Changes with Apache 2.3.3
+ *) SECURITY: CVE-2009-3095 (cve.mitre.org)
+ mod_proxy_ftp: sanity check authn credentials.
+ [Stefan Fritsch <sf fritsch.de>, Joe Orton]
+
+ *) SECURITY: CVE-2009-3094 (cve.mitre.org)
+ mod_proxy_ftp: NULL pointer dereference on error paths.
+ [Stefan Fritsch <sf fritsch.de>, Joe Orton]
+
+ *) Allow ProxyPreserveHost to work in <Proxy> sections. PR 34901.
+ [Stefan Fritsch]
+
+ *) configure: Fix THREADED_MPMS so that mod_cgid is enabled again
+ for worker MPM. [Takashi Sato]
+
+ *) mod_dav: Provide a mechanism to obtain the request_rec and pathname
+ from the dav_resource. [Jari Urpalainen <jari.urpalainen nokia.com>,
+ Brian France <brian brianfrance.com>]
+
+ *) Build: Use install instead of cp if available on installing
+ modules to avoid segmentation fault. PR 47951. [hirose31 gmail.com]
+
+ *) mod_cache: correctly consider s-maxage in cacheability
+ decisions. [Dan Poirier]
+
+ *) mod_logio/core: Report more accurate byte counts in mod_status if
+ mod_logio is loaded. PR 25656. [Stefan Fritsch]
+
+ *) mod_ldap: If LDAPSharedCacheSize is too small, try harder to purge
+ some cache entries and log a warning. Also increase the default
+ LDAPSharedCacheSize to 500000. This is a more realistic size suitable
+ for the default values of 1024 for LdapCacheEntries/LdapOpCacheEntries.
+ PR 46749. [Stefan Fritsch]
+
+ *) mod_rewrite: Make sure that a hostname:port isn't fully qualified if
+ the request is a CONNECT request. [Bill Zajac <billz consultla.com>]
+
+ *) mod_cache: Teach CacheEnable and CacheDisable to work from within a
+ Location section, in line with how ProxyPass works. [Graham Leggett]
+
+ *) mod_reqtimeout: New module to set timeouts and minimum data rates for
+ receiving requests from the client. [Stefan Fritsch]
+
+ *) core: Fix potential memory leaks by making sure to not destroy
+ bucket brigades that have been created by earlier filters.
+ [Stefan Fritsch]
+
+ *) core, mod_deflate, mod_sed: Reduce memory usage by reusing bucket
+ brigades in several places. [Stefan Fritsch]
+
+ *) mod_cache: Fix uri_meets_conditions() so that CacheEnable will
+ match by scheme, or by a wildcarded hostname. PR 40169
+ [Peter Grandi <pg_asf asf.for.sabi.co.uk>, Graham Leggett]
+
+ *) suxec: Allow to log an error if exec fails by setting FD_CLOEXEC
+ on the log file instead of closing it. PR 10744. [Nicolas Rachinsky]
+
+ *) mod_mime: Make RemoveType override the info from TypesConfig.
+ PR 38330. [Stefan Fritsch]
+
+ *) mod_cache: Introduce the option to run the cache from within the
+ normal request handler, and to allow fine grained control over
+ where in the filter chain content is cached. [Graham Leggett]
+
+ *) core: Treat timeout reading request as 408 error, not 400.
+ Log 408 errors in access log as was done in Apache 1.3.x.
+ PR 39785 [Nobutaka Mantani <nobutaka nobutaka.org>,
+ Stefan Fritsch <sf fritsch.de>, Dan Poirier]
+
+ *) mod_ssl: Reintroduce SSL_CLIENT_S_DN, SSL_CLIENT_I_DN, SSL_SERVER_S_DN,
+ SSL_SERVER_I_DN back to the environment variables to be set by mod_ssl.
+ [Peter Sylvester <peter.sylvester edelweb.fr>]
+
+ *) mod_disk_cache: don't cache incomplete responses, per RFC 2616, 13.8.
+ PR15866. [Dan Poirier]
+
+ *) ab: ab segfaults in verbose mode on https sites
+ PR46393. [Ryan Niebur]
+
+ *) mod_dav: Allow other modules to become providers and add resource types
+ to the DAV response. [Jari Urpalainen <jari.urpalainen nokia.com>,
+ Brian France <brian brianfrance.com>]
+
+ *) mod_dav: Allow other modules to add things to the DAV or Allow headers
+ of an OPTIONS request. [Jari Urpalainen <jari.urpalainen nokia.com>,
+ Brian France <brian brianfrance.com>]
+
+ *) core: Lower memory usage of core output filter.
+ [Stefan Fritsch <sf sfritsch.de>]
+
+ *) mod_mime: Detect invalid use of MultiviewsMatch inside Location and
+ LocationMatch sections. PR47754. [Dan Poirier]
+
+ *) mod_request: Make sure the KeptBodySize directive rejects values
+ that aren't valid numbers. [Graham Leggett]
+
+ *) mod_session_crypto: Sanity check should the potentially encrypted
+ session cookie be too short. [Graham Leggett]
+
+ *) mod_session.c: Prevent a segfault when session is added but not
+ configured. [Graham Leggett]
+
+ *) htcacheclean: 19 ways to fail, 1 error message. Fixed. [Graham Leggett]
+
*) mod_auth_digest: Fail server start when nonce count checking
is configured without shared memory, or md5-sess algorithm is
configured. [Dan Poirier]
*) mod_alias: ensure Redirect issues a valid URL.
PR 44020 [Håkon Stordahl <hakon stordahl.org>]
- *) mod_dir: add DefaultHandler directive, to enable admin to specify
+ *) mod_dir: add FallbackResource directive, to enable admin to specify
an action to happen when a URL maps to no file, without resorting
to ErrorDocument or mod_rewrite. PR 47184 [Nick Kew]
projects / apache / blobdiff