PR: 10993
Submitted by:	 Peter Bieringer <pb@bieringer.de>


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@96622 13f79535-47bb-0310-9956-ffa450edef68

added to the response headers when this was already done in the
core already. This resulted in header (and therefore cookie)
duplication.
PR:
Obtained from:
Submitted by:	Martijn Schoemaker <martijn@osp.nl>
Reviewed by:	Graham Leggett


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@96620 13f79535-47bb-0310-9956-ffa450edef68

- Fix segfault on strlen computation on the empty string in vlv case
- If the etag is "", don't set the ETag header to be "" - leave the
  header NULL instead.

Andrew's patch would change ap_meets_condition to accept "", but Justin
thinks it would be better just to sidestep it all together and not set
ETag when it would be "".

(Backport of patch applied to httpd-2.0 as original 1.3 code has the
same flaws.)

PR: 12202
Submitted by: Andrew Ho <andrew@tellme.com>


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@96610 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@96465 13f79535-47bb-0310-9956-ffa450edef68

has no '\r' or '\n' in the first 1023 bytes.

Reported by: Aaron Campbell


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@96464 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@96453 13f79535-47bb-0310-9956-ffa450edef68

that results in the over/underflow


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@96450 13f79535-47bb-0310-9956-ffa450edef68

	Add a new environment variable to keep the charset from being
	included on canned error documents.  (Having it there make
	some browsers apply it to the redirect target document.)

Reviewed by:	Bill Stoddard, Jim Jagielski, Justin Erenkrantz, Cliff Woolley


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@96362 13f79535-47bb-0310-9956-ffa450edef68

PR: 11626


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@96354 13f79535-47bb-0310-9956-ffa450edef68

security changes so they are consistant
PR:
Obtained from:
Submitted by:
Reviewed by:


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@96235 13f79535-47bb-0310-9956-ffa450edef68

Submitted by:	Larry Rosenman <ler@lerctr.org>
Reviewed by:	Jeff Trawick


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@96178 13f79535-47bb-0310-9956-ffa450edef68

response line ("HTTP/1.1 200 \r\n"). It looks like RFC2616 allows this,
but ap_getline() strips the trailing blank, and that lead to
an error in ap_proxy_read_response_line() for proxy-requests to
Tomcat+mod_jk2 servers. (It replaced the NIL after the "200" by
a space, and so the resulting response line had an extra NL appended).
Now the SP character which was deleted by ap_getline() is reappended,
avoiding the erroneous '\0'->' ' change, and preserving RFC2616's
requirement
     Status-Line = HTTP-Version SP Status-Code SP Reason-Phrase CRLF
     Reason-Phrase = *<TEXT, excluding CR, LF>
(thus there is now always a SP after the Status-Code).


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@96144 13f79535-47bb-0310-9956-ffa450edef68

Submitted by:	Henning Brauer <hb-apache-dev@bsws.de>
Reviewed by:	Jim Jagielski, Jeff Trawick


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@96096 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@96095 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@96078 13f79535-47bb-0310-9956-ffa450edef68

with the value at startup - have a method to find the value without
actually really running it (or binding ot ports, touching logs, etc).


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@96077 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@96032 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95987 13f79535-47bb-0310-9956-ffa450edef68

we do not allow for the total bogusness of values for C-L, just this
one special case. IMO a C-L field of "iloveyou" is bogus as is one
of "123yabbadabbado", which older versions appear to have allowed
(and in the 1st case, assume 0 and in the 2nd assume 123). Didn't
make sense to make this runtime, but a documented special case
instead.
PR:
Obtained from:
Submitted by:
Reviewed by:


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95986 13f79535-47bb-0310-9956-ffa450edef68

check for a valid protocol string in the request (eg: HTTP/1.1)
and return HTTP_BAD_REQUEST if not valid. Versions of Apache
prior to 1.3.26 would silently ignore bad protocol strings, but
1.3.26 included a more strict check. This makes it runtime
configurable. The default is On. This also removes the requirement
on an ANSI sscanf() implementation.

PR:
Obtained from:
Submitted by:
Reviewed by:


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95978 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95974 13f79535-47bb-0310-9956-ffa450edef68

used a semaphore to simulate the file locking behavior.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95973 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95904 13f79535-47bb-0310-9956-ffa450edef68

PR:
Obtained from:
Submitted by:
Reviewed by:


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95902 13f79535-47bb-0310-9956-ffa450edef68

and add some missing ones (I applied a while ago for the remaining
CVE names for older issues, but since these are pre-2000 they are low
priority)
PR:
Obtained from:
Submitted by:
Reviewed by:


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95901 13f79535-47bb-0310-9956-ffa450edef68

	Style police; there appears to be a bug in here somewhere
	(see bugzilla #10259), and I want to get the code style
	fix out of the way first.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95890 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95889 13f79535-47bb-0310-9956-ffa450edef68

PR:
Obtained from:
Submitted by:
Reviewed by:


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95845 13f79535-47bb-0310-9956-ffa450edef68

to daedalus to go through.  keeps stalling.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95841 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95831 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95823 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95811 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95809 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95802 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95798 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95797 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95796 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95794 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95790 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95783 13f79535-47bb-0310-9956-ffa450edef68