changes.txt

Apache_2.0.59-Openssl_0.9 配置tomcat. Apache_2.0.59-Openssl_0.9 配置tomcat.

     request containing the "If-Modified-Since" and "If-None-Match"
     headers, to which the backend server respond with status 304.)
     [Graham Wiseman <gwiseman fscinternet.com>, Richard Reiner]

  *) mod_dav: Reject requests which include an unescaped fragment in the
     Request-URI.  PR 21779.  [Amit Athavale <amit_athavale lycos.com>]

  *) Build array of allowed methods with proper dimensions, fixing
     possible memory corruption.  [Jeff Trawick]

  *) mod_ssl: Fix potential segfault on lookup of SSL_SESSION_ID.
     PR 15057.  [Otmar Lendl <lendl nic.at>]

  *) mod_ssl: Fix streaming output from an nph- CGI script. PR 21944
     [Joe Orton]

  *) mod_usertrack no longer inspects the Cookie2 header for
     the cookie name. PR 11475.  [Chris Darrochi <chrisd pearsoncmg.com>]

  *) mod_usertrack no longer overwrites other cookies.
     PR 26002.  [Scott Moore <apache nopdesign.com>]

  *) worker MPM: fix stack overlay bug that could cause the parent
     process to crash.  [Jeff Trawick]

  *) Win32: Add Win32DisableAcceptEx directive. This Windows
     NT/2000/CP directive is useful to work around bugs in some 
     third party layered service providers like virus scanners, 
     VPN and firewall products, that do not properly handle 
     WinSock 2 APIs.  Use this directive if your server is issuing
     AcceptEx failed messages.
     [Allan Edwards, Bill Rowe, Bill Stoddard, Jeff Trawick]

  *) Make REMOTE_PORT variable available in mod_rewrite.
     PR 25772.  [André Malo]

  *) Fix a long delay with CGI requests and keepalive connections on
     AIX.  [Jeff Trawick]

  *) mod_autoindex: Add 'XHTML' option in order to allow switching between
     HTML 3.2 and XHTML 1.0 output. PR 23747.  [André Malo]

  *) Add XHTML Document Type Definitions to httpd.h (minor MMN bump).
     [André Malo]

  *) mod_ssl: Advertise SSL library version as determined at run-time rather
     than at compile-time.  PR 23956.  [Eric Seidel <seidel apple.com>]

  *) mod_ssl: Fix segfault on a non-SSL request if the 'c' log
     format code is used.  PR 22741.  [Gary E. Miller <gem rellim.com>]

  *) Fix build with parallel make.  PR 24643.  [Joe Orton]

  *) mod_rewrite: In external rewrite maps lookup keys containing
     a newline now cause a lookup failure. PR 14453.
     [Cedric Gavage <cedric.gavage unixtech.be>, André Malo]

  *) Backport major overhaul of mod_include's filter parser from 2.1.
     The new parser code is expected to be more robust and should
     catch all of the edge cases that were not handled by the previous one.
     The 2.1 external API changes were hidden by a wrapper which is
     expected to keep the API backwards compatible.  [André Malo]

  *) Add a hook (insert_error_filter) to allow filters to re-insert
     themselves during processing of error responses. Enable mod_expires
     to use the new hook to include Expires headers in valid error
     responses. This addresses an RFC violation. It fixes PRs 19794,
     24884, and 25123. [Paul J. Reder]

  *) Add Polish translation of error messages.  PR 25101.
     [Tomasz Kepczynski <tomek jot23.org>]

  *) Add AP_MPMQ_MPM_STATE function code for ap_mpm_query. (Not yet
     supported for BeOS or OS/2 MPMs.)  [Jeff Trawick, Brad Nicholes,
     Bill Stoddard]

  *) Add mod_status hook to allow modules to add to the mod_status
     report.  [Joe Orton]

  *) Fix htdbm to generate comment fields in DBM files correctly.
     [Justin Erenkrantz]

  *) mod_dav: Use bucket brigades when reading PUT data. This avoids
     problems if the data stream is modified by an input filter. PR 22104.
     [Tim Robbins <tim robbins.dropbear.id.au>, André Malo]

  *) Fix RewriteBase directive to not add double slashes.  [André Malo]

  *) Improve 'configure --help' output for some modules.  [Astrid Keßler]

  *) Correct UseCanonicalName Off to properly check incoming port number.
     [Jim Jagielski]

  *) Fix slow graceful restarts with prefork MPM.  [Joe Orton]

  *) Fix a problem with namespace mappings being dropped in mod_dav_fs;
     if any property values were set which defined namespaces these
     came out mangled in the PROPFIND response.  PR 11637.
     [Amit Athavale <amit_athavale persistent.co.in>]

  *) mod_dav: Return a WWW-auth header for MOVE/COPY requests where
     the destination resource gives a 401.  PR 15571.  [Joe Orton]

  *) SECURITY: CVE-2003-0020 (cve.mitre.org)
     Escape arbitrary data before writing into the errorlog. Unescaped
     errorlogs are still possible using the compile time switch
     "-DAP_UNSAFE_ERROR_LOG_UNESCAPED".  [Geoffrey Young, André Malo]

  *) mod_autoindex / core: Don't fail to show filenames containing
     special characters like '%'. PR 13598.  [André Malo]
 
  *) mod_status: Report total CPU time accurately when using a threaded
     MPM.  PR 23795.  [Jeff Trawick]

  *) Fix memory leak in handling of request bodies during reverse
     proxy operations.  PR 24991. [Larry Toppi <larry.toppi citrix.com>]

  *) Win32 MPM: Implement MaxMemFree to enable setting an upper
     limit on the amount of storage used by the bucket brigades
     in each server thread. [Bill Stoddard]

  *) Modified the cache code to be header-location agnostic. Also
     fixed a number of other cache code bugs related to PR 15852.
     Includes a patch submitted by Sushma Rai <rsushma novell.com>.
     This fixes mod_mem_cache but not mod_disk_cache yet so I'm not
     closing the PR since that is what they are using. [Paul J. Reder]

  *) complain via error_log when mod_include's INCLUDES filter is
     enabled, but the relevant Options flag allowing the filter to run
     for the specific resource wasn't set, so that the filter won't
     silently get skipped. next remove itself, so the warning will be
     logged only once [Stas Bekman, Jeff Trawick, Bill Rowe]

  *) mod_info: HTML escape configuration information so it displays 
     correctly. PR 24232. [Thom May]
     
  *) Restore the ability to add a description for directories that
     don't contain an index file.  (Broken in 2.0.48) [André Malo]

  *) Fix a problem with the display of empty variables ("SetEnv foo") in
     mod_include.  PR 24734  [Markus Julen <mj zermatt.net>]

  *) mod_log_config: Log the minutes component of the timezone correctly.
     PR 23642.  [Hong-Gunn Chew <hgbug gunnet.org>]

  *) mod_proxy: Fix cases where an invalid status-line could be sent 
     to the client.  PR 23998.  [Joe Orton]

  *) mod_ssl: Fix segfaults at startup if other modules which use OpenSSL
     are also loaded.  [Joe Orton]

  *) mod_ssl: Use human-readable OpenSSL error strings in logs; use
     thread-safe interface for retrieving error strings.  [Joe Orton]

  *) mod_expires: Initialize ExpiresDefault to NULL instead of "" to
     avoid reporting an Internal Server error if it is used without
     having been set in the httpd.conf file. PR: 23748, 24459
     [André Malo, Liam Quinn  <liam htmlhelp.com>]

  *) mod_autoindex: Don't omit the <tr> start tag if the SuppressIcon
     option is set. PR 21668.  [Jesse Tie-Ten-Quee <highos highos.com>]

  *) mod_include no longer allows an ETag header on 304 responses.
     PR 19355. [Geoffrey Young <geoff apache.org>, André Malo]

  *) EBCDIC: Convert header fields to ASCII before sending (broken
     since 2.0.44). [Martin Kraemer]

  *) Fix the inability to log errors like exec failure in
     mod_ext_filter/mod_cgi script children.  This was broken after 
     such children stopped inheriting the error log handle.  
     [Jeff Trawick]

  *) Fix mod_info to use the real config file name, not the default
     config file name.  [Aryeh Katz <aryeh secured-services.com>]

  *) Set the scoreboard state to indicate logging prior to running 
     logging hooks so that server-status will show 'L' for hung loggers
     instead of 'W'.  [Jeff Trawick]

Changes with Apache 2.0.48

  *) SECURITY: CVE-2003-0789 (cve.mitre.org)
     mod_cgid: Resolve some mishandling of the AF_UNIX socket used to
     communicate with the cgid daemon and the CGI script.
     [Jeff Trawick]

  *) SECURITY: CVE-2003-0542 (cve.mitre.org)
     Fix buffer overflows in mod_alias and mod_rewrite which occurred
     if one configured a regular expression with more than 9 captures.
     [André Malo]

  *) mod_include: fix segfault which occured if the filename was not
     set, for example, when processing some error conditions.
     PR 23836.  [Brian Akins <bakins web.turner.com>, André Malo]

  *) fix the config parser to support <Foo>..</Foo> containers (no
     arguments in the opening tag) supported by httpd 1.3. Without
     this change mod_perl 2.0's <Perl> sections are broken.
     ["Philippe M. Chiasson" <gozer cpan.org>]

  *) mod_cgid: fix a hash table corruption problem which could
     result in the wrong script being cleaned up at the end of a
     request.  [Jeff Trawick]

  *) Update httpd-*.conf to be clearer in describing the connection
     between AddType and AddEncoding for defining the meaning of
     compressed file extensions. [Roy Fielding]

  *) mod_rewrite: Don't die silently when failing to open RewriteLogs.
     PR 23416.  [André Malo]

  *) mod_rewrite: Fix mod_rewrite's support of the [P] option to send
     rewritten request using "proxy:". The code was adding multiple "proxy:"
     fields in the rewritten URI. PR: 13946.
     [Eider Oliveira <eider bol.com.br>]

  *) cache_util: Fix ap_check_cache_freshness to check max_age, smax_age, and
     expires as directed in RFC 2616. [Thomas Castelle <tcastelle generali.fr>]

  *) Ensure that ssl-std.conf is generated at configure time, and switch
     to using the expanded config variables to work the same as
     httpd-std.conf PR: 19611
     [Thom May]

  *) mod_ssl: Fix segfaults after renegotiation failure. PR 21370
     [Hartmut Keil <Hartmut.Keil adnovum.ch>]

  *) mod_autoindex: If a directory contains a file listed in the
     DirectoryIndex directive, the folder icon is no longer replaced
     by the icon of that file. PR 9587.
     [David Shane Holden <dpejesh yahoo.com>]

  *) Fixed mod_usertrack to not get false positive matches on the
     user-tracking cookie's name.  PR 16661.
     [Manni Wood <manniwood planet-save.com>]

  *) mod_cache: Fix the cache code so that responses can be cached
     if they have an Expires header but no Etag or Last-Modified
     headers. PR 23130.
     [<bjorn exoweb.net>]

  *) mod_log_config: Fix %b log format to write really "-" when 0 bytes
     were sent (e.g. with 304 or 204 response codes).  [Astrid Keßler]

  *) Modify ap_get_client_block() to note if it has seen EOS.
     [Justin Erenkrantz]

  *) Fix a bug, where mod_deflate sometimes unconditionally compressed the
     content if the Accept-Encoding header contained only other tokens than
     "gzip" (such as "deflate"). PR 21523.  [Joe Orton, André Malo]

  *) Avoid an infinite recursion, which occured if the name of an included
     config file or directory contained a wildcard character. PR 22194.
     [André Malo]

  *) mod_ssl: Fix a problem setting variables that represent the
     client certificate chain.  PR 21371  [Jeff Trawick]

  *) Unix: Handle permissions settings for flock-based mutexes in 
     unixd_set_global|proc_mutex_perms().  Allow the functions to be
     called for any type of mutex.  PR 20312  [Jeff Trawick]

  *) ab: Work over non-loopback on Unix again. PR 21495. [Jeff Trawick]

  *) Fix a misleading message from the some of the threaded MPMs when 
     MaxClients has to be lowered due to the setting of ServerLimit.  
     [Jeff Trawick]

  *) Lower the severity of the "listener thread didn't exit" message
     to debug, as it is of interest only to developers.  PR 9011
     [Jeff Trawick]

  *) MPMs: The bucket brigades subsystem now honors the MaxMemFree setting.
     [Cliff Woolley, Jean-Jacques Clar]

  *) Install config.nice into the build/ directory to make
     minor version upgrades easier. [Joshua Slive]

  *) Fix mod_deflate so that it does not call deflate() without checking
     first whether it has something to deflate. (Currently this causes
     deflate to generate a fatal error according to the zlib spec.)
     PR 22259. [Stas Bekman]

  *) mod_ssl: Fix FakeBasicAuth for subrequest.  Log an error when an
     identity spoof is encountered.
     [Sander Striker]

  *) mod_rewrite: Ignore RewriteRules in .htaccess files if the directory
     containing the .htaccess file is requested without a trailing slash.
     PR 20195.  [André Malo]

  *) ab: Overlong credentials given via command line no longer clobber
     the buffer.  [André Malo]

  *) mod_deflate: Don't attempt to hold all of the response until we're
     done.  [Justin Erenkrantz]

  *) Assure that we block properly when reading input bodies with SSL.
     PR 19242.  [David Deaves <David.Deaves dd.id.au>, William Rowe]

  *) Update mime.types to include latest IANA and W3C types.  [Roy Fielding]