CHANGES revision 9db0b0ee6ffade769db57b37a06b3f4849b5d367
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff -*- coding: utf-8 -*-
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduffChanges with Apache 2.3.9
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_cache: Make sure that we never allow a 304 Not Modified response
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff that we asked for to leak to the client should the 304 response be
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff uncacheable. PR45341 [Graham Leggett]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_cache: Add the cache_status hook to register the final cache
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff decision hit/miss/revalidate. Add optional support for an X-Cache
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff and/or an X-Cache-Detail header to add the cache status to the
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff response. PR48241 [Graham Leggett]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_authz_host: Add 'local' provider that matches connections originating
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff on the local host. PR 19938. [Stefan Fritsch]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) Event MPM: Fix crash accessing pollset on worker thread when child
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff process is exiting. [Jeff Trawick]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) core: For process invocation (cgi, fcgid, piped loggers and so forth)
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff pass the system library path (LD_LIBRARY_PATH or platform-specific
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff variables) along with the system PATH, by default. Both should be
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff overridden together as desired using PassEnv etc; see mod_env.
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff [William Rowe]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_cache: Introduce CacheStoreExpired, to allow administrators to
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff capture a stale backend response, perform If-Modified-Since requests
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff against the backend, and serving from the cache all 304 responses.
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff This restores pre-2.2.4 cache behavior. [William Rowe]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_rewrite: Introduce <=, >= string comparison operators, and integer
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff comparators -lt, -le, -eq, -ge, and -gt. To help bash users and drop
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff the ambiguity of the symlink test "-ltest", introduce -h or -L as
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff symlink test operators. [William Rowe]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_cache: Give the cache provider the opportunity to choose to cache
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff or not cache based on the buckets present in the brigade, such as the
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff presence of a FILE bucket.
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff [Graham Leggett]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_authz_core: Allow authz providers to check args while reading the
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff config and allow to cache parsed args. Move 'all' and 'env' authz
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff providers from mod_authz_host to mod_authz_core. Add 'method' authz
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff provider depending on the HTTP method. [Stefan Fritsch]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_include: Move the request_rec within mod_include to be
b610c3e7694ee7d23d00c046d9cdc37989102492jvergara exposed within include_ctx_t. [Graham Leggett]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_include: Reinstate support for UTF-8 character sets by allowing a
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff variable being echoed or set to be decoded and then encoded as separate
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff steps. PR47686 [Graham Leggett]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_cache: Add a discrete commit_entity() provider function within the
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff mod_cache provider interface which is called to indicate to the
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff provider that caching is complete, giving the provider the opportunity
ee236eb6e7c53dc81952f48002d16a485eda9061jvergara to commit temporary files permanently to the cache in an atomic
ee236eb6e7c53dc81952f48002d16a485eda9061jvergara fashion. Replace the inconsistent use of error cleanups with a formal
ee236eb6e7c53dc81952f48002d16a485eda9061jvergara set of pool cleanups attached to a subpool, which is destroyed on error.
ee236eb6e7c53dc81952f48002d16a485eda9061jvergara [Graham Leggett]
ee236eb6e7c53dc81952f48002d16a485eda9061jvergara *) mod_cache: Change the signature of the store_body() provider function
ee236eb6e7c53dc81952f48002d16a485eda9061jvergara within the mod_cache provider interface to support an "in" brigade
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff and an "out" brigade instead of just a single input brigade. This
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff gives a cache provider the option to consume only part of the brigade
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff passed to it, rather than the whole brigade as was required before.
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff This fixes an out of memory and a request timeout condition that would
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff occur when the original document was a large file. Introduce
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff CacheReadSize and CacheReadTime directives to mod_disk_cache to control
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff the amount of data to attempt to cache at a time. [Graham Leggett]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) core: Add ErrorLogFormat to allow configuring error log format, including
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff additional information that is logged once per connection or request. Add
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff error log IDs for connections and request to allow correlating error log
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff lines and the corresponding access log entry. [Stefan Fritsch]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) core: Disable sendfile by default. [Stefan Fritsch]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_cache: Check the request to determine whether we are allowed
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff to return cached content at all, and respect a "Cache-Control:
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff no-cache" header from a client. Previously, "no-cache" would
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff behave like "max-age=0". [Graham Leggett]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_cache: Use a proper filter context to hold filter data instead
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff of misusing the per-request configuration. Fixes a segfault on trunk
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff when the normal handler is used. [Graham Leggett]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_cgid: Log a warning if the ScriptSock path is truncated because
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff it is too long. PR 49388. [Stefan Fritsch]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) vhosts: Do not allow _default_ in NameVirtualHost, or mixing *
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff and non-* ports on NameVirtualHost, or multiple NameVirtualHost
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff directives for the same address:port, or NameVirtualHost
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff directives with no matching VirtualHosts, or multiple ip-based
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff VirtualHost sections for the same address:port. These were
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff previously accepted with a warning, but the behavior was
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff undefined. [Dan Poirier]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_remoteip: Fix a segfault when using mod_remoteip in conjunction with
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff Allow/Deny. PR 49838. [Andrew Skalski <voltara gmail.com>]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) core: DirectoryMatch can now match on the end of line character ($),
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff and sub-directories of matched directories are no longer implicitly
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff matched. PR49809 [Eric Covener]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) Regexps: introduce new higher-level regexp utility including parsing
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff and executing perl-style regexp ops (e.g s/foo/bar/i) and regexp memory
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduffChanges with Apache 2.3.8
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) suexec: Support large log files. PR 45856. [Stefan Fritsch]
b610c3e7694ee7d23d00c046d9cdc37989102492jvergara *) core: Abort with sensible error message if no or more than one MPM is
b610c3e7694ee7d23d00c046d9cdc37989102492jvergara loaded. [Stefan Fritsch]
b610c3e7694ee7d23d00c046d9cdc37989102492jvergara *) mod_proxy: Rename erroronstatus to failonstatus.
b610c3e7694ee7d23d00c046d9cdc37989102492jvergara [Daniel Ruggeri <DRuggeri primary.net>]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_dav_fs: Fix broken "creationdate" property.
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff Regression in version 2.3.7. [Rainer Jung]
2706915084d41c1829bb186eb242e800e8fd35b2jvergaraChanges with Apache 2.3.7
2706915084d41c1829bb186eb242e800e8fd35b2jvergara *) SECURITY: CVE-2010-1452 (cve.mitre.org)
2706915084d41c1829bb186eb242e800e8fd35b2jvergara mod_dav, mod_cache, mod_session: Fix Handling of requests without a path
2706915084d41c1829bb186eb242e800e8fd35b2jvergara segment. PR: 49246 [Mark Drayton, Jeff Trawick]
2706915084d41c1829bb186eb242e800e8fd35b2jvergara *) mod_ldap: Properly check the result returned by apr_ldap_init. PR 46076.
2706915084d41c1829bb186eb242e800e8fd35b2jvergara [Stefan Fritsch]
2706915084d41c1829bb186eb242e800e8fd35b2jvergara *) mod_rewrite: Log errors if rewrite map files cannot be opened. PR 49639.
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff [Stefan Fritsch]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_proxy_http: Support the 'ping' property for backend HTTP/1.1 servers
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff via leveraging 100-Continue as the initial "request".
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff [Jim Jagielski]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) core/mod_authz_core: Introduce new access_checker_ex hook that enables
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff mod_authz_core to bypass authentication if access should be allowed by
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff IP address/env var/... [Stefan Fritsch]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) core: Introduce note_auth_failure hook to allow modules to add support
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff for additional auth types. This makes ap_note_auth_failure() work with
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff mod_auth_digest again. PR 48807. [Stefan Fritsch]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) socache modules: return APR_NOTFOUND when a lookup is not found [Nick Kew]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_authn_cache: new module [Nick Kew]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) configure: Add reallyall option for --enable-mods-shared. [Stefan Fritsch]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) Fix Windows build when using VC6. [Gregg L. Smith <lists glewis com>]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_rewrite: Allow to set environment variables without explicitly
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff giving a value. [Rainer Jung]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_rewrite: Remove superfluous EOL from rewrite logging. [Rainer Jung]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_include: recognise "text/html; parameters" as text/html
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff PR 49616 [Andrey Chernov <ache nagual.pp.ru>]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) CGI vars: allow PATH to be set by SetEnv, consistent with LD_LIBRARY_PATH
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff PR 43906 [Nick Kew]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) Core: Extra robustness: don't try authz and segfault if authn
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff fails to set r->user. Log bug and return 500 instead.
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff PR 42995 [Nick Kew]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) HTTP protocol filter: fix handling of longer chunk extensions
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) Update SSL cipher suite and add example for SSLHonorCipherOrder.
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff [Lars Eilebrecht, Rainer Jung]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) move AddOutputFilterByType from core to mod_filter. This should
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff fix nasty side-effects that happen when content_type is set
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff more than once in processing a request, and make it fully
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff compatible with dynamic and proxied contents. [Nick Kew]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_log_config: Implement logging for sub second timestamps and
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff request end time. [Rainer Jung]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduffChanges with Apache 2.3.6
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) SECURITY: CVE-2009-3555 (cve.mitre.org)
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff mod_ssl: Comprehensive fix of the TLS renegotiation prefix injection
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff attack when compiled against OpenSSL version 0.9.8m or later. Introduces
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff the 'SSLInsecureRenegotiation' directive to reopen this vulnerability
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff and offer unsafe legacy renegotiation with clients which do not yet
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff support the new secure renegotiation protocol, RFC 5746.
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff [Joe Orton, and with thanks to the OpenSSL Team]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) SECURITY: CVE-2009-3555 (cve.mitre.org)
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff mod_ssl: A partial fix for the TLS renegotiation prefix injection attack
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff by rejecting any client-initiated renegotiations. Forcibly disable
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff keepalive for the connection if there is any buffered data readable. Any
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff configuration which requires renegotiation for per-directory/location
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff access control is still vulnerable, unless using OpenSSL >= 0.9.8l.
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff [Joe Orton, Ruediger Pluem, Hartmut Keil <Hartmut.Keil adnovum.ch>]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) SECURITY: CVE-2010-0408 (cve.mitre.org)
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff mod_proxy_ajp: Respond with HTTP_BAD_REQUEST when the body is not sent
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff when request headers indicate a request body is incoming; not a case of
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff HTTP_INTERNAL_SERVER_ERROR. [Niku Toivola <niku.toivola sulake.com>]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) SECURITY: CVE-2010-0425 (cve.mitre.org)
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff mod_isapi: Do not unload an isapi .dll module until the request
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff processing is completed, avoiding orphaned callback pointers.
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff [Brett Gervasoni <brettg senseofsecurity.com>, Jeff Trawick]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) core: Filter init functions are now run strictly once per request
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff before handler invocation. The init functions are no longer run
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff for connection filters. PR 49328. [Joe Orton]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) core: Adjust the output filter chain correctly in an internal
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff redirect from a subrequest, preserving filters from the main
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff request as necessary. PR 17629. [Joe Orton]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_cache: Explicitly allow cache implementations to cache a 206 Partial
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff Response if they so choose to do so. Previously an attempt to cache a 206
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff was arbitrarily allowed if the response contained an Expires or
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff Cache-Control header, and arbitrarily denied if both headers were missing.
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff [Graham Leggett]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) core: Add microsecond timestamp fractions, process id and thread id
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff to the error log. [Rainer Jung]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) configure: The "most" module set gets build by default. [Rainer Jung]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) configure: Building dynamic modules (DSO) by default. [Rainer Jung]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) configure: Fix broken VPATH build when using included APR.
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff [Rainer Jung]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_session_crypto: Fix configure problem when building
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff with APR 2 and for VPATH builds with included APR.
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff [Rainer Jung]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_session_crypto: API compatibility with APR 2 crypto and
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff APR Util 1.x crypto. [Rainer Jung]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) ab: Fix memory leak with -v2 and SSL. PR 49383.
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff [Pavel Kankovsky <peak argo troja mff cuni cz>]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) core: Add per-module and per-directory loglevel configuration.
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff Add some more trace logging.
b610c3e7694ee7d23d00c046d9cdc37989102492jvergara mod_rewrite: Replace RewriteLog/RewriteLogLevel with trace log levels.
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff mod_ssl: Replace LogLevelDebugDump with trace log levels.
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff mod_ssl/mod_proxy*: Adjust loglevels to be less verbose at levels info
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff mod_dumpio: Replace DumpIOLogLevel with trace log levels.
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff [Stefan Fritsch]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_ldap: LDAP caching was suppressed (and ldap-status handler returns
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff title page only) when any mod_ldap directives were used in VirtualHost
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff context. [Eric Covener]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_disk_cache: Decline the opportunity to cache if the response is
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff a 206 Partial Content. This stops a reverse proxied partial response
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff from becoming cached, and then being served in subsequent responses.
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff [Graham Leggett]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_deflate: avoid the risk of forwarding data before headers are set.
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff PR 49369 [Matthew Steele <mdsteele google.com>]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_authnz_ldap: Ensure nested groups are checked when the
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff top-level group doesn't have any direct non-group members
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff of attributes in AuthLDAPGroupAttribute. [Eric Covener]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_authnz_ldap: Search or Comparison during authorization phase
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff can use the credentials from the authentication phase
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff (AuthLDAPSearchAsUSer,AuthLDAPCompareAsUser).
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff PR 48340 [Domenico Rotiroti, Eric Covener]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_authnz_ldap: Allow the initial DN search during authentication
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff to use the HTTP username/pass instead of an anonymous or hard-coded
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff LDAP id (AuthLDAPInitialBindAsUser, AuthLDAPInitialBindPattern).
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff [Eric Covener]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_authnz_ldap: Publish requested LDAP data with an AUTHORIZE_ prefix
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff when this module is used for authorization. See AuthLDAPAuthorizePrefix.
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff PR 45584 [Eric Covener]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) apxs -q: Stop filtering out ':' characters from the reported values.
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff PR 45343. [Bill Cole]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) prefork MPM: Run cleanups for final request when process exits gracefully.
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff PR 43857. [Tom Donovan]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) ab: fix number of requests sent by ab when keepalive is enabled. PR 48497.
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff [Bryn Dole <dole blekko.com>]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) Log an error for failures to read a chunk-size, and return 408 instead of
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff 413 when this is due to a read timeout. This change also fixes some cases
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff of two error documents being sent in the response for the same scenario.
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff [Eric Covener] PR49167
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_proxy_balancer: Add new directive BalancerNonce to allow admin
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff to control/set the nonce used in the balancer-manager application.
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff [Jim Jagielski]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_proxy_connect: Support port ranges in AllowConnect. PR 23673.
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff [Stefan Fritsch]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) Proxy balancer: support setting error status according to HTTP response
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff code from a backend. PR 48939. [Daniel Ruggeri <DRuggeri primary.net>]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) htcacheclean: Introduce the ability to clean specific URLs from the
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff cache, if provided as an optional parameter on the command line.
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff [Graham Leggett]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) core: Introduce the IncludeStrict directive, which explicitly fails
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff server startup if no files or directories match a wildcard path.
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff [Graham Leggett]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) htcacheclean: Report additional statistics about entries deleted.
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff PR 48944. [Mark Drayton mark markdrayton.info]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) Introduce SSLFIPS directive to support OpenSSL FIPS_mode; permits all
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff builds of mod_ssl to use 'SSLFIPS off' for portability, but the proper
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff build of openssl is required for 'SSLFIPS on'. PR 46270.
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff [Dr Stephen Henson <steve openssl.org>, William Rowe]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_proxy_http: Log the port of the remote server in various messages.
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff PR 48812. [Igor Galić <i galic brainsware org>]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_reqtimeout: Do not wrongly enforce timeouts for mod_proxy's backend
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff connections and other protocol handlers (like mod_ftp). [Stefan Fritsch]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_proxy_ajp: Really regard the operation a success, when the client
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff aborted the connection. In addition adjust the log message if the client
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff aborted the connection. [Ruediger Pluem]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_ssl: Add the 'SSLInsecureRenegotiation' directive, which
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff allows insecure renegotiation with clients which do not yet
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff support the secure renegotiation protocol. [Joe Orton]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_ssl: Fix a potential I/O hang if a long list of trusted CAs
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff is configured for client cert auth. PR 46952. [Joe Orton]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) core: Only log a 408 if it is no keepalive timeout. PR 39785
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff [Ruediger Pluem, Mark Montague <markmont umich.edu>]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) support/rotatelogs: Add -L option to create a link to the current
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff log file. PR 48761 [<lyndon orthanc.ca>, Dan Poirier]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_ldap: Update LDAPTrustedClientCert to consistently be a per-directory
eb9158dea141f092a53bcc111a8e965b42fa9502jvergara setting only, matching most of the documentation and examples.
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff PR 46541 [Paul Reder, Eric Covener]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_ldap: LDAPTrustedClientCert now accepts CA_DER/CA_BASE64 argument
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff types previously allowed only in LDAPTrustedGlobalCert. [Eric Covener]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_negotiation: Preserve query string over multiviews negotiation.
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff This buglet was fixed for type maps in 2.2.6, but the same issue
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff affected multiviews and was overlooked.
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff PR 33112 [Joergen Thomsen <apache jth.net>]
ee236eb6e7c53dc81952f48002d16a485eda9061jvergara *) mod_ldap: Eliminate a potential crash with multiple LDAPTrustedClientCert
ee236eb6e7c53dc81952f48002d16a485eda9061jvergara when some are not password-protected. [Eric Covener]
ee236eb6e7c53dc81952f48002d16a485eda9061jvergara *) Fix startup segfault when the Mutex directive is used but no loaded
ee236eb6e7c53dc81952f48002d16a485eda9061jvergara modules use httpd mutexes. PR 48787. [Jeff Trawick]
ee236eb6e7c53dc81952f48002d16a485eda9061jvergara *) Proxy: get the headers right in a HEAD request with
ee236eb6e7c53dc81952f48002d16a485eda9061jvergara ProxyErrorOverride, by checking for an overridden error
ee236eb6e7c53dc81952f48002d16a485eda9061jvergara before not after going into a catch-all code path.
ee236eb6e7c53dc81952f48002d16a485eda9061jvergara PR 41646. [Nick Kew, Stuart Children]
ee236eb6e7c53dc81952f48002d16a485eda9061jvergara *) support/rotatelogs: Support the simplest log rotation case, log
ee236eb6e7c53dc81952f48002d16a485eda9061jvergara truncation. Useful when the log is being processed in real time
ee236eb6e7c53dc81952f48002d16a485eda9061jvergara using a command like tail. [Graham Leggett]
ee236eb6e7c53dc81952f48002d16a485eda9061jvergara *) support/htcacheclean: Teach it how to write a pid file (modelled on
ee236eb6e7c53dc81952f48002d16a485eda9061jvergara httpd's writing of a pid file) so that it becomes possible to run
ee236eb6e7c53dc81952f48002d16a485eda9061jvergara more than one instance of htcacheclean on the same machine.
ee236eb6e7c53dc81952f48002d16a485eda9061jvergara [Graham Leggett]
ee236eb6e7c53dc81952f48002d16a485eda9061jvergara *) Log command line on startup, so there's a record of command line
ee236eb6e7c53dc81952f48002d16a485eda9061jvergara arguments like -f. PR 48752. [Dan Poirier]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) Introduce mod_reflector, a handler capable of reflecting POSTed
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff request bodies back within the response through the output filter
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff stack. Can be used to turn an output filter into a web service.
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff [Graham Leggett]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_proxy_http: Make sure that when an ErrorDocument is served
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff from a reverse proxied URL, that the subrequest respects the status
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff of the original request. This brings the behaviour of proxy_handler
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff in line with default_handler. PR 47106. [Graham Leggett]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) Support wildcards in both the directory and file components of
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff the path specified by the Include directive. [Graham Leggett]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_proxy, mod_proxy_http: Support remote https proxies
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff by using HTTP CONNECT. PR 19188.
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff [Philippe Dutrueux <lilas evidian.com>, Rainer Jung]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) apxs: Fix -A and -a options to ignore whitespace in httpd.conf
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff [Philip M. Gollucci]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) worker: Don't report server has reached MaxClients until it has.
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff Add message when server gets within MinSpareThreads of MaxClients.
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff PR 46996. [Dan Poirier]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_session: Session expiry was being initialised, but not updated
ee236eb6e7c53dc81952f48002d16a485eda9061jvergara on each session save, resulting in timed out sessions when there
ee236eb6e7c53dc81952f48002d16a485eda9061jvergara should not have been. Fixed. [Graham Leggett]
ee236eb6e7c53dc81952f48002d16a485eda9061jvergara *) mod_log_config: Add the R option to log the handler used within the
ee236eb6e7c53dc81952f48002d16a485eda9061jvergara request. [Christian Folini <christian.folini netnea com>]
ee236eb6e7c53dc81952f48002d16a485eda9061jvergara *) mod_include: Allow fine control over the removal of Last-Modified and
ee236eb6e7c53dc81952f48002d16a485eda9061jvergara ETag headers within the INCLUDES filter, making it possible to cache
ee236eb6e7c53dc81952f48002d16a485eda9061jvergara responses if desired. Fix the default value of the SSIAccessEnable
ee236eb6e7c53dc81952f48002d16a485eda9061jvergara directive. [Graham Leggett]
ee236eb6e7c53dc81952f48002d16a485eda9061jvergara *) Add new UnDefine directive to undefine a variable. PR 35350.
ee236eb6e7c53dc81952f48002d16a485eda9061jvergara [Stefan Fritsch]
ee236eb6e7c53dc81952f48002d16a485eda9061jvergara *) Make ap_pregsub(), used by AliasMatch and friends, use the same syntax
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff for regex backreferences as mod_rewrite and mod_include: Remove the use
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff of '&' as an alias for '$0' and allow to escape any character with a
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff backslash. PR 48351. [Stefan Fritsch]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_authnz_ldap: If AuthLDAPCharsetConfig is set, also convert the
7185b49f58c4cdb16d035ecc45e38ec9b1cd9bd0matthew_swift password to UTF-8. PR 45318.
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff [Johannes Müller <joh_m gmx.de>, Stefan Fritsch]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) ab: Fix calculation of requests per second in HTML output. PR 48594.
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff [Stefan Fritsch]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_authnz_ldap: Failures to map a username to a DN, or to check a user
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff password now result in an informational level log entry instead of
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff warning level. [Eric Covener]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduffChanges with Apache 2.3.5
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) SECURITY: CVE-2010-0434 (cve.mitre.org)
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff Ensure each subrequest has a shallow copy of headers_in so that the
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff parent request headers are not corrupted. Eliminates a problematic
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff optimization in the case of no request body. PR 48359
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff [Jake Scott, William Rowe, Ruediger Pluem]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) Turn static function get_server_name_for_url() into public
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff ap_get_server_name_for_url() and use it where appropriate. This
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff fixes mod_rewrite generating invalid URLs for redirects to IPv6
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff literal addresses. [Stefan Fritsch]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_ldap: Introduce new config option LDAPTimeout to set the timeout
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff for LDAP operations like bind and search. [Stefan Fritsch]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_proxy, mod_proxy_ftp: Move ProxyFtpDirCharset from mod_proxy to
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff mod_proxy_ftp. [Takashi Sato]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_proxy, mod_proxy_connect: Move AllowCONNECT from mod_proxy to
7185b49f58c4cdb16d035ecc45e38ec9b1cd9bd0matthew_swift mod_proxy_connect. [Takashi Sato]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_cache: Do an exact match of the keys defined by
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff CacheIgnoreURLSessionIdentifiers against the querystring instead of
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff a partial match. PR 48401.
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff [Dodou Wang <wangdong.08 gmail.com>, Ruediger Pluem]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_proxy_balancer: Fix crash in balancer-manager. [Rainer Jung]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) Core HTTP: disable keepalive when the Client has sent
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff Expect: 100-continue
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff but we respond directly with a non-100 response.
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff Keepalive here led to data from clients continuing being treated as
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff a new request.
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff PR 47087 [Nick Kew]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) Core: reject NULLs in request line or request headers.
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff PR 43039 [Nick Kew]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) Core: (re)-introduce -T commandline option to suppress documentroot
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff check at startup.
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff PR 41887 [Jan van den Berg <janvdberg gmail.com>]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_autoindex: support XHTML as equivalent to HTML in IndexOptions,
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff ScanHTMLTitles, ReadmeName, HeaderName
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff PR 48416 [Dmitry Bakshaev <dab18 izhnet.ru>, Nick Kew]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) Proxy: Fix ProxyPassReverse with relative URL
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff Derived (slightly erroneously) from PR 38864 [Nick Kew]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_headers: align Header Edit with Header Set when used on Content-Type
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff PR 48422 [Cyril Bonté <cyril.bonte free.fr>, Nick Kew>]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_headers: Enable multi-match-and-replace edit option
7185b49f58c4cdb16d035ecc45e38ec9b1cd9bd0matthew_swift PR 46594 [Nick Kew]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_filter: enable it to act on non-200 responses.
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff PR 48377 [Nick Kew]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduffChanges with Apache 2.3.4
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) Replace AcceptMutex, LockFile, RewriteLock, SSLMutex, SSLStaplingMutex,
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff and WatchdogMutexPath with a single Mutex directive. Add APIs to
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff simplify setup and user customization of APR proc and global mutexes.
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff (See util_mutex.h.) Build-time setting DEFAULT_LOCKFILE is no longer
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff respected; set DEFAULT_REL_RUNTIMEDIR instead. [Jeff Trawick]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) http_core: KeepAlive no longer accepts other than On|Off.
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff [Takashi Sato]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_dav: Remove errno from dav_error interface. Calls to dav_new_error()
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff and dav_new_error_tag() must be adjusted to add an apr_status_t parameter.
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff [Jeff Trawick]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_authnz_ldap: Add AuthLDAPBindAuthoritative to allow Authentication to
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff try other providers in the case of an LDAP bind failure.
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff PR 46608 [Justin Erenkrantz, Joe Schaefer, Tony Stevenson]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) Build: fix --with-module to work as documented
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduffChanges with Apache 2.3.3
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) SECURITY: CVE-2009-3095 (cve.mitre.org)
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff mod_proxy_ftp: sanity check authn credentials.
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff [Stefan Fritsch <sf fritsch.de>, Joe Orton]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) SECURITY: CVE-2009-3094 (cve.mitre.org)
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff mod_proxy_ftp: NULL pointer dereference on error paths.
d87085487d9a620a84d11812bd9572b41d16be6cjvergara [Stefan Fritsch <sf fritsch.de>, Joe Orton]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_ssl: enable support for ECC keys and ECDH ciphers. Tested against
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff OpenSSL 1.0.0b3. [Vipul Gupta <vipul.gupta sun.com>, Sander Temme]
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff *) mod_dav: Include uri when logging a PUT error due to connection abort.
d25372dc8e65a9ed019a88fdf659ca61313f1b31jcduff PR 38149. [Stefan Fritsch]
instead of substrings. PR 28037. [Dan Franklin <dan dan-franklin.com>,
[Dr Stephen Henson <shenson oss-institute.org>]
PR 47178. [Philipp Hagemeister <oss phihag.de>]
Brian France <brian brianfrance.com>]
modules to avoid segmentation fault. PR 47951. [hirose31 gmail.com]
*) mod_logio/core: Report more accurate byte counts in mod_status if
for the default values of 1024 for LdapCacheEntries/LdapOpCacheEntries.
the request is a CONNECT request. [Bill Zajac <billz consultla.com>]
[Peter Grandi <pg_asf asf.for.sabi.co.uk>, Graham Leggett]
Log 408 errors in access log as was done in Apache 1.3.x.
PR 39785 [Nobutaka Mantani <nobutaka nobutaka.org>,
Stefan Fritsch <sf fritsch.de>, Dan Poirier]
Brian France <brian brianfrance.com>]
Brian France <brian brianfrance.com>]
[Stefan Fritsch <sf sfritsch.de>]
*) mod_session.c: Prevent a segfault when session is added but not
definition. [Stefan Fritsch sf sfritsch.de]
*) Add support for HTTP PUT to ab. [Jeff Barnes <jbarnesweb yahoo.com>]
PR 46971 [evanc nortel.com]
[Stefan Fritsch <sf sfritsch.de>]
for a file is missing. PR 47682 [Peter Poeml <poeml suse.de>]
*) SECURITY: CVE-2009-1890 (cve.mitre.org)
*) SECURITY: CVE-2009-1191 (cve.mitre.org)
by the client. PR 33098 [ Stefan Fritsch <sf sfritsch.de>]
PR 42175 [Jim Radford <radford blackbean.org>]
type. PR 45107. [Michael Ströder <michael stroeder.com>,
PR 44020 [Håkon Stordahl <hakon stordahl.org>]
CGI process. PR 47335 [Kornél Pál <kornelpal gmail.com>]
PR 46942 [Dan Poirier <poirier pobox.com>]
PR 44729 [Sönke Tesch <st kino-fahrplan.de>, Jim Jagielski]
PR 47177 [Carlos Garcia Braschi <cgbraschi gmail.com>]
PR 45082 [Vitaly Polonetsky <m_vitaly topixoft.com>]
[Marko Kevac <mkevac gmail.com>]
as A/UX, Next, and Tandem. [Jeff Trawick]
directory listing. PR 46789 [Dan Poirier <poirier pobox.com>]
of module state across unload/load. [Jeff Trawick]
[Dan Poirier <poirier pobox.com>]
[Geoff Keating <geoffk apple.com>]
with kqueue (BSD/OS X) and excessive CPU with event ports (Solaris).
a media type has not been configured via mime.types, AddType,
[Ryan Phillips <ryan-apache trolocsis.com>]
[<tlhackque yahoo.com>]
*) prefork: Fix child process hang during graceful restart/stop in
*) core/utils: Enhance ap_escape_html API to support escaping non-ASCII chars
PR 45529 [Bob Ionescu <bobsiegen googlemail.com>]
times out before returning status line/headers.
PR 39332 [Masaoki Kobayashi <masaoki techfirm.co.jp>]
[Theo Schlossnagle <jesus omniti.com>, Paul Querna]
modules/proxy/balancers [Jim Jagielski]
privileges and Unix user/group IDs [Nick Kew]
logic replicate 2.2.x authz logic, and replace <Satisfy*>, Reject,
*) unixd: turn existing code into a module, and turn the set user/group
Suggested By André Warnier <aw ice-sa.com> [Eric Covener]
*) mod_ssl: Send Content-Type application/ocsp-request for POST requests to
OSCP responders. PR 46014 [Dr Stephen Henson <steve openssl.org>]
*) New module mod_sed: filter Request/Response bodies through sed
null value. [David Shane Holden <dpejesh apache.org>]
both inside and outside the location/directory sections, as
form request with the type of application/x-www-form-urlencoded.
*) mod_authz_dbd: When redirecting after successful login/logout per
PR 44560 [Anders Kaseorg <anders kaseorg.com>]
mod_cache et.al. to trap the results of the redirect.
*) ApacheMonitor.exe: Introduce --kill argument for use by the
*) mod_ldap, mod_authnz_ldap: Add support for nested groups (i.e. the ability
[David M. Lee <dmlee crossroads.com>]
[Niklas Edmundsson <nikke acc.umu.se>]
[Niklas Edmundsson <nikke acc.umu.se>]
[Markus Schiegl <ms schiegl.com>]
*) Remove incorrect comments from scoreboard.h regarding conditional
[Chris Darroch <chrisd pearsoncmg.com>]
in ap_init_scoreboard(). [Chris Darroch <chrisd pearsoncmg.com>]
[Chris Darroch <chrisd pearsoncmg.com>]
and 'Reject' to mod_authz_core. The new directives introduce 'AND/OR'
*) mod_authz_dbd: SQL authz with Login/Session support [Nick Kew]
Apache 2.2.xx tree as documented, and except as noted, below.]
Changes with Apache 2.2.x and later:
Changes with Apache 2.0.x and later:
Changes with Apache 1.3.x and later: