CHANGES revision ef056d09d39412b9f7d9b71f48ff3d00222833f6
4d237bbe075b1d2c19428cd954d721d65b31f67cwrowe -*- coding: utf-8 -*-
bf52162f2d05c1fb1a107c7ef108de73f739b3edpquernaChanges with Apache 2.5.0
bf52162f2d05c1fb1a107c7ef108de73f739b3edpquerna *) SECURITY: CVE-2012-2687 (cve.mitre.org)
86bb763be5d87c295c8844d30078da2ddb964f73rpluem mod_negotiation: Escape filenames in variant list to prevent an
86bb763be5d87c295c8844d30078da2ddb964f73rpluem possible XSS for a site where untrusted users can upload files to
ba217dc41cebc0976010ee177f8fedac782d1f6fminfrin a location with MultiViews enabled. [Niels Heinen <heinenn google.com>]
86bb763be5d87c295c8844d30078da2ddb964f73rpluem *) mod_authz_core: If an expression in "Require expr" returns denied and
86bb763be5d87c295c8844d30078da2ddb964f73rpluem references %{REMOTE_USER}, trigger authentication and retry. PR 52892.
ba217dc41cebc0976010ee177f8fedac782d1f6fminfrin [Stefan Fritsch]
6bc4f334a04802bab835893d0c42af8bfb9c3c41sf *) mod_lua: Add new directive LuaAuthzProvider to allow implementing an
6bc4f334a04802bab835893d0c42af8bfb9c3c41sf authorization provider in lua. [Stefan Fritsch]
6bc4f334a04802bab835893d0c42af8bfb9c3c41sf *) mod_lua: Add a few missing request_rec fields. Rename remote_ip to
53593dbd8fece82cb66a23f0b7024d8d713d66f1sf client_ip to match conn_rec. [Stefan Fritsch]
79e3f2f950745953fff4a6a8dfe1f7cce31ce287sf *) mod_lua: Change prototype of vm_construct, to work around gcc bug which
79e3f2f950745953fff4a6a8dfe1f7cce31ce287sf causes a segfault. PR 52779. [Dick Snippe <Dick Snippe tech omroep nl>]
ab2b977442827214b1d884decf3e3f1579fd45e1rpluem *) mod_lua: Add the parsebody function for parsing POST data. PR 53064.
ab2b977442827214b1d884decf3e3f1579fd45e1rpluem [Daniel Gruno]
195edf54eccd8c5a436c7dd17f5f604e7074d5d1sf *) mod_ssl: If exiting during initialization because of a fatal error,
195edf54eccd8c5a436c7dd17f5f604e7074d5d1sf log a message to the main error log pointing to the appropriate
3709b26f3370ae89c5324a3c03fab56a93b09ecdsf virtual host error log. [Stefan Fritsch]
3709b26f3370ae89c5324a3c03fab56a93b09ecdsf *) mod_ldap: Treat the "server unavailable" condition as a transient
03577bc320125eaa2b27ee7af78b894ee6dfe121takashi error with all LDAP SDKs. [Filip Valder <filip.valder vsb.cz>]
03577bc320125eaa2b27ee7af78b894ee6dfe121takashi *) mod_ssl: Add support for TLS-SRP (Secure Remote Password key exchange
f5119c5d7cfe8c6d53cb29d43f8746684068ed82minfrin for TLS, RFC 5054). PR 51075. [Quinn Slack <sqs cs stanford edu>,
f5119c5d7cfe8c6d53cb29d43f8746684068ed82minfrin Christophe Renou, Peter Sylvester]
f5119c5d7cfe8c6d53cb29d43f8746684068ed82minfrin *) htdbm, htpasswd: Don't crash if crypt() fails (e.g. with FIPS enabled).
f74d35a61a835e15412b99b8aebe4958fe4e94a5takashi [Paul Wouters <pwouters redhat.com>, Joe Orton]
f74d35a61a835e15412b99b8aebe4958fe4e94a5takashi *) mod_ssl: Add new directive SSLCompression to disable TLS-level
20216b769716c4346cce373f2028d7dbebf03886poirier compression. PR 53219. [Björn Jacke <bjoern j3e de>, Stefan Fritsch]
20216b769716c4346cce373f2028d7dbebf03886poirier *) core: Make ap_regcomp() return AP_REG_ESPACE if out of memory. Make
7317a32e0c621c9a28f6f10e83e6c5dc63e3f3bdsf ap_pregcomp() abort if out of memory. This raises the minimum PCRE
7317a32e0c621c9a28f6f10e83e6c5dc63e3f3bdsf requirement to version 6.0. PR 53284. [Stefan Fritsch]
ecc6e723b804fb4b8f858910eff3f88242ec56fasf *) apxs: Use LDFLAGS from config_vars.mk in addition to CFLAGS and CPPFLAGS.
ecc6e723b804fb4b8f858910eff3f88242ec56fasf [Stefan Fritsch]
ecc6e723b804fb4b8f858910eff3f88242ec56fasf *) mpm_event: Fix handling of MaxConnectionsPerChild. [Stefan Fritsch]
ecc6e723b804fb4b8f858910eff3f88242ec56fasf *) suexec: Add --enable-suexec-capabilites support on Linux, to use
727d68c6009030f56a350b4603384ce4fb844341minfrin setuid/setgid capability bits rather than a setuid root binary.
727d68c6009030f56a350b4603384ce4fb844341minfrin [Joe Orton]
ed6dfb7d7057dc4f42348f12d7bff9fe98fc73cfminfrin *) suexec: Add support for logging to syslog as an alternative to logging
ed6dfb7d7057dc4f42348f12d7bff9fe98fc73cfminfrin to a file; configure --without-suexec-logfile --with-suexec-syslog.
ed6dfb7d7057dc4f42348f12d7bff9fe98fc73cfminfrin [Joe Orton]
4dee28b6fc8fff5efde4e7821aeb6defed3fb84dsf *) mod_proxy_ajp: Reduce memory usage in case of many keep-alive requests on
4dee28b6fc8fff5efde4e7821aeb6defed3fb84dsf one connection. PR 52275. [Naohiro Ooiwa <naohiro ooiwa miraclelinux com>]
23247a8f748077bc788a5fbaf91d5fad34d0b7d1sf *) mod_proxy: Use the the same hostname for SNI as for the HTTP request when
23247a8f748077bc788a5fbaf91d5fad34d0b7d1sf forwarding to SSL backends. PR 53134.
23247a8f748077bc788a5fbaf91d5fad34d0b7d1sf [Michael Weiser <michael weiser.dinsnail.net>, Ruediger Pluem]
58015652ffe00f004c6404a0631474f23dadc7dasf *) mod_ssl: Add support for TLS Next Protocol Negotiation. PR 52210.
58015652ffe00f004c6404a0631474f23dadc7dasf [Matthew Steele <mdsteele google.com>]
2af38cc44e48753913565b38a7a9f325f898a293minfrin *) mod_so: If a filename without slashes is specified for LoadFile or
745417156908df54538ca284b382ce8d27b30066minfrin LoadModule and the file cannot be found in the server root directory,
2af38cc44e48753913565b38a7a9f325f898a293minfrin try to use the standard dlopen() search path. [Stefan Fritsch]
fc2f0972572614b50523bc5ddb3f866ca4acd2f0sf *) various modules, rotatelogs: Replace use of apr_file_write() with
fc2f0972572614b50523bc5ddb3f866ca4acd2f0sf apr_file_write_full() to prevent incomplete writes. PR 53131.
251430bcaff1fa6a77953bfe56475eb6cc7abc78sf [Nicolas Viennot <apache viennot biz>, Stefan Fritsch]
251430bcaff1fa6a77953bfe56475eb6cc7abc78sf *) cross-compile: allow to provide CC_FOR_BUILD so that gen_test_char will
7b467aa53854c95318a1c709709c1619a4f47118minfrin be compiled by the build compiler instead of the host compiler.
7b467aa53854c95318a1c709709c1619a4f47118minfrin Also set CC_FOR_BUILD to 'cc' when cross-compilation is detected.
7b467aa53854c95318a1c709709c1619a4f47118minfrin PR 51257. [Guenter Knauf]
7ba7402d405dc9e3c1083e34049ed933472ca910poirier *) mod_authz_core: Fix parsing of Require arguments in <AuthzProviderAlias>.
7ba7402d405dc9e3c1083e34049ed933472ca910poirier PR 53048. [Stefan Fritsch]
7ba7402d405dc9e3c1083e34049ed933472ca910poirier *) core: Fix error handling in ap_scan_script_header_err_brigade() if there
7ba7402d405dc9e3c1083e34049ed933472ca910poirier is no EOS bucket in the brigade. Fixes segfault with mod_proxy_fcgi.
4286d2e267e788d856092bf2ccf461e7ca99570frpluem PR 48272. [Stefan Fritsch]
4286d2e267e788d856092bf2ccf461e7ca99570frpluem *) mod_proxy_fcgi: If there is an error reading the headers from the
4286d2e267e788d856092bf2ccf461e7ca99570frpluem backend, send an error to the client. PR 52879. [Stefan Fritsch]
5357892a1e367372dc2d4a315156e3e44dc5d56dpoirier *) mod_rewrite: Fix RewriteCond integer checks to be parsed correctly.
5357892a1e367372dc2d4a315156e3e44dc5d56dpoirier PR 53023. [Axel Reinhold <apache freakout.de>, André Malo]
b42af5f6edf4fe4b820288c37920a7a6fd65f1f1poirier *) Fix MPM DSO load failure on AIX. [Jeff Trawick]
49cea03e96dc4707bce15d6318eb013cb8668d96minfrin *) core: Add the port number to the vhost's name in the scoreboard.
49cea03e96dc4707bce15d6318eb013cb8668d96minfrin [Stefan Fritsch]
49cea03e96dc4707bce15d6318eb013cb8668d96minfrin *) mpm_event: Don't do a blocking write when starting a lingering close
847b3922f7dcde6830f4aad49d29c84b4569c260minfrin from the listener thread. PR 52229. [Stefan Fritsch]
63eaa8ed62d63de0a44346b8af48e08e562db01eminfrin *) core: In maintainer mode, replace apr_palloc with a version that
847b3922f7dcde6830f4aad49d29c84b4569c260minfrin initializes the allocated memory with non-zero values, except if
1af2b28846e2647963db788b081676884fb7df8crpluem AP_DEBUG_NO_ALLOC_POISON is defined. [Stefan Fritsch]
1af2b28846e2647963db788b081676884fb7df8crpluem *) mod_authnz_ldap: Don't try a potentially expensive nested groups
845258fbf5102b8b09fe9b7f4cb4ea4c089344c3poirier search before exhausting all AuthLDAPGroupAttribute checks on the
845258fbf5102b8b09fe9b7f4cb4ea4c089344c3poirier current group. PR52464 [Eric Covener]
5d36cddfe00d5c6ad18845fcc04e6f7662050fafminfrin *) mod_policy: Add a new testing module to help server administrators
5d36cddfe00d5c6ad18845fcc04e6f7662050fafminfrin enforce a configurable level of protocol compliance on their
5d36cddfe00d5c6ad18845fcc04e6f7662050fafminfrin servers and application servers behind theirs. [Graham Leggett]
20aa41f86a5b451529d26d9b901eea69989e5c0aminfrin *) mod_firehose: Add a new debugging module able to record traffic
20aa41f86a5b451529d26d9b901eea69989e5c0aminfrin passing through the server in such a way that connections and/or
8c92aeeb75b1b393f61a3e01c495484737a0ff8cminfrin requests be reconstructed and replayed. [Graham Leggett]
8c92aeeb75b1b393f61a3e01c495484737a0ff8cminfrin *) mod_noloris
e5db2522dbe503cbf5399094b6239c88c246a8c5poirier *) Simple MPM
e5db2522dbe503cbf5399094b6239c88c246a8c5poirier *) mod_serf
ad7e5e9fb8f63a5155bb392114162997505ff772minfrin [Apache 2.5.0-dev includes those bug fixes and changes with the
ad7e5e9fb8f63a5155bb392114162997505ff772minfrin Apache 2.4.xx tree as documented below, except as noted.]
ad7e5e9fb8f63a5155bb392114162997505ff772minfrinChanges with Apache 2.4.x and later:
59cb8d601b8c44476e59310f68b9c373d8fc62a6minfrin *) http://svn.apache.org/viewvc/httpd/httpd/branches/2.4.x/CHANGES?view=markup
59cb8d601b8c44476e59310f68b9c373d8fc62a6minfrinChanges with Apache 2.2.x and later:
ec8b1faa56744b338f6d6421144b56c2bb3faae6poirier *) http://svn.apache.org/viewvc/httpd/httpd/branches/2.2.x/CHANGES?view=markup
10abdcbd7b30d957d15c61ea8100ba97a627ac95minfrinChanges with Apache 2.0.x and later: