git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1611791 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1611741 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1611725 13f79535-47bb-0310-9956-ffa450edef68

mod_authnz_fcgi.c:580:44: warning: 'orspbuflen'
may be used uninitialized in this function.

Not true but annoying.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1611600 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1611481 13f79535-47bb-0310-9956-ffa450edef68

Remove useless comment. As far as I have tested (with dox 1.8.6), it works as described in doxygen doc.

Generated docs are still only visible from the "List File". More work is needed to have them included within the "Module/Core routine" architecture. However they are now useable and the ouput of "make dox" is now readable :)

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1611480 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1611430 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1611357 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1611256 13f79535-47bb-0310-9956-ffa450edef68

Improve layout, add trailing '.' in function description, capitalize first letter of description, fix typo, turn \0 into \\0.
Move the detailled description after @defgroup so that it is taken into account.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1611252 13f79535-47bb-0310-9956-ffa450edef68

work due to the fact that we overload rv as both the DWORD windows result
and the apr_status_t result code.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1611244 13f79535-47bb-0310-9956-ffa450edef68

Improve layout, add trailing '.' in function description, remove unneeded @fn.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1611210 13f79535-47bb-0310-9956-ffa450edef68

Improve layout, add trailing '.' in function description, remove unneeded @fn.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1611202 13f79535-47bb-0310-9956-ffa450edef68

internationalization.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1611169 13f79535-47bb-0310-9956-ffa450edef68

for 80 character folding and legibility.

Folds several identical errors into the same APLOGNO() groups.

Catches several errors which were missing APLOGNO() entries, in the
existing groups and in one new message.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1611165 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1611012 13f79535-47bb-0310-9956-ffa450edef68

Submitted by normw at gknw net.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1610997 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1610916 13f79535-47bb-0310-9956-ffa450edef68

     core: HTTP trailers could be used to replace HTTP headers
     late during request processing, potentially undoing or
     otherwise confusing modules that examined or modified
     request headers earlier.  Adds "MergeTrailers" directive to restore
     legacy behavior.  

Submitted By: Edward Lu, Yann Ylavic, Joe Orton, Eric Covener
Committed By: covener



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1610814 13f79535-47bb-0310-9956-ffa450edef68

       - to correctly reset bits
       - not to modify the 'method_mask' bitfield unnecessarily

Also remove a useless 'register' in the declaration of a variable.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1610813 13f79535-47bb-0310-9956-ffa450edef68

character as the first character in a 2/3 character pattern.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1610707 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1610686 13f79535-47bb-0310-9956-ffa450edef68

proxy configuration, a remote attacker could send a carefully crafted
request which could crash a server process, resulting in denial of
service.

Thanks to Marek Kroemeke working with HP's Zero Day Initiative for
reporting this issue.

* server/util.c (ap_parse_token_list_strict): New function.

* modules/proxy/proxy_util.c (find_conn_headers): Use it here.

* modules/proxy/mod_proxy_http.c (ap_proxy_http_process_response):
  Send a 400 for a malformed Connection header.

Submitted by: Edward Lu, breser, covener


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1610674 13f79535-47bb-0310-9956-ffa450edef68

service in the WinNT MPM used in all Windows installations.
Workaround: AcceptFilter <protocol> {none|connect}

Submitted by: trawick
Reviewed by: jorton, covener, jim


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1610652 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1610518 13f79535-47bb-0310-9956-ffa450edef68

   mod_cgid: Fix a denial of service against CGI scripts that do
   not consume stdin that could lead to lingering HTTPD child processes
   filling up the scoreboard and eventually hanging the server.
   [Rainer Jung, Eric Covener, Yann Ylavic]

Submitted By: rjung, covener, ylavic
Reviewed By: trawick, jorton, covener, jim
   


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1610509 13f79535-47bb-0310-9956-ffa450edef68

     mod_deflate: The DEFLATE input filter (inflates request bodies) now
     limits the length and compression ratio of inflated request bodies to avoid
     denial of sevice via highly compressed bodies.  See directives 
     DeflateInflateLimitRequestBody, DeflateInflateRatioLimit,
     and DeflateInflateRatioBurst.

Thanks to Giancarlo Pellegrino and Davide Balzarotti for reporting the issue.

Submitted By: ylavic, covener
Reviewed By: jorton, covener, jim




git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1610501 13f79535-47bb-0310-9956-ffa450edef68

which could lead to a heap buffer overflow.  Thanks to Marek Kroemeke
working with HP's Zero Day Initiative for reporting this.

* include/scoreboard.h: Add ap_copy_scoreboard_worker.

* server/scoreboard.c (ap_copy_scoreboard_worker): New function.

* modules/generators/mod_status.c (status_handler): Use it.

* modules/lua/lua_request.c (lua_ap_scoreboard_worker): Likewise.

Reviewed by: trawick, jorton, covener, jim
Submitted by: jorton, covener


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1610491 13f79535-47bb-0310-9956-ffa450edef68

Cases where 'loc' doesn't have any ':' or is  starting with ':' are already handled by 'ap_ir_url()'
Calling 'apr_isascii()' seems useless.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1610383 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1610366 13f79535-47bb-0310-9956-ffa450edef68

Save a few cycles by calling 'apr_isalnum' instead of 'apr_isalpha' and 'apr_isdigit'.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1610353 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1610341 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1610339 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1610329 13f79535-47bb-0310-9956-ffa450edef68

Followup to r1604466.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1610323 13f79535-47bb-0310-9956-ffa450edef68

resumed by TLS session resumption (RFC 5077).


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1610311 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1610310 13f79535-47bb-0310-9956-ffa450edef68

like we already do for the remote port.

Both were forgotten in the original AJP 13 spec
but are needed by the Servlet spec. Until now,
Tomcat simply returns for getLocalAddr() the same as
for getLocalName().

The next round of Tomcat releases will look for the
optional new request attribute.

See also Tomcat BZ 56661.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1610207 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1610015 13f79535-47bb-0310-9956-ffa450edef68

response for 403 errors.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1609938 13f79535-47bb-0310-9956-ffa450edef68