Fix insecure handling of LD_LIBRARY_PATH that could lead to the
current working directory to be searched for DSOs

CVE-2012-0883

Submitted by: sf
Reviewed/backported by: jim


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1298453 13f79535-47bb-0310-9956-ffa450edef68

Pass the EOS bucket down the filter chain

PR: 52766

Submitted by: sf
Reviewed/backported by: jim


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1298451 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1294764 13f79535-47bb-0310-9956-ffa450edef68

Enable per-module loglevel for mod_xml2enc and mod_proxy_html


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1294159 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1294158 13f79535-47bb-0310-9956-ffa450edef68

Fix AddOutputFilterByType brown paper bag crash bug
Initialize pointers, fix off-by-one.
PR: 52755


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1294157 13f79535-47bb-0310-9956-ffa450edef68

mod_session: Sessions are encoded as application/x-www-form-urlencoded strings,
however we do not handle the encoding of spaces properly. Fixed.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1293889 13f79535-47bb-0310-9956-ffa450edef68

consistent with the default configuration.

PR 52715.

Backport from trunk of r1241069 and 1241071.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1293800 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1291315 13f79535-47bb-0310-9956-ffa450edef68

from trunk to 2.4.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1291307 13f79535-47bb-0310-9956-ffa450edef68

Also rephrase remaining mentioning of the deps package.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1243670 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1243504 13f79535-47bb-0310-9956-ffa450edef68

PCRE dropped support for pcre_info() which is
deprecated since a long time. Use pcre_fullinfo()
instead, which exists since version 3.0 of PCRE.

Patch provided by Ruediger Pluem.

Backport of r1243176 from trunk.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1243177 13f79535-47bb-0310-9956-ffa450edef68

two known issues gone


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1240480 13f79535-47bb-0310-9956-ffa450edef68

Check during configtest that the directories for error logs exist

PR: 29941


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1238824 13f79535-47bb-0310-9956-ffa450edef68

Core configuration: add AllowOverride option to treat syntax
errors in .htaccess as non-fatal.
PR 52439


Submitted by: niq
Reviewed/backported by: jim


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1238698 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1238654 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1235916 13f79535-47bb-0310-9956-ffa450edef68

the problem was introduced.

(following r1235875 which DidTRT for 2.2.x/CHANGES)


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1235894 13f79535-47bb-0310-9956-ffa450edef68

* server/core_filters.c (ap_core_output_filter): Don't read the entire
  output of a morphing bucket into RAM.

Submitted by: jorton, sf


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1234854 13f79535-47bb-0310-9956-ffa450edef68

could expose "httpOnly" cookies when no custom ErrorDocument is specified 
for status code 400. 


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1234838 13f79535-47bb-0310-9956-ffa450edef68

Make APACHE_MODULE() accept an optional prerequisite module for configure.

Introduce the following configure time dependencies:
  mod_proxy_* (except proxy_html) require mod_proxy
  mod_dav_* require mod_dav
  mod_session_* require mod_session
  mod_cache_disk requires mod_cache
  mod_heartbeat requires mod_watchdog

PR: 52487


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1234570 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1233887 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1233611 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1233609 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1232417 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1232071 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1230283 13f79535-47bb-0310-9956-ffa450edef68

SECURITY (CVE-2012-0031): Fix possible crash on shutdown if a child
changes the sb_type field in the scoreboard.  Since unprivileged
children should not be able to affect the parent in this way, this is
treated as a Low severity security issue.

Thanks to "halfdog" <me halfdog.net> for reporting this issue.

* server/scoreboard.c (ap_cleanup_scoreboard, ap_create_scoreboard):
  Use a static global to store an authoritative copy of the scoreboard
  type.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1230069 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1225481 13f79535-47bb-0310-9956-ffa450edef68

Fix segfault when trying to log a nameless valueless cookie

PR: 52256
Submitted by: Rainer Canavan <rainer-apache 7val com>


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1225385 13f79535-47bb-0310-9956-ffa450edef68

SSLProtocol: allow explicit control of TLSv1.1 and TLSv1.2 flavors when
compiled against OpenSSL 1.0.1 or later. Update documentation.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1222922 13f79535-47bb-0310-9956-ffa450edef68

Set OPENSSL_NO_SSL_INTERN when compiling against OpenSSL 1.0.1
or later, so that mod_ssl retains binary compatibility with future
versions when internal structures are changed. Use API functions
where available, and fall back to direct access for OpenSSL up
to 1.0.0, where needed.

Remove SSL_make_ciphersuite() from ssl_util_ssl.[ch], as it was
never used by any released version of mod_ssl.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1222920 13f79535-47bb-0310-9956-ffa450edef68

mod_mime: Don't arbitrarily bypass AddOutputFilter during a ProxyPass,
but then allow AddOutputFilter during a RewriteRule [P]. Make mod_mime
behave identically in both cases. PR52342.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1222643 13f79535-47bb-0310-9956-ffa450edef68

Move ab, logresolve, httxt2dbm and apxs to bin from sbin, along with
corresponding man pages.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1221299 13f79535-47bb-0310-9956-ffa450edef68

Distinguish properly between the bindir and sbindir directories when
installing binaries. Previously all binaries were silently installed to
sbindir, whether they were system administration commands or not.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1220867 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1214793 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1214787 13f79535-47bb-0310-9956-ffa450edef68

Streamline TLS session ticket key handling (added in r1200040):
- drop the SSLTicketKeyDefault directive, and only support a single
  ticket key per server/vhost
- rename the SSLTicketKeyFile directive to SSLSessionTicketKeyFile,
  remove the keyname parameter
- move ticket key parameters from SSLSrvConfigRec to modssl_ctx_t
- configure the tlsext_ticket_key_cb only when in server mode
- add documentation for SSLSessionTicketKeyFile


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1213395 13f79535-47bb-0310-9956-ffa450edef68

Limit length of lines in .htaccess to 8K again, to reduce DoS potential.
Make ap_varbuf_cfg_getline() strictly enforce the max_len parameter.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1213344 13f79535-47bb-0310-9956-ffa450edef68