

3f91f671

Jul 08, 2003

· 9c2f26b8

Paul J. Reder authored Jul 08, 2003

Update the header token parsing code to allow LWS between the token word
and the ':' seperator.  [PR 16520]
[submitted: Kris Verbeeck <kris.verbeeck@advalvas.be> and
            Nicel KM <mnicel@yahoo.com>]
[Reviewed: <coad@measurement-factory.com> and
           Paul J. Reder]


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@100492 13f79535-47bb-0310-9956-ffa450edef68

9c2f26b8

Jul 07, 2003

move the entry for a fix just merged into 2.0.48-dev · ada59358

Jeff Trawick authored Jul 07, 2003


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@100482 13f79535-47bb-0310-9956-ffa450edef68

ada59358

move the entry for a fix just merged into 2.0.48-dev · 16029d16

Jeff Trawick authored Jul 07, 2003


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@100480 13f79535-47bb-0310-9956-ffa450edef68

16029d16

Jul 01, 2003

mod_ext_filter: Add the ability to filter request bodies. · 49b175b2

Jeff Trawick authored Jul 01, 2003

Submitted by: Philipp Reisner <philipp.reisner@linbit.com>
Reviewed by: Jeff Trawick

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@100429 13f79535-47bb-0310-9956-ffa450edef68

49b175b2

Note backport. · d09dd5ad

Sander Striker authored Jul 01, 2003


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@100427 13f79535-47bb-0310-9956-ffa450edef68

d09dd5ad

Note backport. · 683a6edf

Sander Striker authored Jul 01, 2003


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@100425 13f79535-47bb-0310-9956-ffa450edef68

683a6edf

Jun 29, 2003

Fix NULL-pointer issue in ab when parsing an incomplete or non-HTTP · 4e7d3f6a

Andre Malo authored Jun 29, 2003

response.

PR: 21085
Submitted by:	Glenn Nielsen <glenn@apache.org>


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@100399 13f79535-47bb-0310-9956-ffa450edef68

4e7d3f6a

Add FreeBSD directory layout · 38ee4e99

Andre Malo authored Jun 29, 2003

PR: 21100
Submitted by: info@orangexl.com (Sander Holthaus)


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@100397 13f79535-47bb-0310-9956-ffa450edef68

38ee4e99

Jun 27, 2003

· 4eecfa1c

Paul J. Reder authored Jun 27, 2003

Correct the code in ap_check_cache_feshness to check max_age, smax_age,
and expires correctly.
Submitted by:   Thomas Castelle  <tcastelle@generali.fr>
Reviewed and altered by: Paul J. Reder


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@100380 13f79535-47bb-0310-9956-ffa450edef68

4eecfa1c

Jun 25, 2003

Ben's streamy PROPFIND patch has been backported. · 9d31e6af

Greg Stein authored Jun 25, 2003


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@100362 13f79535-47bb-0310-9956-ffa450edef68

9d31e6af

Jun 23, 2003

mod_cgid: Restart the cgid daemon if it crashes. · b71d643d

Jeff Trawick authored Jun 23, 2003

PR:             19849
Submitted by:   Glenn Nielsen <glenn@apache.org>
Reviewed by:    Jeff Trawick


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@100343 13f79535-47bb-0310-9956-ffa450edef68

b71d643d

update to reflect a merged fix · acf5bbe2

Jeff Trawick authored Jun 23, 2003


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@100338 13f79535-47bb-0310-9956-ffa450edef68

acf5bbe2

Jun 20, 2003

mod_cgid: Eliminate a double-close of a socket. This resolves · cbbc7735

Jeff Trawick authored Jun 20, 2003

various operational problems in a threaded MPM, since on the
second attempt to close the socket, the same descriptor was
often already in use by another thread for another purpose.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@100320 13f79535-47bb-0310-9956-ffa450edef68

cbbc7735

Jun 07, 2003

Unix: Handle permissions settings for flock-based mutexes in · b704f57c

Jeff Trawick authored Jun 07, 2003

unixd_set_global|proc_mutex_perms().  Allow the functions to be
called for any type of mutex.

This resolves a fatal problem with mod_rewrite on systems where
APR uses flock-based mutex.

It simplifies mod_ssl as well, which had special logic to perform
the chown().  It fixed an init error with mod_ssl on systems where
flock is used when the user had no SSLMutex directive.

The Unix MPMs continue to call unixd_set_global|proc_mutex_perms()
only for SysV sems.  There is no permission problem with flock-based
accept mutexes since the child init logic for the MPMs is done
prior to switching identity.

PR:              20312


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@100189 13f79535-47bb-0310-9956-ffa450edef68

b704f57c

mod_rewrite: Perform child initialization on the rewrite log lock. · dd0522a5

Jeff Trawick authored Jun 07, 2003

This fixes a log corruption issue when flock-based serialization
is used (e.g., FreeBSD).

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@100187 13f79535-47bb-0310-9956-ffa450edef68

dd0522a5

Jun 06, 2003

Don't respect the Server header field as set by modules and CGIs. · ec92bc44

Jeff Trawick authored Jun 06, 2003

As with 1.3, for proxy requests any such field is from the origin
server; otherwise it will have our server info as controlled by
the ServerTokens directive.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@100182 13f79535-47bb-0310-9956-ffa450edef68

ec92bc44

Jun 05, 2003

Fix some broken log messages in WinNT MPM. · 22b28442

Jeff Trawick authored Jun 05, 2003

Submitted by: Juan Rivera <Juan.Rivera@citrix.com>
Reviewed by: Jeff Trawick

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@100175 13f79535-47bb-0310-9956-ffa450edef68

22b28442

Jun 03, 2003

add Ben's streamy PROPFIND change · b8bbfc67

Greg Stein authored Jun 03, 2003


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@100165 13f79535-47bb-0310-9956-ffa450edef68

b8bbfc67

Be more consistant in how we label security issues · 1f37c225

Mark J. Cox authored Jun 03, 2003

Promote the issues that have been allocated a full CVE name (to replace CAN)
PR:
Obtained from:
Submitted by:
Reviewed by:


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@100151 13f79535-47bb-0310-9956-ffa450edef68

1f37c225

Apply missing security fix CHANGELOG entries to head · 3aac15e2

Mark J. Cox authored Jun 03, 2003

PR:
Obtained from:
Submitted by:
Reviewed by:


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@100150 13f79535-47bb-0310-9956-ffa450edef68

3aac15e2

Jun 01, 2003

· 93310ddf

Ken Coar authored Jun 01, 2003

	Allow ExpiresByType to accept and understand minor-type wildcards
	(e.g., text/*).  They'll be used if an exact type match isn't
	found; if there's no wildcard match, the expiry falls back to any
	ExpiresDefault setting as usual.

PR:		7991


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@100126 13f79535-47bb-0310-9956-ffa450edef68

93310ddf

May 31, 2003
- More mod_expires tuning. Replace the fixup hook with an insert filter · 3111af83
  Bill Stoddard authored May 31, 2003
```
hook.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@100124 13f79535-47bb-0310-9956-ffa450edef68
```
  3111af83
May 30, 2003

sync · 0dc3c474

Andre Malo authored May 30, 2003


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@100101 13f79535-47bb-0310-9956-ffa450edef68

0dc3c474

May 29, 2003

- revert my patch (r1.155) since it produces regressions. · b0a6d7d5

Andre Malo authored May 29, 2003

- add a note to STATUS that we don't forget the thing.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@100086 13f79535-47bb-0310-9956-ffa450edef68

b0a6d7d5

May 27, 2003

sync · 2f1f36c6

Andre Malo authored May 27, 2003


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@100047 13f79535-47bb-0310-9956-ffa450edef68

2f1f36c6

May 21, 2003

Updates with backported changes. · df798c55

Justin Erenkrantz authored May 21, 2003


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@99989 13f79535-47bb-0310-9956-ffa450edef68

df798c55

Move backported patches to 2.0.46 list. · f73525ca

Justin Erenkrantz authored May 21, 2003


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@99980 13f79535-47bb-0310-9956-ffa450edef68

f73525ca

May 20, 2003

sync, sync (forgot one recently ...) · 4a8aa0ce

Andre Malo authored May 20, 2003


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@99969 13f79535-47bb-0310-9956-ffa450edef68

4a8aa0ce

mod_dav providers define a 'can_be_activity' callback. Unfortunately, · 7b08dd09

Sander Striker authored May 20, 2003

mod_dav isn't calling it before creating an activity.  This is a
required precondition (along with the resource not existing), as
defined in the deltaV RFC (3253), section 13.5.

* mod_dav.c (dav_method_make_activity): if available, call provider's
  'can_be_activity' callback as a precondition to making an activity.

Submitted by: Ben Collins-Sussman <sussman@apache.org>
Reviewed by: Sander Striker


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@99966 13f79535-47bb-0310-9956-ffa450edef68

7b08dd09

May 19, 2003

Play nice with libtool 1.5. · 88bebcc1

Wilfredo Sanchez authored May 19, 2003


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@99926 13f79535-47bb-0310-9956-ffa450edef68

88bebcc1

Prevent the server from crashing when entering infinite loops. The · ef0dfc31

Andre Malo authored May 19, 2003

new LimitInternalRecursion directive configures limits of subsequent
internal redirects and nested subrequests, after which the request
will be aborted.
[William Rowe, Jeff Trawick, Andr� Malo]

PR: 19753 (and probably others)


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@99911 13f79535-47bb-0310-9956-ffa450edef68

ef0dfc31

May 18, 2003

mod_expires filter patch has been ported · fb1ba2a8

Bill Stoddard authored May 18, 2003


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@99909 13f79535-47bb-0310-9956-ffa450edef68

fb1ba2a8