NetBSD Packages Collection (pkgsrc) changes:
* Modify French page in same way as the English page. Translation
provided by Remi Zara <remi_zara@mac.com> in private e-mail.
* Use EAPI patches from mod_ssl-2.8.4-1.3.20.
* Unify repeated SED replacement info for config.layout, apache.sh,
DEINSTALL, and INSTALL into one location, FILES_SUBST.
* Modify patch to apxs to use 0:0 instead of root:wheel, as some
non-NetBSD systems don't have a wheel group.
The general bug fixes:
* Eliminate a potential segfault if an invalid floating point value
is passed to the ap_snprintf() function, on platforms supporting
isnan() and isinf().
* Fix a possible segfault at startup in the detection of a default
ServerName or IP string when no ServerName was specified.
* Fixed mod_proxy to retain empty headers, as allowed by RFC2068.
* Properly resolve the location of ndbm on Linux and some glibc2
builds, where ndbm.h is in the nonstandard db1/ subdir.
The main new features include:
* Enhanced rotatelogs to allow a UTC offset to be specified, and
the format logfile names with human-readable date/time stamps.
* Added the NOESCAPE (NS) flag to RewriteRule, to disable *all*
normal URI escaping. Note incautious use can give unexpected
results or introduce security risks.
* Added the '\' character to RewriteRule to allow escaping of
special characters. Allows embedding of both the '$' and '%'
characters in the results, so 'foo\$1' translates to 'foo$1'
rather than 'foo\<value of $1>'.
* Added the -V flag to suexec, to display the compile-time settings
with which it was built. (Only valid for root or the HTTPD_USER
username.)
* Introduced EBCDIC conversion configuration options, controlling the
conversion based on MIME type or file suffix.
the updated EAPI patches from mod_ssl-2.8.3-1.3.19 which includes the
following fix:
*) Fixed EAPI context usage in http_request.c: a context pointer
potentially can be NULL requests and can cause a segfault if
dereferenced.
config.layout file instead of specifying every directory as on option to
the Apache configure script. This layout file might be useful later when
we package Apache 2.x. I also reordered a few lines so that it's easier
to diff apache/Makefile and apache6/Makefile (hi itojun!). Also build
the mod_define shared module from the mod_ssl sources.
Relevant changes from version 1.3.17.1 include:
*) Rewrite ap_unparse_uri_components() to make it safer and more readable
*) Under certain circumstances, Apache did not supply the
right response headers when requiring authentication.
*) Clean up some end-of-loop not reached warnings
*) Add the correct language tag for interoperation with the Taiwanese
versions of MSIE and Netscape.
*) Workaround enabled for a core dump which appeared in broken
NameVirtualHost configurations.
*) Sporadic core dump in ap_default_port_for_scheme() with
internal requests
*) SECURITY: The default installation could lead to mod_negotiation
and mod_dir/mod_autoindex displaying a directory listing instead of
the index.html.* files, if a very long path was created artificially
by using many slashes. Now a 403 FORBIDDEN is returned.
*) Trailing slashes (if they exist) are now removed from ServerRoot,
because there were known problems with them.
*) TPF startup/shutdown fixes.
*) Correct a typo in httpd.conf.
*) Get the correct IP address if ServerName isn't set and we can't
find a fully-qualified domain name at startup.
*) Fix pointer arithmetic in mod_rewrite map expansion.
*) Fixed a problem with file extensions being truncated during
the call to ap_os_canonical_filename().
possible to use LoadModule at all (httpd crashes soon after it forks).
This is most probably an Apache problem. Until the real problem
is tracked down, put this in as workaround.
This addresses lib/12164 and bin/12283.
(hope it is the right way).
>There's another bug in RewriteMap handling in Apache 1.3.17, which
>causes ${} expansions to be completely ignored. This patch fixes it.
-) Remove patch to avoid dlclose()ing on NetBSD. The mod_perl vs. perl CGI
mis-interaction seems to be gone and I wasn't able to reproduce it on my
system.
*) Fix the declaration of the module structure in mod_example.
*) Fix the handling of variable expansion look-ahead in mod_rewrite,
i.e. syntax like %{LA-U:REMOTE_USER}, and also fix the parsing of
more complicated nested RewriteMap lookups.
*) mod_status now respects ?refresh=n of 1 or greater. If the given
refresh value is not a number, ?refresh is set to 1 second.
*) Accomodate an out-of-space condition in the piped logs and the
rotatelogs.c code, and no longer churn log processes for this condition.
*) Make cgi-bin work as a regular directory when using mod_vhost_alias
with no VirtualScriptAlias directives.
*) Move the check of the Expect request header field after the hook
for ap_post_read_request, since that is the only opportunity for
modules to handle Expect extensions.
*) Eliminate caching problems of mod_autoindex results, so the last
modified date of the directory is returned as the Last-Modified
and ETag HTTP header tags are sent if IndexOptions TrackModified
directive/option is used.
*) Correct an issue with Alias and ScriptAlias directives that
file path arguments were not normalized in canonical form.
This correction makes no attempt to normalize regular expression
forms of Alias or ScriptAlias.
*) Add a new LogFormat directive, %c, that will log connection
status at the end of the response.
*) Update the mime.types file to the registered media types as of 2000-10-19.
*) Restore functionality broken by the mod_rewrite security fix:
rewrite map lookup keys and default values are now expanded
so that the lookup can depend on the requested URI etc.
1.3.14.1, adding a superminor version number to indicate possible EAPI
update.
*) Fixed the parsing of SSLSessionCache directives. The prefixes were
incorrectly skipped and leaded to "unable to open semaphore file"
errors.
The security fixes are:
* A problem with the Rewrite module, mod_rewrite, allowed access to
any file on the web server under certain circumstances
* The handling of Host: headers in mass virtual hosting
configurations, mod_vhost_alias, could allow access to any file on
the server
* If a cgi-bin directory is under the document root, the source to
the scripts inside it could be sent if using mass virtual hosting
The main new features include:
* Support for a directory-based configuration system. If any of the
configuration directives point to directories instead of files,
all files in that directory (and in subdirectories) will be also
parsed as configuration files
* Support name-based virtual hosting without needing to specify an
IP address in the Apache configuration file. This enables sites
that use dynamic IP addresses to support name-based virtual
hosting as well as allowing identical machines to share a
configuration file, say in a load-balanced cluster
* The SetEnvIf and BrowserMatch range of directives are now able to
be used in .htaccess files.
* Administrators who are nervous about their full server version
details being public can use the new keyword 'ProductOnly' in the
ServerTokens directive. This keyword forces the server to only
return the string "Apache" as the server version.
* The new digest authentication module, mod_auth_digest has had a
number of fixes and upgrades applied
EAPI didn't change so no need to change Apache's version number.
Also standardize package builds to have Apache listen on ports 80/443
regardless of UID of user that builds the package, and make MAINTAINER
point to me.
package admin where the cruft is that may need to be manually removed.
* Factor out the making of extra directories and the copying of config files
into a separate INSTALL script.
* Rearrange the Makefile a bit to handle changes in the PLIST.
* Remove erroneous information from pkg/DESCR.
