Commits · e97839d65937a514a222d2fee56c5c13f9d7653f · CYBER - Cyber Security / TS 103 523 MSP / TLMSP / TLMSP Apache Httpd

Apr 18, 2006

Thiago Zaninotti reported to security@apache.org on 20060410 a possible · e97839d6

Mark J. Cox authored Apr 18, 2006

cross-site scripting flaw because the Expect header error message isn't
escaped. We couldn't find a way that this could be used by an attacker
however, as they can't influence the Expect header a victim will send to a
target site. Thiago agreed and we're therefore not treating this as a
security flaw, but it is a bug that ought to get fixed. I'll add to
STATUS for 1.3/2.0/2.2 shortly for acks.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@394965 13f79535-47bb-0310-9956-ffa450edef68

e97839d6

Apr 16, 2006

* Also initialize local data structures for workers of a balancer. · 1141e9a4

Ruediger Pluem authored Apr 16, 2006

PR: 38227, 39267
Submitted by: James A. Robinson <jim.robinson stanford.edu>
Reviewed by: rpluem


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@394446 13f79535-47bb-0310-9956-ffa450edef68

1141e9a4

Apr 14, 2006

* Sync with 2.2.x CHANGES · 9f4584eb

Ruediger Pluem authored Apr 14, 2006


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@394092 13f79535-47bb-0310-9956-ffa450edef68

9f4584eb

* Avoid calling ap_proxy_http_cleanup twice as this releases a connection · 2a16d5f9

Ruediger Pluem authored Apr 14, 2006

  from the connection pool twice. This causes this connection to be present
  in the connection pool twice. Thus it may be used by different threads
  at the same time which causes many troubles (segfaults in this case).
  Furthermore implement a logic to prevent double releases to the connection
  pool if they are triggered by buggy code and log an error message in this
  case.

  - mod_proxy_http.c: remove double calls to ap_proxy_http_cleanup
  - proxy_util.c: Add logic to prevent double releases of a
    connection to the connection pool.

PR: 38793


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@394088 13f79535-47bb-0310-9956-ffa450edef68

2a16d5f9

* Initialize last_char as otherwise a random value will be compared · a475dde6

Ruediger Pluem authored Apr 14, 2006

  against APR_ASCII_LF at the end of the loop if bb only contains an
  EOS bucket.

PR: 39282
Submitted by: Davi Arnaut <davi haxent.com.br>
Reviewed by: rpluem


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@394070 13f79535-47bb-0310-9956-ffa450edef68

a475dde6

Apr 12, 2006

The crypt() prototype is in <unistd.h> instead of <crypt.h> · 62f5a2fd

Jeff Trawick authored Apr 12, 2006

on HP-UX.  We had no prototype for crypt() there.
In 64-bit mode, a crash occurred because the pointer 
returned by crypt() was truncated before we passed
the pointer to apr_cpystrn().


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@393364 13f79535-47bb-0310-9956-ffa450edef68

62f5a2fd

Apr 10, 2006

* Rollback r393037 as this was vetoed by wrowe. Details see · 13fe1784

Ruediger Pluem authored Apr 10, 2006

  http://mail-archives.apache.org/mod_mbox/httpd-dev/200604.mbox/%3c443ABE65.1060603@rowe-clan.net%3e


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@393087 13f79535-47bb-0310-9956-ffa450edef68

13fe1784

* Prevent r->parsed_uri.path from being NULL as this can cause segmentation · 2cdf62e1

Ruediger Pluem authored Apr 10, 2006

  faults e.g. in mod_cache. Set it to "/" in this case.

PR: 39259
Submitted by: Davi Arnaut <davi haxent.com.br>
Reviewed by: rpluem


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@393037 13f79535-47bb-0310-9956-ffa450edef68

2cdf62e1

htdbm: Warn the user when adding a plaintext password on a platform · 927ba95a

Jeff Trawick authored Apr 10, 2006

where it wouldn't work with the server (i.e., anywhere that has
crypt()).


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@392944 13f79535-47bb-0310-9956-ffa450edef68

927ba95a

Apr 08, 2006

* Check for an existing socket independant of an existing connection record. · da57990e

Ruediger Pluem authored Apr 08, 2006

  This ensures that requests handled by the '*' worker are sent to the correct
  backend server.

PR: 39253


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@392613 13f79535-47bb-0310-9956-ffa450edef68

da57990e

Apr 02, 2006

Default handler: Don't return output filter apr_status_t values. · d99724e7

Jeff Trawick authored Apr 02, 2006

PR: 31759
Helped by: Ruediger Pluem, Joe Orton


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@390922 13f79535-47bb-0310-9956-ffa450edef68

d99724e7

remove charset turds left by last commit · f5a57b54

Roy T. Fielding authored Apr 02, 2006

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@390887 13f79535-47bb-0310-9956-ffa450edef68

f5a57b54

Apr 01, 2006

* Sync with CHANGES files of 2.2.x and 2.0.x · 60606c6b

Ruediger Pluem authored Apr 01, 2006


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@390753 13f79535-47bb-0310-9956-ffa450edef68

60606c6b

* Sync with 2.2.x CHANGES file · 836b01da

Ruediger Pluem authored Apr 01, 2006


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@390616 13f79535-47bb-0310-9956-ffa450edef68

836b01da

Mar 31, 2006

* Sync with 2.2.x CHANGES file · 7e3cf716

Ruediger Pluem authored Mar 31, 2006


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@390507 13f79535-47bb-0310-9956-ffa450edef68

7e3cf716

Note backports to be in 2.2.1 · 4ad433b2

Jim Jagielski authored Mar 31, 2006


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@390496 13f79535-47bb-0310-9956-ffa450edef68

4ad433b2

Mar 30, 2006

Document the removal of the flushing bandaid to a · 5dd51449

Jim Jagielski authored Mar 30, 2006

runtime param. Since other protocols might benefit
from this, remove the ajp_ prefixes, to make it
more generic looking.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@390210 13f79535-47bb-0310-9956-ffa450edef68

5dd51449

Note merged backport · bf8c6d1c

Jim Jagielski authored Mar 30, 2006

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@390192 13f79535-47bb-0310-9956-ffa450edef68

bf8c6d1c

Backported to 2.2.1... · 14641516

Jim Jagielski authored Mar 30, 2006

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@390185 13f79535-47bb-0310-9956-ffa450edef68

14641516

Mar 13, 2006

reflect a couple of items merged into 2.2.1-dev · d5347ec3

Jeff Trawick authored Mar 13, 2006


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@385583 13f79535-47bb-0310-9956-ffa450edef68

d5347ec3

Mar 05, 2006

* Crosscheck the length of the body chunk with the length of the ajp message · 6023b116

Ruediger Pluem authored Mar 05, 2006

to prevent readings beyond the buffer boundaries which possibly could reveal
sensitive memory contents to the client.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@383339 13f79535-47bb-0310-9956-ffa450edef68

6023b116

Feb 28, 2006

Revert the refactoring of the request read code · 70188dee

Brian Pane authored Feb 28, 2006

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@381679 13f79535-47bb-0310-9956-ffa450edef68

70188dee

Feb 27, 2006

* Document fixes for PR 38524. · b69ec0c3

Ruediger Pluem authored Feb 27, 2006


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@381469 13f79535-47bb-0310-9956-ffa450edef68

b69ec0c3

Feb 25, 2006

Fill in the scoreboard's tid field in the event MPM, just like we do in · a0e92e2f

Garrett Rooney authored Feb 25, 2006

other MPMs.

Submitted by: Chris Darroch <chrisd pearsoncmg.com>
Issue: 38736

* server/mpm/experimental/event/event.c
  (worker_thread): Fill in the scoreboard's tid field.

* CHANGES: Note change.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@380878 13f79535-47bb-0310-9956-ffa450edef68

a0e92e2f

Feb 23, 2006

mod_charset_lite: Remove Content-Length when output filter can · 9c97962e

Jeff Trawick authored Feb 23, 2006

invalidate it.  Warn when input filter can invalidate it.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@380232 13f79535-47bb-0310-9956-ffa450edef68

9c97962e

Feb 21, 2006

Ensure that the proper status line is written to the client, fixing · 1db46cae

Jeff Trawick authored Feb 21, 2006

incorrect status lines caused by filters which modify r->status without
resetting r->status_line, such as the built-in byterange filter.

Note: For the byterange example, the handler must set r->status_line
even though this is a 200 response. Some proxy-type modules blindly
set r->status_line as set by the origin server and thus trigger
the problem with byteranges if the origin server didn't handle the
byterange.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@379562 13f79535-47bb-0310-9956-ffa450edef68

1db46cae

Feb 17, 2006

* modules/ssl/ssl_engine_init.c (ssl_check_public_cert): Fix spurious · 5c87df10

Joe Orton authored Feb 17, 2006

hostname-mismatch warning for valid wildcard certs.

PR: 37911
Submitted by: Nick Burch <nick torchbox.com>


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@378487 13f79535-47bb-0310-9956-ffa450edef68

5c87df10

Feb 15, 2006

- Nitpicking style police: Add space between PR and number of PR · 2ec413cd

Ruediger Pluem authored Feb 15, 2006

- Remove myself from credit list of fix for PR 38340, as this patch went
  in unaltered.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@378085 13f79535-47bb-0310-9956-ffa450edef68

2ec413cd

*) mod_proxy: Fix KeepAlives not being allowed and set to · 5439fda0

Jim Jagielski authored Feb 15, 2006

     backend servers. PR38602. [Ruediger Pluem, Jim Jagielski]

Also, document previous patch:
  *) Correctly initialize mod_proxy workers, which use a
     combination of local and shared datasets. Adjust logging
     to better trace usage. PR38403. [Jim Jagielski]



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@378032 13f79535-47bb-0310-9956-ffa450edef68

5439fda0

Feb 13, 2006

Make the worker and event MPMs support GracefulShutdownTimeout just like · 33fb57a0

Garrett Rooney authored Feb 13, 2006

the prefork MPM does.

Submitted by: Chris Darroch <chrisd pearsoncmg.com>
Ported to event MPM by: rooneg
Issue number: 38621

* server/mpm/worker/worker.c
  (ap_mpm_run): Make the graceful shutdown log message refer to the right
   signal, and respect the graceful shutdown timeout if there is one.

* server/mpm/experimental/event/event.c
  (ap_mpm_run): Ditto.

* CHANGES: Note change.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@377291 13f79535-47bb-0310-9956-ffa450edef68

33fb57a0

Feb 04, 2006

* sync with 2.2.x CHANGES · 8ae0ffa4

Ruediger Pluem authored Feb 04, 2006


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@374935 13f79535-47bb-0310-9956-ffa450edef68

8ae0ffa4

* Do not overwrite the status of initialized workers and respect the configured · e0727e42

Ruediger Pluem authored Feb 04, 2006

  status of uninitilized workers when creating a new child process.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@374929 13f79535-47bb-0310-9956-ffa450edef68

e0727e42

· 23a214ba

William A. Rowe Jr authored Feb 04, 2006

  Sync

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@374911 13f79535-47bb-0310-9956-ffa450edef68

23a214ba

Solaris build proposal; don't fail on missing .h files within · d32113c7

William A. Rowe Jr authored Feb 04, 2006

a VPATH build, and don't test trees with -d (simply -f the
expected files) in case a tree such as srclib/apr is actually
a symlink rather than a true directory in ./buildconf.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@374821 13f79535-47bb-0310-9956-ffa450edef68

d32113c7

Jan 30, 2006

mod_speling: Stop crashing with certain non-file requests. · cd1ad0e5

Jeff Trawick authored Jan 30, 2006

(r->filename unset)


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@373519 13f79535-47bb-0310-9956-ffa450edef68

cd1ad0e5

Jan 21, 2006

* Fix PR38340 by actual getting the word and thus advancing the message buffer · 543dda57

Ruediger Pluem authored Jan 21, 2006

  pointer to the next data.

Submitted by: Aleksey Pesternikov <apesternikov yahoo.com>
Reviewed by: Ruediger Pluem


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@371013 13f79535-47bb-0310-9956-ffa450edef68

543dda57

Jan 18, 2006

* Fix PR38123 by adding the HTTP_IN filter also in the case of an invalid · 1953bc35

Ruediger Pluem authored Jan 18, 2006

  expect header.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@370172 13f79535-47bb-0310-9956-ffa450edef68

1953bc35

Jan 17, 2006

Note the changes to Authz · 05a4fe1c

Bradley Nicholes authored Jan 17, 2006

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@369823 13f79535-47bb-0310-9956-ffa450edef68

05a4fe1c

* Add CacheMinExpire directive to set the minimum time in seconds to cache a document · 93e204af

Ruediger Pluem authored Jan 17, 2006

in the case that no valid expire time was supplied with the document.

Submitted by: Brian Akins <brian.akins turner.com>
Reviewed by: Ruediger Pluem

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@369811 13f79535-47bb-0310-9956-ffa450edef68

93e204af

Jan 13, 2006

* Sync with 2.2.x STATUS file · 7444bda0

Ruediger Pluem authored Jan 13, 2006


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@368887 13f79535-47bb-0310-9956-ffa450edef68

7444bda0