Graham Leggett [Sun, 22 Oct 2006 13:31:25 +0000 (13:31 +0000)]
mod_dbd: Key the storage of prepared statements on the hex string
value of server_rec, rather than the server name, as the server name
may change (eg when the server name is set) at any time, causing
weird behaviour in modules dependent on mod_dbd.
Mladen Turk [Sat, 14 Oct 2006 13:34:58 +0000 (13:34 +0000)]
Fix compile warning. The /wd:XXXX is invalid. It should
be /wdXXXX, and since its for VS2005 only use the standard
preprocessor directives instead of that.
This should be backported to 2.2 as well.
Graham Leggett [Thu, 12 Oct 2006 20:52:37 +0000 (20:52 +0000)]
mod_authnz_ldap: Add an AuthLDAPRemoteUserAttribute directive. If
set, REMOTE_USER will be set to this attribute, rather than the
username supplied by the user. Useful for example when you want users
to log in using an email address, but need to supply a userid instead
to the backend.
Jim Jagielski [Thu, 12 Oct 2006 15:53:33 +0000 (15:53 +0000)]
So I'm sitting in Rich's talk and think to myself, it's kind
of stupid that DumpIO always logs at Debug, esp when
you consider that it's likely you'll be doing so
in conjunction with SSL... One Big Log is understating
it! :)
Add DumpIOLogLevel to allow one to change the level...
Graham Leggett [Tue, 10 Oct 2006 22:10:01 +0000 (22:10 +0000)]
mod_disk_cache: NULL fd pointers when closing them, fix missing
close/flush, remove some unneccessary code duplication instead
of calling the right helper in replace_brigade_with_cache().
Graham Leggett [Tue, 10 Oct 2006 21:31:36 +0000 (21:31 +0000)]
sendfile_nonblocking() takes the _brigade_ as an argument, gets
the first bucket from the brigade, finds it not to be a FILE
bucket and barfs. The fix is to pass a bucket rather than a brigade.
Joe Orton [Tue, 3 Oct 2006 11:40:30 +0000 (11:40 +0000)]
When starting a new piped error logger for the main server, ensure
that the new child's stderr is not a pipe to an old piped logger:
* server/log.c (log_child): Add "dummy_stderr" parameter; if set,
duplicate stdout as the stderr for the child.
(open_error_log): Add "is_main" parameter; use dummy stderr for logger
for main server only.
(ap_open_logs, ap_open_piped_log): Adjust for new open_error_log()/
log_child() parameters.
Mladen Turk [Mon, 2 Oct 2006 07:06:24 +0000 (07:06 +0000)]
Cleanup alternate is_connected method.
It works for sure on win32,linux and solaris.
I do not have access to other platforms so can not
verify it works on them.
Mladen Turk [Sat, 30 Sep 2006 11:04:46 +0000 (11:04 +0000)]
Add alternative is_socket_connected implementation.
It works on win32 and linux for sure, so that's why
I put it inside the #ifdef.
Of course something like that needs APR abstraction.
Mladen Turk [Sat, 30 Sep 2006 10:18:48 +0000 (10:18 +0000)]
Add force recovery for balancer.
In case all balancer members were in error state 503
was returned until the recovery timeout expired.
The patch forces recovery in case all balancer members
are in error state regardless of recovery timeout
directive.
This fixes the time gap when 503 was returned and
backend was already up and running.
* Move the tasks of eor_bucket_destroy (status update, transaction logging) to
a cleanup function that is registered with the request pool.
eor_bucket_destroy only destroys the request pool if there is still a request
at this point of time which triggers the call of the cleanup function.
This is needed as the eor bucket could be (and usually is) allocated from
a pool different from the request pool (the connection pool in this case).
This can lead to situations where eor_bucket_destroy is called at a point of
time when the request pool had been already destroyed. But the status update
and the transaction logging rely on the request pool.
In practise this happens with the worker MPM if the client refuses to read
the response from the handler. Then the unsent data (including the
eor bucket) remains in a brigade allocated from the connection pool which
is the parent of the request pool. This brigade is cleaned up during the
cleanup of the ptrans pool in worker_thread. As the request pool gets
destroyed during this cleanup operation *before* the brigade gets cleaned up
eor_bucket_destroy starts the status update and the transaction logging with
a destroyed request pool which leads to a segfault.
Graham Leggett [Tue, 26 Sep 2006 16:26:56 +0000 (16:26 +0000)]
mod_disk_cache: Make caching of large files possible on 32bit machines
by determining whether the cached file should be copied on disk rather
than loaded into RAM. PR39380
Graham Leggett [Tue, 26 Sep 2006 15:37:02 +0000 (15:37 +0000)]
mod_mem_cache: Convert mod_mem_cache to use APR memory pool functions
by creating a root pool for object persistence across requests. This
also eliminates the need for custom serialization code.
Graham Leggett [Tue, 26 Sep 2006 14:36:43 +0000 (14:36 +0000)]
mod_cache: From RFC3986 (section 6.2.3.) if a URI contains an
authority component and an empty path, the empty path is to be equivalent
to "/". It explicitly cites the following four URIs as equivalents:
http://example.com
http://example.com/
http://example.com:/
http://example.com:80/
Graham Leggett [Tue, 26 Sep 2006 14:12:36 +0000 (14:12 +0000)]
Don't cache requests with a expires date in the past; otherwise mod_cache will
always try to cache the URL. This bug might lead to numerous rename() errors
on win32 if the URL was previously cached.
Graham Leggett [Tue, 26 Sep 2006 13:29:09 +0000 (13:29 +0000)]
mod_disk_cache: Make sure that only positive integers are accepted
for the CacheMaxFileSize and CacheMinFileSize parameters in the
config file. PR39380 [Niklas Edmundsson <nikke acc.umu.se>]
Nick Kew [Thu, 21 Sep 2006 22:13:34 +0000 (22:13 +0000)]
Generic fix for PR#31759
If a handler returns a value that is neither reserved nor a valid
HTTP response code, log an error and substitute HTTP_INTERNAL_SERVER_ERROR.
Allow a handler to override this explicitly by setting a note.
* Set the new environment variable BALANCER_ROUTE_CHANGED if a worker with a
route different from the one supplied by the client had been chosen or if
the client supplied no routing information for a balancer with sticky
sessions.
* PROXY_WORKER_IS_INITIALIZED checks if PROXY_WORKER_INITIALIZED is set in
worker->s->status, but we need to check here if it is set in worker->status.
As PROXY_WORKER_INITIALIZED is set in worker->s->status in
ap_proxy_initialize_worker_share, which is called just before
ap_proxy_initialize_worker we never initialize the worker. This is very bad
as we create no reslist for the pool in this case.
Jeff Trawick [Tue, 5 Sep 2006 13:08:15 +0000 (13:08 +0000)]
Replace ap_get_server_version with ap_get_server_banner() and
ap_get_server_description().
High-level summary:
The full server version information is now included in the error log at
startup as well as server status reports, irrespective of the setting
of the ServerTokens directive.
Third-party modules must now use ap_get_server_banner() or
ap_get_server_description() in place of ap_get_server_version().
Joshua Slive [Tue, 22 Aug 2006 17:07:54 +0000 (17:07 +0000)]
Allow the typical non-DAV methods to be unrestricted
in our DAV examples (in particular, POST). Also
change <Location> to <Directory> in the docs. This
particular example was not a security problem because
<Location> was being used to *extend* access, rather than
to *restrict* access, but it is better to encourage
people to use <Directory> by default.
Joshua Slive [Sun, 20 Aug 2006 19:46:24 +0000 (19:46 +0000)]
My last effort was a little too succinct and not quite precise
enough. Try being more explicit.
This does leave the danger that people will clip the <Location>
example as the proper way to do things, when they should be
reading on to the <Directory> example. The <Location> example
is only correct when used in conjunction with Alias.
Joshua Slive [Sun, 20 Aug 2006 18:48:24 +0000 (18:48 +0000)]
Add a note about case-sensitivity to the windows platform docs.
Partially in response to the disputed vulnerability:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4110
Joshua Slive [Sun, 20 Aug 2006 18:08:43 +0000 (18:08 +0000)]
Make it clear that url-path is always case-sensitive.
Provide an example of using a regex to make it case-insensitive.
Make it clear that ScriptAlias is only used when you want
BOTH mapping and script-designation.
Partially in response to the disputed vulnerability:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4110
Nick Kew [Fri, 18 Aug 2006 12:16:13 +0000 (12:16 +0000)]
Don't use NULL s->server_hostname as hash lookup key.
Reported by paritosh (at limewire.co.in) on dev@httpd (thread
Re: apache 2.2 crashes at the start time in mod_dbd.c then preparing AuthDBDUserPWQuery)
Fixed by paritosh and Yours Truly.