Changes with Apache 2.3.0
[ When backported to 2.2.x, remove entry from this file ]
- *) SECURITY: CVE-2007-6420 (cve.mitre.org)
- mod_proxy_balancer: Prevent CSRF attacks against the balancer-manager
- interface. [Joe Orton]
+ *) Allow for smax to be 0 for balancer members so that all idle
+ connections are able to be dropped should they exceed ttl.
+ PR 43371 [Phil Endecott <spam_from_apache_bugzilla chezphil.org>,
+ Jim Jagielski]
- *) mod_proxy_http: Do not forward requests with 'Expect: 100-continue' to
- known HTTP/1.0 servers. Return 'Expectation failed' (417) instead.
- [Ruediger Pluem]
+ *) mod_proxy_ajp: Fix wrongly formatted requests where client
+ sets Content-Length header, but doesn't provide a body.
+ Servlet container always expects that next packet is
+ body whenever C-L is present in the headers. This can lead
+ to wrong interpretation of the packets. In this case
+ send the empty body packet, so container can deal with
+ that. [Mladen Turk]
+
+ *) mod_authnz_ldap: don't return NULL-valued environment variables to
+ other modules. PR 39045 [Francois Pesce <francois.pesce gmail.com>]
+
+ *) Don't adjust case in pathname components that are not of interest
+ to mod_mime. Fixes mod_negotiation's use of such components.
+ PR 43250 [Basant Kumar Kukreja <basant.kukreja sun.com>]
+
+ *) Add new LogFormat parameter, %k, which logs the number of
+ keepalive requests on this connection for this request..
+ [Dan Poirier <poirier pobox.com>]
+
+ *) Be tolerant in what you accept - accept slightly broken
+ status lines from a backend provide they include a valid status code.
+ PR 44995 [Rainer Jung <rainer.jung kippdata.de>]
+
+ *) New module mod_sed: filter Request/Response bodies through sed
+ [Basant Kumar Kukreja <basant.kukreja sun.com>]
+
+ *) mod_auth_form: Make sure that basic authentication is correctly
+ faked directly after login. [Graham Leggett]
+
+ *) mod_session_cookie, mod_session_dbd: Make sure cookies are set both
+ within the output headers and error output headers, so that the
+ session is maintained across redirects. [Graham Leggett]
+
+ *) mod_auth_form: Make sure the logged in user is populated correctly
+ after a form login. Fixes a missing REMOTE_USER variable directly
+ following a login. [Graham Leggett]
+
+ *) mod_session_cookie: Make sure that cookie attributes are correctly
+ included in the blank cookie when cookies are removed. This fixes an
+ inability to log out when using mod_auth_form. [Graham Leggett]
+
+ *) mod_autoindex: add configuration option to insert string
+ in HTML HEAD. [Nick Kew]
+
+ *) mod_ssl: implement dynamic mutex callbacks for the benefit of
+ OpenSSL. [Sander Temme]
+
+ *) mod_session: Prevent a segfault when a CGI script sets a cookie with a
+ null value. [David Shane Holden <dpejesh apache.org>]
+
+ *) mod_headers: Prevent Header edit from processing only the first header
+ of possibly multiple headers with the same name and deleting the
+ remaining ones. PR 45333. [Ruediger Pluem]
+
+ *) mod_rewrite: Preserve the query string with [proxy,noescape]. PR 45247
+ [Tom Donovan]
*) core, authn/z: Determine registered authn/z providers directly in
ap_setup_auth_internal(), which allows optional functions that just
using referrals without the use of the global catalog.
PRs 26538, 40268, and 42557 [Paul J. Reder]
- *) Support chroot on Unix-family platforms
- PR 43596 [Dimitar Pashev <mitko banksoft-bg.com>]
-
*) mod_ssl: Added server name indication support (SNI, RFC 4366).
PR 34607. [Kaspar Brand <asfbugz velox.ch>]. A test configuration
can be created with test/make_sni.sh [Dirk-Willem van Gulik].
*) mod_ssl: Add support for OCSP validation of client certificates.
PR 41123. [Marc Stern <marc.stern approach.be>, Joe Orton]
- *) mod_unique_id: Fix timestamp value in UNIQUE_ID.
- PR 37064 [Kobayashi <kobayashi firstserver.co.jp>]
-
*) mod_serf: New module for Reverse Proxying. [Paul Querna]
*) core: Add the option to keep aside a request body up to a certain
to circumvent the symbolic link checks imposed by FollowSymLinks and
SymLinksIfOwnerMatch. [Nick Kew, Ruediger Pluem, William Rowe]
- *) mod_proxy: Support environment variable interpolation in reverse
- proxying directives. [Nick Kew]
-
- *) core: Add the filename of the configuration file to the warning message
- about the useless use of AllowOverride. PR 39992.
- [Darryl Miles <darryl darrylmiles.org>]
-
*) New SSLLogLevelDebugDump [ None (default) | IO (not bytes) | Bytes ]
configures the I/O Dump of SSL traffic, when LogLevel is set to Debug.
The default is none as this is far greater debugging resolution than