PR: 11626


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@96354 13f79535-47bb-0310-9956-ffa450edef68

security changes so they are consistant
PR:
Obtained from:
Submitted by:
Reviewed by:


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@96235 13f79535-47bb-0310-9956-ffa450edef68

Submitted by:	Larry Rosenman <ler@lerctr.org>
Reviewed by:	Jeff Trawick


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@96178 13f79535-47bb-0310-9956-ffa450edef68

response line ("HTTP/1.1 200 \r\n"). It looks like RFC2616 allows this,
but ap_getline() strips the trailing blank, and that lead to
an error in ap_proxy_read_response_line() for proxy-requests to
Tomcat+mod_jk2 servers. (It replaced the NIL after the "200" by
a space, and so the resulting response line had an extra NL appended).
Now the SP character which was deleted by ap_getline() is reappended,
avoiding the erroneous '\0'->' ' change, and preserving RFC2616's
requirement
     Status-Line = HTTP-Version SP Status-Code SP Reason-Phrase CRLF
     Reason-Phrase = *<TEXT, excluding CR, LF>
(thus there is now always a SP after the Status-Code).


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@96144 13f79535-47bb-0310-9956-ffa450edef68

Submitted by:	Henning Brauer <hb-apache-dev@bsws.de>
Reviewed by:	Jim Jagielski, Jeff Trawick


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@96096 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@96095 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@96078 13f79535-47bb-0310-9956-ffa450edef68

with the value at startup - have a method to find the value without
actually really running it (or binding ot ports, touching logs, etc).


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@96077 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@96032 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95987 13f79535-47bb-0310-9956-ffa450edef68

we do not allow for the total bogusness of values for C-L, just this
one special case. IMO a C-L field of "iloveyou" is bogus as is one
of "123yabbadabbado", which older versions appear to have allowed
(and in the 1st case, assume 0 and in the 2nd assume 123). Didn't
make sense to make this runtime, but a documented special case
instead.
PR:
Obtained from:
Submitted by:
Reviewed by:


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95986 13f79535-47bb-0310-9956-ffa450edef68

check for a valid protocol string in the request (eg: HTTP/1.1)
and return HTTP_BAD_REQUEST if not valid. Versions of Apache
prior to 1.3.26 would silently ignore bad protocol strings, but
1.3.26 included a more strict check. This makes it runtime
configurable. The default is On. This also removes the requirement
on an ANSI sscanf() implementation.

PR:
Obtained from:
Submitted by:
Reviewed by:


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95978 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95974 13f79535-47bb-0310-9956-ffa450edef68

used a semaphore to simulate the file locking behavior.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95973 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95904 13f79535-47bb-0310-9956-ffa450edef68

PR:
Obtained from:
Submitted by:
Reviewed by:


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95902 13f79535-47bb-0310-9956-ffa450edef68

and add some missing ones (I applied a while ago for the remaining
CVE names for older issues, but since these are pre-2000 they are low
priority)
PR:
Obtained from:
Submitted by:
Reviewed by:


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95901 13f79535-47bb-0310-9956-ffa450edef68

	Style police; there appears to be a bug in here somewhere
	(see bugzilla #10259), and I want to get the code style
	fix out of the way first.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95890 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95889 13f79535-47bb-0310-9956-ffa450edef68

PR:
Obtained from:
Submitted by:
Reviewed by:


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95845 13f79535-47bb-0310-9956-ffa450edef68

to daedalus to go through.  keeps stalling.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95841 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95831 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95823 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95811 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95809 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95802 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95798 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95797 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95796 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95794 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95790 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95783 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95781 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95780 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95779 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95778 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95777 13f79535-47bb-0310-9956-ffa450edef68

a good idea.

(How this escaped for essentially 5 years is completely unknown)


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95776 13f79535-47bb-0310-9956-ffa450edef68

were failing to build because ap_strtol() wasn't being exported from the core.
This makes it unnecessary.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95770 13f79535-47bb-0310-9956-ffa450edef68

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95766 13f79535-47bb-0310-9956-ffa450edef68