Version 7.20.0 (9 February 2010)
Daniel Stenberg (9 Feb 2010)
- When downloading compressed content over HTTP and the app asked libcurl to
automatically uncompress it with the CURLOPT_ENCODING option, libcurl could
wrongly provide the callback with more data than the maximum documented
amount. An application could thus get tricked into badness if the maximum
limit was trusted to be enforced by libcurl itself (as it is documented).
This is further detailed and explained in the libcurl security advisory
20100209 at
http://curl.haxx.se/docs/adv_20100209.html
Daniel Fandrich (3 Feb 2010)
- Changed the Watcom makefiles to make them easier to keep in sync with
Makefile.inc since that can't be included directly.
Yang Tse (2 Feb 2010)
- Symbol CURL_FORMAT_OFF_T now obsoleted, will be removed in a future release,
symbol will not be available when building with CURL_NO_OLDIES defined. Use
of CURL_FORMAT_CURL_OFF_T is preferred since 7.19.0
Daniel Stenberg (1 Feb 2010)
- Using the multi_socket API, it turns out at times it seemed to "forget"
connections (which caused a hang). It turned out to be an existing (7.19.7)
bug in libcurl (that's been around for a long time) and it happened like
this:
The app calls curl_multi_add_handle() to add a new easy handle, libcurl will
then set it to timeout in 1 millisecond so libcurl will tell the app about
it.
The app's timeout fires off that there's a timeout, the app calls libcurl as
we so often document it:
do {
res = curl_multi_socket_action(... TIMEOUT ...);
} while(CURLM_CALL_MULTI_PERFORM == res);
And this is the problem number one:
When curl_multi_socket_action() is called with no specific handle, but only
a timeout-action, it will *only* perform actions within libcurl that are
marked to run at this time. In this case, the request would go from INIT to
CONNECT and return CURLM_CALL_MULTI_PERFORM. When the app then calls libcurl
again, there's no timer set for this handle so it remains in the CONNECT
state. The CONNECT state is a transitional state in libcurl so it reports no
sockets there, and thus libcurl never tells the app anything more about that
easy handle/connection.
libcurl _does_ set a 1ms timeout for the handle at the end of
multi_runsingle() if it returns CURLM_CALL_MULTI_PERFORM, but since the loop
is instant the new job is not ready to run at that point (and there's no
code that makes libcurl call the app to update the timout for this new
timeout). It will simply rely on that some other timeout will trigger later
on or that something else will update the timeout callback. This makes the
bug fairly hard to repeat.
The fix made to adress this issue:
We introduce a loop in lib/multi.c around all calls to multi_runsingle() and
simply check for CURLM_CALL_MULTI_PERFORM internally. This has the added
benefit that this goes in line with my long-term wishes to get rid of the
CURLM_CALL_MULTI_PERFORM all together from the public API.
The downside of this fix, is that the counter we return in 'running_handles'
in several of our public functions then gets a slightly new and possibly
confusing behavior during times:
If an app adds a handle that fails to connect (very quickly) it may just
as well never appear as a 'running_handle' with this fix. Previously it
would first bump the counter only to get it decreased again at next call.
Even I have used that change in handle counter to signal "end of a
transfer". The only *good* way to find the end of a individual transfer
is calling curl_multi_info_read() to see if it returns one.
Of course, if the app previously did the looping before it checked the
counter, it really shouldn't be any new effect.
Yang Tse (26 Jan 2010)
- Constantine Sapuntzakis' and Joshua Kwan's work done in the last four months
relative to the asynchronous DNS lookups, along with with some integration
adjustments I have done are finally committed to CVS.
Currently these enhancements will benefit builds done using c-ares on any
platform as well as Windows builds using the default threaded resolver.
This release does not make generally available POSIX threaded DNS lookups
yet. There is no configure option to enable this feature yet. It is possible
to experimantally try this feature running configure with compiler flags that
make simultaneous definition of preprocessor symbols USE_THREADS_POSIX and
HAVE_PTHREAD_H, as well as whatever reentrancy compiler flags and linker ones
are required to link and properly use pthread_* functions on each platform.
Daniel Stenberg (26 Jan 2010)
- Mike Crowe made libcurl return CURLE_COULDNT_RESOLVE_PROXY when it is the
proxy that cannot be resolved when using c-ares. This matches the behaviour
when not using c-ares.
Bj
- Added a new flag: -J/--remote-header-name. This option tells the
-O/--remote-name option to use the server-specified Content-Disposition
filename instead of extracting a filename from the URL.
Daniel Stenberg (21 Jan 2010)
- Chris Conroy brought support for RTSP transfers, and with it comes 8(!) new
libcurl options for controlling what to get and how to receive posssibly
interleaved RTP data.
Daniel Stenberg (20 Jan 2010)
- As was pointed out on the http-state mailing list, the order of cookies in a
HTTP Cookie: header _needs_ to be sorted on the path length in the cases
where two cookies using the same name are set more than once using
(overlapping) paths. Realizing this, identically named cookies must be
sorted correctly. But detecting only identically named cookies and take care
of them individually is harder than just to blindly and unconditionally sort
all cookies based on their path lengths. All major browsers also already do
this, so this makes our behavior one step closer to them in the cookie area.
Test case 8 was the only one that broke due to this change and I updated it
accordingly.
Daniel Stenberg (19 Jan 2010)
- David McCreedy brought a fix and a new test case (129) to make libcurl work
again when downloading files over FTP using ASCII and it turns out that the
final size of the file is not the same as the initial size the server
reported. This is very common since servers don't take the newline
conversions into account.
Kamil Dudka (14 Jan 2010)
- Suppressed side effect of OpenSSL configure checks, which prevented NSS from
being properly detected under certain circumstances. It had been caused by
strange behavior of pkg-config when handling PKG_CONFIG_LIBDIR. pkg-config
distinguishes among empty and non-existent environment variable in that case.
Daniel Stenberg (12 Jan 2010)
- Gil Weber reported a peculiar flaw with the multi interface when doing SFTP
transfers: curl_multi_fdset() would return -1 and not set and file
descriptors several times during a transfer of a single file. It turned out
to be due to two different flaws now fixed. Gil's excellent recipe helped me
nail this.
Daniel Stenberg (11 Jan 2010)
- Made sure that the progress callback is repeatedly called at a regular
interval even during very slow connects.
- The tests/runtests.pl script now checks to see if the test case that runs is
present in the tests/data/Makefile.am and outputs a notice message on the
screen if not. Each test file has to be included in that Makefile.am to get
included in release archives and forgetting to add files there is a common
mistake. This is an attempt to make it harder to forget.
Daniel Stenberg (9 Jan 2010)
- Johan van Selst found and fixed a OpenSSL session ref count leak:
ossl_connect_step3() increments an SSL session handle reference counter on
each call. When sessions are re-used this reference counter may be
incremented many times, but it will be decremented only once when done (by
Curl_ossl_session_free()); and the internal OpenSSL data will not be freed
if this reference count remains positive. When a session is re-used the
reference counter should be corrected by explicitly calling
SSL_SESSION_free() after each consecutive SSL_get1_session() to avoid
introducing a memory leak.
(http://curl.haxx.se/bug/view.cgi?id=2926284)
Daniel Stenberg (7 Jan 2010)
- Make sure the progress callback is called repeatedly even during very slow
name resolves when c-ares is used for resolving.
Claes Jakobsson (6 Jan 2010)
- Julien Chaffraix fixed so that the fragment part in an URL is not sent
to the server anymore.
Kamil Dudka (3 Jan 2010)
- Julien Chaffraix eliminated a duplicated initialization in singlesocket().
Daniel Stenberg (2 Jan 2010)
- Make curl support --ssl and --ssl-reqd instead of the previous FTP-specific
versions --ftp-ssl and --ftp-ssl-reqd as these options are now used to
control SSL/TLS for IMAP, POP3 and SMTP as well in addition to FTP. The old
option names are still working but the new ones are the ones listed and
documented.
Daniel Stenberg (1 Jan 2010)
- Ingmar Runge enhanced libcurl's FTP engine to support the PRET command. This
command is a special "hack" used by the drftpd server, but even though it is
a custom extension I've deemed it fine to add to libcurl since this server
seems to survive and people keep using it and want libcurl to support
it. The new libcurl option is named CURLOPT_FTP_USE_PRET, and it is also
usable from the curl tool with --ftp-pret. Using this option on a server
that doesn't support this command will make libcurl fail.
I added test cases 1107 and 1108 to verify the functionality.
The PRET command is documented at
http://www.drftpd.org/index.php/Distributed_PASV
Yang Tse (30 Dec 2009)
- Steven M. Schweda improved VMS build system, and Craig A. Berry helped
with the patch and testing.
Daniel Stenberg (26 Dec 2009)
- Renato Botelho and Peter Pentchev brought a patch that makes the libcurl
headers work correctly even on FreeBSD systems before v8.
(http://curl.haxx.se/bug/view.cgi?id=2916915)
Daniel Stenberg (17 Dec 2009)
- David Byron fixed Curl_ossl_cleanup to actually call ENGINE_cleanup when
available.
- Follow-up fix for the proxy fix I did for Jon Nelson's bug. It turned out I
was a bit too quick and broke test case 1101 with that change. The order of
some of the setups is sensitive. I now changed it slightly again to make
sure we do them in this order:
1 - parse URL and figure out what protocol is used in the URL
2 - prepend protocol:// to URL if missing
3 - parse name+password off URL, which needs to know what protocol is used
(since only some allows for name+password in the URL)
4 - figure out if a proxy should be used set by an option
5 - if no proxy option, check proxy environment variables
6 - run the protocol-specific setup function, which needs to have the proxy
already set
Daniel Stenberg (15 Dec 2009)
- Jon Nelson found a regression that turned out to be a flaw in how libcurl
detects and uses proxies based on the environment variables. If the proxy
was given as an explicit option it worked, but due to the setup order
mistake proxies would not be used fine for a few protocols when picked up
from '[protocol]_proxy'. Obviously this broke after 7.19.4. I now also added
test case 1106 that verifies this functionality.
(http://curl.haxx.se/bug/view.cgi?id=2913886)
Daniel Stenberg (12 Dec 2009)
- IMAP, POP3 and SMTP support and their TLS versions (including IMAPS, POP3S
and SMTPS) are now supported. The current state may not yet be solid, but
the foundation is in place and the test suite has some initial support for
these protocols. Work will now persue to make them nice libcurl citizens
until release.
The work with supporting these new protocols was sponsored by
networking4all.com - thanks!
Daniel Stenberg (10 Dec 2009)
- Siegfried Gyuricsko found out that the curl manual said --retry would retry
on FTP errors in the transient 5xx range. Transient FTP errors are in the
4xx range. The code itself only tried on 5xx errors that occured _at login_.
Now the retry code retries on all FTP transfer failures that ended with a
4xx response.
(http://curl.haxx.se/bug/view.cgi?id=2911279)
- Constantine Sapuntzakis figured out a case which would lead to libcurl
accessing alredy freed memory and thus crash when using HTTPS (with
OpenSSL), multi interface and the CURLOPT_DEBUGFUNCTION and a certain order
of cleaning things up. I fixed it.
(http://curl.haxx.se/bug/view.cgi?id=2905220)
Daniel Stenberg (7 Dec 2009)
- Martin Storsjo made libcurl use the Expect: 100-continue header for posts
with unknown size. Previously it was only used for posts with a known size
larger than 1024 bytes.
Daniel Stenberg (1 Dec 2009)
- If the Expect: 100-continue header has been set by the application through
curl_easy_setopt with CURLOPT_HTTPHEADER, the library should set
data->state.expect100header accordingly - the current code (in 7.19.7 at
least) doesn't handle this properly. Martin Storsjo provided the fix!
Yang Tse (28 Nov 2009)
- Added Diffie-Hellman parameters to several test harness certificate files in
PEM format. Required by several stunnel versions used by our test harness.
Daniel Stenberg (28 Nov 2009)
- Markus Koetter provided a polished and updated version of Chad Monroe's TFTP
rework patch that now integrates TFTP properly into libcurl so that it can
be used non-blocking with the multi interface and more. BLKSIZE also works.
The --tftp-blksize option was added to allow setting the TFTP BLKSIZE from
the command line.
Daniel Stenberg (26 Nov 2009)
- Extended and fixed the change I did on Dec 11 for the the progress
meter/callback during FTP command/response sequences. It turned out it was
really lame before and now the progress meter SHOULD get called at least
once per second.
Daniel Stenberg (23 Nov 2009)
- Bjorn Augustsson reported a bug which made curl not report any problems even
though it failed to write a very small download to disk (done in a single
fwrite call). It turned out to be because fwrite() returned success, but
there was insufficient error-checking for the fclose() call which tricked
curl to believe things were fine.
Yang Tse (23 Nov 2009)
- David Byron modified Makefile.dist vc8 and vc9 targets in order to allow
finer granularity control when generating src and lib makefiles.
Yang Tse (22 Nov 2009)
- I modified configure to force removal of the curlbuild.h file included in
distribution tarballs for use by non-configure systems. As intended, this
would get overwriten when doing in-tree builds. But VPATH builds would end
having two curlbuild.h files, one in the source tree and another in the
build tree. With the modification I introduced 5 Nov 2009 this could become
an issue when running libcurl's test suite.
Daniel Stenberg (20 Nov 2009)
- Constantine Sapuntzakis identified a write after close, as the sockets were
closed by libcurl before the SSL lib were shutdown and they may write to its
socket. Detected to at least happen with OpenSSL builds.
- Jad Chamcham pointed out a bug with connection re-use. If a connection had
CURLOPT_HTTPPROXYTUNNEL enabled over a proxy, a subsequent request using the
same proxy with the tunnel option disabled would still wrongly re-use that
previous connection and the outcome would only be badness.
Yang Tse (18 Nov 2009)
- I modified the memory tracking system to make it intolerant with zero sized
malloc(), calloc() and realloc() function calls.
Daniel Stenberg (17 Nov 2009)
- Constantine Sapuntzakis provided another fix for the DNS cache that could
end up with entries that wouldn't time-out:
1. Set up a first web server that redirects (307) to a http://server:port
that's down
2. Have curl connect to the first web server using curl multi
After the curl_easy_cleanup call, there will be curl dns entries hanging
around with in_use != 0.
(http://curl.haxx.se/bug/view.cgi?id=2891591)
- Marc Kleine-Budde fixed: curl saved the LDFLAGS set during configure into
its pkg-config file. So -Wl stuff ended up in the .pc file, which is really
bad, and breaks if there are multiple -Wl in our LDFLAGS (which are in
PTXdist). bug #2893592 (http://curl.haxx.se/bug/view.cgi?id=2893592)
Kamil Dudka (15 Nov 2009)
- David Byron improved the configure script to use pkg-config to find OpenSSL
(and in particular the list of required libraries) even if a path is given
as argument to --with-ssl
Yang Tse (15 Nov 2009)
- I removed enable-thread / disable-thread configure option. These were only
placebo options. The library is always built as thread safe as possible on
every system.
Claes Jakobsson (14 Nov 2009)
- curl-config now accepts '--configure' to see what arguments was
passed to the configure script when building curl.
Daniel Stenberg (14 Nov 2009)
- Claes Jakobsson restored the configure functionality to detect NSS when
--with-nss is set but not "yes".
I think we can still improve that to check for pkg-config in that path etc,
but at least this patch brings back the same functionality we had before.
- Camille Moncelier added support for the file type SSL_FILETYPE_ENGINE for
the client certificate. It also disable the key name test as some engines
can select a private key/cert automatically (When there is only one key
and/or certificate on the hardware device used by the engine)
Yang Tse (14 Nov 2009)
- Constantine Sapuntzakis provided the fix that ensures that an SSL connection
won't be reused unless protection level for peer and host verification match.
I refactored how preprocessor symbol _THREAD_SAFE definition is done.
Kamil Dudka (12 Nov 2009)
- Kevin Baughman provided a fix preventing libcurl-NSS from crash on doubly
closed NSPR descriptor. The issue was hard to find, reported several times
before and always closed unresolved. More info at the RH bug:
https://bugzilla.redhat.com/534176
- libcurl-NSS now tries to reconnect with TLS disabled in case it detects
a broken TLS server. However it does not happen if SSL version is selected
manually. The approach was originally taken from PSM. Kaspar Brand helped me
to complete the patch. Original bug reports:
https://bugzilla.redhat.com/525496https://bugzilla.redhat.com/527771
Yang Tse (12 Nov 2009)
- I modified configure script to make the getaddrinfo function check also
verify if the function is thread safe.
Yang Tse (11 Nov 2009)
- Marco Maggi reported that compilation failed when configured --with-gssapi
and GNU GSS installed due to a missing mutual exclusion of header files in
the Kerberos 5 code path. He also verified that my patch worked for him.
Daniel Stenberg (11 Nov 2009)
- Constantine Sapuntzakis posted bug #2891595
(http://curl.haxx.se/bug/view.cgi?id=2891595) which identified how an entry
in the DNS cache would linger too long if the request that added it was in
use that long. He also provided the patch that now makes libcurl capable of
still doing a request while the DNS hash entry may get timed out.
- Christian Schmitz noticed that the progress meter/callback was not properly
used during the FTP connection phase (after the actual TCP connect), while
it of course should be. I also made the speed check get called correctly so
that really slow servers will trigger that properly too.
Kamil Dudka (5 Nov 2009)
- Dropped misleading timeouts in libcurl-NSS and made sure the SSL socket works
in non-blocking mode.
Yang Tse (5 Nov 2009)
- I removed leading 'curl' path on the 'curlbuild.h' include statement in
curl.h, adjusting auto-makefiles include path, to enhance portability to
OS's without an orthogonal directory tree structure such as OS/400.
Daniel Stenberg (4 Nov 2009)
- I fixed several problems with the transfer progress meter. It showed the
wrong percentage for small files, most notable for <1000 bytes and could
easily end up showing more than 100% at the end. It also didn't show any
percentage, transfer size or estimated transfer times when transferring
less than 100 bytes.
This covers the transition to ASF that mod_fcgi was donated to in the course
of 2009. No longer backwards compatible as far as configuration is concerned!
Changes with mod_fcgid 2.3.5
*) Stop using the unsuppressable "notice" log level for debug and
informational messages. PR 48536. [Jeff Trawick]
*) Respect DEFAULT_REL_RUNTIMEDIR for default values of FcgidIPCDir and
FcgidProcessTableFile. [Jeff Trawick]
*) Resolve fatal EDEADLK errors with threaded MPMs on Solaris. [Jeff Trawick]
*) Display information about active processes in the server-status page.
[Ryan Pan]
*) Fix compatibility of httpd.conf-editing logic with non-GNU awk. PR 48067.
[Hans Werner Strube <strube physik3.gwdg.de>]
*) Fix startup errors creating shared memory in constrained systems, such
as OS X in its default configuration. This is a regression since mod_fcgid
2.2. [Jeff Trawick]
*) Recover from most "Resource temporarily unavailable" errors writing the
request to the FastCGI application. These were common with large request
bodies on Mac OS X and intermittent on Solaris. PR 48025. [Jeff Trawick]
*) Fix a bug in fixconf.sed that resulted in a prefix of "FcgidFcgid" on the
updated directives. [Dan Hulme <dhulme gmail.com>]
*) Fix possible corruption or truncation of request bodies which exceed
FcgidMaxRequestInMem. This is a regression since mod_fcgid 2.2, which
effectively ignored FcgidMaxRequestInMem if larger than 8K. PR 48021.
[Jeff Trawick]
*) Fix handling of the request body when a FastCGI access checker/
authenticator/authorizer (AAA) was configured. The body wasn't available
for the request handler. PR 47973.
[Jeff Trawick, Barry Scott <barry.scott onelan.co.uk>]
*) Fix handling of FcgidCmdOptions so that it can apply to wrapper scripts
which were defined with command-line arguments on the FcgidWrapper
directive. [Jeff Trawick]
Changes with mod_fcgid 2.3.4
*) Corrected unix 'make install' target regression in 2.3.3. [Jeff Trawick]
Changes with mod_fcgid 2.3.3
*) Add FcgidCmdOptions directive to associate some of the existing
configuration settings with a specific command. [Jeff Trawick]
*) Allow/respect virtual host settings for the following directives:
FcgidBusyTimeout, FcgidMaxProcessesPerClass, FcgidMinProcessesPerClass,
FcgidIdleTimeout, and FcgidProcessLifetime. [Jeff Trawick]
Changes with mod_fcgid 2.3.2
*) Fix a make install DESTDIR problem handling the reference manual and
potentially other files (specific to 2.3.1).
[Paul Howarth <paul city-fan.org>]
*) Fix a mod_fcgid 2.3.1 failure with <sys/mutex.h> when building for
httpd 2.0.x on some platforms. [Paul Howarth <paul city-fan.org>]
*) Termination of idle processes after inactivity timeout can now be
disabled by setting FcgidIdleTimeout to 0. Termination of idle
processes based on the process lifetime can now be disabled by setting
FcgidProcessLifeTime to 0. FcgidMaxRequestsPerProcess now accepts 0
for unlimited. [Ricardo Cantu <ricardo smartcsc.com>]
*) All directives have been renamed in order to use a common prefix "Fcgid".
Underscores in directive names have been eliminated in favor of
CamelCase. The old directive names will still work but are deprecated.
To fix your configuration you can use the sed script build/fixconf.sed.
The following tables contains old and new directive names.
Old Name New Name
...................................................................
BusyScanInterval FcgidBusyScanInterval
BusyTimeout FcgidBusyTimeout
DefaultInitEnv FcgidInitialEnv
DefaultMaxClassProcessCount FcgidMaxProcessesPerClass
DefaultMinClassProcessCount FcgidMinProcessesPerClass
ErrorScanInterval FcgidErrorScanInterval
FastCgiAccessChecker FcgidAccessChecker
FastCgiAccessCheckerAuthoritative FcgidAccessCheckerAuthoritative
FastCgiAuthenticator FcgidAuthenticator
FastCgiAuthenticatorAuthoritative FcgidAuthenticatorAuthoritative
FastCgiAuthorizer FcgidAuthorizer
FastCgiAuthorizerAuthoritative FcgidAuthorizerAuthoritative
FCGIWrapper FcgidWrapper
IdleScanInterval FcgidIdleScanInterval
IdleTimeout FcgidIdleTimeout
IPCCommTimeout FcgidIOTimeout
IPCConnectTimeout FcgidConnectTimeout
MaxProcessCount FcgidMaxProcesses
MaxRequestInMem FcgidMaxRequestInMem
MaxRequestLen FcgidMaxRequestLen
MaxRequestsPerProcess FcgidMaxRequestsPerProcess
OutputBufferSize FcgidOutputBufferSize
PassHeader FcgidPassHeader
PHP_Fix_Pathinfo_Enable FcgidFixPathinfo
ProcessLifeTime FcgidProcessLifeTime
SharememPath FcgidProcessTableFile
SocketPath FcgidIPCDir
SpawnScore FcgidSpawnScore
SpawnScoreUpLimit FcgidSpawnScoreUpLimit
TerminationScore FcgidTerminationScore
TimeScore FcgidTimeScore
ZombieScanInterval FcgidZombieScanInterval
*) Separate classes by virtual host also on Windows. [Rainer Jung]
*) Log client IP address with many more error log messages. [Jeff Trawick]
*) Fix basic implementation of FcgidMaxRequestInMem and FcgidMaxRequestLen
directives. [Jeff Trawick]
*) Merge per-directory directives so that they can be inherited or
overridden within other containers as expected. Merge server config/
virtual host directives so that they can be inherited or overridden
within a virtual host as expected. [Jeff Trawick]
*) Use the virtual host settings for the request being processed instead
of those of the first FastCGI request handled by this httpd child process.
Affected directives: FcgidBusyTimeout, FcgidIOTimeout,
FcgidConnectTimeout, FcgidMaxRequestsPerProcess, and FcgidOutputBufferSize.
[Jeff Trawick]
*) Directives which previously were ignored in a virtual host context are no
longer allowed. [Jeff Trawick]
*) Add an optional flag "virtual" to FcgidWrapper.
If virtual is set, the URLs passed to the wrapper are not
checked, whether they resolve to a file. [Rainer Jung]
*) Make the second argument (suffix) for FcgidWrapper optional.
A wrapper defined without a suffix applies to all URLs, unless
there is another more specific wrapper with a suffix. [Rainer Jung]
Changes with mod_fcgid 2.3.1
*) Suppress "need AuthType to note auth failure" error-level messages when a
FastCGIAccessChecker fails without any other kind of authentication
(Basic, Digest) configured. [Eric Covener]
*) Complete the unix port to 2.3-dev trunk. [William Rowe]
*) Provide a default, mandatory environment as with mod_cgi (with the
inclusion of LD_LIBRARY_PATH or similar variables on other platforms),
unless overridden by DefaultInitEnv. [William Rowe]
*) Handle DefaultInitEnv for case-insensitive platforms by forcing the env
variable names to uppercase on Win32, OS2 and Netware. [William Rowe]
*) Don't try to set the ownership of the socket directory unless running
as root and the directory was just created. This allows the default
httpd.conf (with some daemon User/Group) to be used by non-root.
[Jeff Trawick]
*) Fix formatting of several messages, including the oft-seen "mod_fcgid:
Can't create shared memory for size %zu byte". [Jeff Trawick]
*) Fix declared names of FastCgiAuthenticator and FastCgiAuthenticator-
Authoritative directives, allowing them to be used. [Ulf Haueisen
<ulf dvlp.de>]
*) Fix vhost-specific DefaultInitEnv settings. Previously, when setting
multiple virtual hosts with the same SuexecUserGroup user and group, the
process manager use the same process pool for both virtual hosts. This
means if one virtual host has a DefaultInitEnv and the other has
different values set, a fastcgi request from any of these virtual host
can go to the same processes, which is inconsistent (a request from
virtualhost a with DefaultInitEnv VAL "a", can go to a process spawned
with virtualhost b with DefaultInitEnv VAL "b" set). [Gabriel Barazer
<gabriel oxeva.fr>]
+- Added keybindings for scrolling.
- Help button and local help file.
+- Add support for multiple class names in CSS.
- Fix X11 coordinate overflows with huge borders.
- Improve CSS font parsing.
- Enable font face setting via <font> element.
- Ignore XML comment markers in CSS.
- Split up long lines in plain.cc to avoid X11 coordinate overflows.
- Fix user agent style for nested <ul>.
- Add support for CSS property list-style-position.
- Support border-width: thin | medium | thick.
- Fix CSS_SHORTHAND_DIRECTIONS case in CssParser.
- Add quirk to reset font properties in tables (fixes e.g. gmail).
+- Cleaned up system includes in dpid directory.
- Fixed CustProgressBox() for systems without weak symbols.
- Handle signed chars. Added dIsspace() and dIsalnum() to dlib.
- Added a_Dpip_get_attr_l() to DPIP's API.
- Changed the CCCs to build in one step (for both HTTP and DPI). This
is simpler and helps to avoid race conditions.
- Updated CCCwork.txt to the new scheme.
- Fixed a bug with OPTION element (it was parsing entities twice).
- Bugfix: remove the empty cache entry lingering after connection abort.
- Switched capi to use dlib's Dlist instead of a_List_* methods.
- Remove empty cache entries on Stop-button press and new link request!
- Fixed URL unescaping in the datauri DPI.
- Changed and reimplemented the DPI API.
* Fixed bugs and updated all DPI programs:
* Reimplemented the file dpi using select(). No pthreads-based anymore.
* Fixed ftp dpi: downloads, streamed transfer, error feedback.
* Fixed a bug in dillo with lingering cache entries.
* Made dpidc a C language program.
* Made the internal dsh implementation use unique functions for read/write.
* Removed the write/fwrite mix in DPIP.
* Made the DPIP API token-based. Packet assembling is coded inside DPIP!
* Several cleanups and more error handling sprinkled all over too.
+- Fix segfault from AREA when MAP is missing name attribute.
- Fix image map coordinates when margin/border/padding present.
- Handle stylesheet @charset.
- Fix cache segfault when cache entry removed.
- Split words that contain whitespace as numeric character references.
- Allow linebreaks around Chinese/Japanese characters.
- Fix segfault in Html_parse_doctype (BUG#918).
- Change exit code used for bad command line argument.
- By default, do not use proxy for localhost (BUG 921).
- Fix scrolling for text search.
- Added 'save' key action (not bound by default).
- Tooltips
- Fix segfault when radio button lacks name attribute.
- Enable popup menu below bottom of page content (BUG#856).
- Handle JPEGs with CMYK color space.
- Allow keysyms in keysrc.
- Explicitly check installation bindir for dpid (BUG 930)
- General cookies overhaul.
+- Support for the letter-spacing property.
+- Fixed a bug in w3c_mode. In fact it wasn't working at all.
- Improve stylesheet menu.
+- Limit number of simultaneous connections (BUG 685).
* template: Preprocess parameters before htmlizing.
* img: Fix a bug that could taint @links with undef values.
* setup automator: Configure Term::Readline to use bold for prompt, rather
than default underline. Closes: #517656
* Allow jumping directly into account registration process by going to
ikiwiki.cgi?do=register
* Improve display of openid in preferences page.
* Add link to userpage (or creation link) to top of preferences page.
* opendiscussion: This plugin will also now allow posting comments
to otherwise locked-down sites.
* auto-blog.setup: Lock all pages, so only admin can post to the blog
by default, and enable opendiscussion so others can comment.
* Fix color and format plugins to appear in the websetup interface.
* amazon_s3: Fix to support the EU S3 datacenter, which is more picky
about attempts to create already existing buckets.
* httpauth: When cgiauthurl is configured, httpauth can now be used
alongside other authentication methods (like openid or anonok). Rather
than always redirect to the cgiauthurl for authentication, there is now
a button on the login form to use it.
* httpauth: Add httpauth_pagespec setting that can be used to limit
pages to only being edited via users authed with httpauth.
* Allow globs to be used in user() pagespecs.
* Group related plugins into sections in the setup file, and drop
unused rcs plugins from the setup file.
uWSGI is a fast (pure C), self-healing, developer-friendly WSGI server,
aimed for professional python webapps deployment and development.
Backend support exists for Apache, nginx, cherokee and lighttpd.
Some of the features include:
- low memory footprint
- preforking and multithreaded operation
- logging, diagnostic and profiling support
- support for sendfile()
- self-healing
- graceful restart and hot-plug upgrading
Collection.
The Perl 5 module Web::Scraper is a web scraper toolkit, inspired
by Ruby's equivalent Scrapi. It provides a DSL-ish interface for
traversing HTML documents and returning a neatly arranged Perl data
structure.
NetBSD Packages Collection.
The Perl 5 module HTML::TreeBuilder::LibXML is a libxml based
compatible interface to HTML::TreeBuilder, which could be slow for
a large document.
* Update Polish language files, supporting really 2.8.RC2.
* Add missing language files which should be added: Bosnian, Croatian,
Finnish, Hungarian, Slovenian and Tagalog.
* Drop executable permission from translation files.
- fix various bugs, including a trivial to trigger OOM/DoS
- Allow support for checking for exec bit on cgi scripts
- Add support for TLS servername indication
- Add support client certificate verification
- Split off spawn-fcgi into a separate package
spawn-fcgi is a small utility to start external FastCGI applications.
It takes care of various common tasks to simplify deployment:
- setuid/setgid
- current working directory
- chroot
- socket creation and permissions in the case of Unix Domain Sockets
- forking a number of worker processes
- fix issues with Keep-Alive in various clients
- fix issue with internal redirects between proxy/fastcgi locations
- fix a bug with discarding request bodies
Add optional uwsgi backend.
NetBSD Packages Collection.
The Perl 5 module HTML::TreeBuilder::XPath adds typical XPath methods
to HTML::TreeBuilder, to make it easy to query a document.
Version 3.49
[BUG FIXES]
1. Fix a regression since 3.44 involving a case when the header includes "Content-Length: 0".
Thanks to Alex Vandiver (RT#51109)
2. Suppress uninitialized warnings under -w. Thanks to burak. (RT#50301)
3. url() now uses virtual_port() instead of server_port(). Thanks to MKANAT and Yanick Champoux. (RT#51562)
[SECURITY]
1. embedded newlines are now filtered out of header values in header().
Thanks to Mark Stosberg and Yanick Champoux.
[DOCUMENTATION]
1. README was updated to reflect that CGI.pm was moved under ./lib.
Thanks to Alex Vandiver.
[INTERNALS]
1. More tests were added for autoescape, thanks to Bob Kuo. (RT#25485)
2. Attempt to avoid test failures with t/fast, thanks to Steve Hay. (RT#49599)
