X-Git-Url: https://granicus.if.org/sourcecode?a=blobdiff_plain;f=CHANGES;h=9011e7e5668ea7dc47e607b3cb25cae677ef7e0c;hb=7d5bef8273f482dee4d3b82c101f07db78c2f7bb;hp=5dbf7957285ffc551d85cf9c9c93dba4fc502ca5;hpb=e95d52f53f3c713bba204280d811df5cf5a7eceb;p=apache diff --git a/CHANGES b/CHANGES index 5dbf795728..9011e7e566 100644 --- a/CHANGES +++ b/CHANGES @@ -2,9 +2,137 @@ Changes with Apache 2.3.0 [ When backported to 2.2.x, remove entry from this file ] - *) http_protocol: Escape request method in 413 error reporting. - Determined to be not generally exploitable, but a flaw in any case. - PR 44014 [Victor Stinner ] + *) mod_session_cookie: Add a session implementation capable of storing + session information within cookies on the browser. Useful for high + volume sites where server bound sessions are too resource intensive. + [Graham Leggett] + + *) mod_session: Add a generic session interface to unify the different + attempts at saving persistent sessions across requests. + [Graham Leggett] + + *) core, authn/z: Avoid calling access control hooks for internal requests + with configurations which match those of initial request. Revert to + original behaviour (call access control hooks for internal requests + with URIs different from initial request) if any access control hooks or + providers are not registered as permitting this optimization. + Introduce wrappers for access control hook and provider registration + which can accept additional mode and flag data. [Chris Darroch] + + *) http_filters: Don't spin if get an error when reading the + next chunk. PR 44381 [Ruediger Pluem] + + *) mod_dav: Return "method not allowed" if the destination URI of a WebDAV + copy / move operation is no DAV resource. PR 44734 [Ruediger Pluem] + + *) Introduced ap_expr API for expression evaluation. + This is adapted from mod_include, which is the first module + to use the new API. + [Nick Kew] + + *) mod_authz_dbd: When redirecting after successful login/logout per + AuthzDBDRedirectQuery, do not report authorization failure, and use + first row returned by database query instead of last row. + [Chris Darroch] + + *) mod_rewrite: Initialize hash needed by ap_register_rewrite_mapfunc early + enough. PR 44641 [Daniel Lescohier ] + + *) mod_authn_dbd: Disambiguate and tidy database authentication + error messages. PR 43210. [Chris Darroch, Phil Endecott + ] + + *) mod_cache: Handle If-Range correctly if the cached resource was stale. + PR 44579 [Ruediger Pluem] + + *) mod_speling: remove regression from 1.3/2.0 behavior and + drop dependency between mod_speling and AcceptPathInfo. + PR 43562 [Jose Kahan ] + + *) mod_ldap: Correctly return all requested attribute values + when some attributes have a null value. + PR 44560 [Anders Kaseorg ] + + *) core: check symlink ownership if both FollowSymlinks and + SymlinksIfOwnerMatch are set [Nick Kew] + + *) core: fix origin checking in SymlinksIfOwnerMatch + PR 36783 [Robert L Mathews ] + + *) rotatelogs: Added '-f' option to force rotatelogs to create the + logfile as soon as started, and not wait until it reads the + first entry. [Jim Jagielski] + + *) mod_proxy: Do not try a direct connection if the connection via a + remote proxy failed before and the request has a request body. + [Ruediger Pluem] + + *) mod_substitute: The default is now flattening the buckets after + each substitution. This was mostly done to abide by the + Principle Of Least Astonishment. The newly added 'q' flag allows for + the quicker, more efficient bucket-splitting if the user so + desires. [Jim Jagielski] + + *) Added 'disablereuse' option for ProxyPass which, essentially, + disables connection pooling for the backend servers. + [Jim Jagielski] + + *) Activate mod_cache, mod_file_cache and mod_disc_cache as part of the + 'most' set for '--enable-modules' and '--enable-shared-mods'. Include + mod_mem_cache in 'all' as well. [Dirk-Willem van Gulik] + + *) Also install mod_so.h, mod_rewrite.h and mod_cache.h; as these + contain public function declarations which are useful for + third party module authors. PR 42431 [Dirk-Willem van Gulik]. + + *) mod_dir, mod_negotiation: pass the output filter information + to newly created sub requests; as these are later on used + as true requests with an internal redirect. This allows for + mod_cache et.al. to trap the results of the redirect. + [Dirk-Willem van Gulik, Ruediger Pluem] + + *) ab: Use a 64 bit unsigned int instead of a signed long to count the + bytes transferred to avoid integer overflows. PR 44346 [Ruediger Pluem] + + *) mod_proxy_ajp: Do not retry request in the case that we either failed to + sent a part of the request body or if the request is not idempotent. + PR 44334 [Ruediger Pluem] + + *) ProxyPassReverse is now balancer aware. [Jim Jagielski] + + *) rotatelogs: Don't leak memory when reopening the logfile. + PR 40183 [Ruediger Pluem, Takashi Sato ] + + *) mod_ldap: Add support (taking advantage of the new APR capability) + for ldap rebind callback while chasing referrals. This allows direct + searches on LDAP servers (in particular MS Active Directory 2003+) + using referrals without the use of the global catalog. + PRs 26538, 40268, and 42557 [Paul J. Reder] + + *) ab: Do not try to read non existing response bodies of HEAD requests. + PR 34275 [Takashi Sato ] + + *) Support chroot on Unix-family platforms + PR 43596 [Dimitar Pashev ] + + *) mod_proxy_http: Return HTTP status codes instead of apr_status_t + values for errors encountered while forwarding the request body + PR 44165 [Eric Covener] + + *) mod_ssl: Added server name indication support (SNI, RFC 4366). + PR 34607. [Kaspar Brand ]. A test configuration + can be created with test/make_sni.sh [Dirk-Willem van Gulik]. + + *) ApacheMonitor.exe: Introduce --kill argument for use by the + installer. This will permit the installation tool to remove + all running instances before attempting to remove the .exe. + [William Rowe] + + *) mod_proxy: Lower memory consumption for short lived connections. + PR 44026. [Ruediger Pluem] + + *) mod_proxy: Keep connections to the backend persistent in the HTTPS case. + [Ruediger Pluem] *) rotatelogs: Improve atomicity when using -l and cleaup code. PR 44004 [Rainer Jung] @@ -12,15 +140,9 @@ Changes with Apache 2.3.0 *) mod_ssl: Add support for OCSP validation of client certificates. PR 41123. [Marc Stern , Joe Orton] - *) mod_filter: Don't segfault on (unsupported) chained FilterProvider usage. - PR 43956 [Nick Kew, Ruediger Pluem] - *) mod_unique_id: Fix timestamp value in UNIQUE_ID. PR 37064 [Kobayashi ] - *) core: Handle unrecognised transfer-encodings. - PR 43882 [Nick Kew] - *) mod_serf: New module for Reverse Proxying. [Paul Querna] *) core: Add the option to keep aside a request body up to a certain @@ -34,12 +156,6 @@ Changes with Apache 2.3.0 *) scoreboard: Correctly declare ap_time_process_request. PR 43789 [Tom Donovan ] - *) mod_status: Add SeeRequestTail directive, which determines if - ExtendedStatus displays the 1st 63 characters of the request - or the last 63. Useful for those requests with large string - lengths and which only vary with the last several characters. - [Jim Jagielski] - *) core; scoreboard: ap_get_scoreboard_worker(sbh) now takes the sbh member from the connection rec, ap_get_scoreboard_worker(proc, thread) will now provide the unusual legacy lookup. [William Rowe] @@ -47,15 +163,6 @@ Changes with Apache 2.3.0 *) mpm winnt: fix null pointer dereference PR 42572 [Davi Arnaut] - *) mod_proxy_http: Correctly forward unexpected interim (HTTP 1xx) - responses from the backend according to RFC2616. But make it - configurable in case something breaks on it. - PR 16518 [Nick Kew] - - *) mod_deflate: Don't leave a strong ETag in place while transforming - the entity. - PR 39727 [Nick Kew] - *) core: reinstate location walk to fix config for subrequests PR 41960 [Jose Kahan ] @@ -63,14 +170,6 @@ Changes with Apache 2.3.0 or remote port can be logged. PR 43415. [Adam Hasselbalch Hansen , Ruediger Pluem, Jeff Trawick] - *) mod_rewrite: Add the novary flag to RewriteCond. - [Ruediger Pluem] - - *) mod_include: Add an "if" directive syntax to test whether an URL - is accessible, and if so, conditionally display content. This - allows a webmaster to hide a link to a private page when the user - has no access to that page. [Graham Leggett] - *) mod_authnz_ldap, mod_authn_dbd: Tidy up the code to expose authn parameters to the environment. Improve portability to EBCDIC machines by using apr_toupper(). [Martin Kraemer] @@ -82,13 +181,6 @@ Changes with Apache 2.3.0 *) mod_ssl: Add support for caching SSL Sessions in memcached. [Paul Querna] - *) mod_substitute: Added a new experimental output filter, which - performs inline response content pattern matching (including - regex) and substitution. [Jim Jagielski] - - *) core: Change etag generation to produce identical results on - 32-bit and 64-bit platforms. PR 40064. [Joe Orton] - *) ab: Add -r option to continue after socket receive errors. [Filip Hanik ] @@ -96,15 +188,6 @@ Changes with Apache 2.3.0 for SDKs that define LDAP_NO_LIMIT to something other than -1. [David Jones ] - *) mod_dbd: Introduce configuration groups to allow inheritance by virtual - hosts of database configurations from the main server. Determine the - minimal set of distinct configurations and share connection pools - whenever possible. Allow virtual hosts to override inherited SQL - statements. PR 41302. [Chris Darroch] - - *) core: Fix broken chunk filtering that causes all non blocking reads to be - converted into blocking reads. PR 41056. [Jean-Frederic Clere, Jim Jagielski] - *) apxs: Enhance -q flag to print all known variables and their values when invoked without variable name(s). [William Rowe, Sander Temme]