==== NEWS ==== - 1.5.0 - * fixed decoding of common headers in AJP13 (#1399) * disable experimental linux-aio and posix-aio support, use gthread-aio instead * fixed several crashes in log-request-handling with %s being NULL on solaris * fixed network-backend-solaris-sendfilev (EINVAL in writev()) * fixed initgroups() called after chroot (#1384) * execute fcgi app without /bin/sh if used as argument to spawn-fcgi (#1428) * fix bug that rrdtool reports "0" for incoming data (#1514) * ssl.cipher-list and ssl.use-sslv2 ported from 1.4.x (#1422) * add IdleServers and Scoreboard directives in ?auto mode for mod_status (#1507) * support letterhomes in mod_userdir (#1473) * mod_auth ldap rework, most important change is being able to startup if ldap server is down (#1535) * Add possibility to disable methods in mod_compress (#1773) * fixed ECONNRESET handling in network-openssl * fixed log_write() for log-files > 4kbyte * fix sending source of cgi script instead of 500 error if fork fails * fix min-procs handling in mod_scgi.c, just set to max-procs (patch from #623) * mod_cgi: add a event-handler for STDERR_FILENO and log it with ERROR() * fixed building/testing outside of the src dir * fix many (64-bit) format warnings and unsigned/signed compare warnings * fixed out of range access in fd array (#1562, #372, #1603) (CVE-2008-0983) * fix auth-ldap configuration in tests * fcgi-stat-accel: Fix unused var / indentation * fix mod_compress bug (#1027) * fix ssl error queue handling (#285) (CVE-2008-1531) * fix dependencies of the parser files in the Makefile * fix server.kbytes-per-second (#1102) * let spawn-fcgi propagate exit code from spawned fcgi application * fix in/out statistics for connections * close connection after redirect in trigger_b4_dl * remove scons build system * fix memory leak on windows (#1371) * do not add Accept-Ranges header if range-request is disabled (#1449) * mod_compress: match mime-type additionaly against the part before ";" (i.e. without encoding) * fix bug with IPv6 in mod_evasive (#1579) * fix mod_magnet: enable "request.method" and "request.protocol" in lighty.env (#1308) * mod_magnet: set con->mode if content was generated so lighty doesn't append error messages. * fix #1574: check for symlinks after successful pathinfo matching * fix #1396: req-method OPTIONS: do not insert default response if request was denied * fix server.max-keep-alive-requests handling * reset physical.path after mod_magnet request restart * fix mod-proxy-backend-http waiting for http body for 304 and 205 (#1178) * fixed sock_addr reading in mod_cgi.c (#1672) * fixed postgresql-vhost module to use all options (#1694) * fixed #1565: mod_compress should check if the request is already handled, e.g. by fastcgi * merged from @1874: add ETag configuration (#1442) * case insensitive match for secdownload md5 token (#1710) * handle only HEAD, GET and POST in mod_dirlisting (same as in staticfile) (#1687) * fixed mod_webdav, litmus now passes everything except locks (#1738) * fixed #1555: HTTP Request/Response only accept complete headers, i.e. ended with double CRLF * fixed url encoding to encode more characters (#266) * fixed dropping last character of evhost pattern (#161) * Match headers case insensitive in response (removing of X-{Sendfile,LIGHTTPD-*}, catching Date/Server) * fixed mem leak in ssi expression parser (#1753), thx Take5k * decode url before matching in mod_rewrite (#1720) * fixed bug with case-insensitive filenames in mod_userdir (#1589), spotted by "anders1" * use decoded url for matching in mod_redirect (#1720) * don't return HANDLER_ERROR from proxy-core content handling, produce 500 instead * do not modify content-length in mod_chunked.c for HEAD requests (produced false Content-Length: 0 headers) * fix sending content-length for static HEAD requests * removed distribution specific stuff (was outdated anyway) * use pipe-io instead of SIGUSR1 to wakeup main thread (fixes #1517) * Fix ajp13 response header handling (fixes #1628) * Enhance mod_uploadprogress to show uploaded size after upload is done (closes #1632) by icy * Fix memory leak in stat-cache (closes #1693), patch by peto * Fix shutdown leaks (fixes #1811), patch by peto * Fix bogus send->bytes_in counter (problems with mod-deflate) * Reformat log output (add timestamp to new log functions) * Use void as return type for connection state machine - may fix some bugs * Fix select() fdevent backend * Fix DoS due to unhandled requests (results in hanging connections); return 403 instead of 200 without mod_deflate/compressed requests they will eventually time out * Fix wrong format strings (fixes #1900, thx stepancheg) * Port some mod_rrdtool fixes from 1.4.x (#604, #419 and more) * New lighttpd man page (moved it to section 8) (fixes #1875) * Fix leaving zombie process with include_shell (#1777) * Finally removed spawn-fcgi * Allow xattr to overwrite mime type (fixes #1929) * Fix endless loop in ajp (fixes #1897) * Fix segfault in mod_proxy_backend_http (fixes #1154) * merge: Fix base64 decoding in mod_auth (#1757) * merge: Compare address family in inet_ntop_cache * Revert CVE-2008-4359 (#1720) fix "encoding+simplifying urls for rewrite/redirect": too many regressions. * merge: Fix wrong malloc sizes in mod_accesslog (probably nothing bad happened...) (#1855, thx ycheng) * merge: Some small buffer.c fixes (#1837) * merge: Disable SSLv2 by default * merge: Use/enforce sane max-connection values (#1803) * merge: Fix max-connection limit handling/100% cpu usage (#1436) * merge: Fix segfault if siginfo_t* is NULL in sigaction handler (#1926) * merge: Create rrd file for empty rrdfile in mod_rrdtool (#1788) * merge: Strip trailing dot from "Host:" header * merge: Remove the optional port info from SERVER_NAME (thx Mr_Bond) * merge: Rename configure.in to configure.ac, with small cleanups (#1932) * merge: Add proper SUID bit detection (#416) * merge: Check for regular file in mod_cgi, so we don't try to start directories * merge: Include mmap.h from chunk.h to fix some problems with #define mmap mmap64 (#1923) * merge: Fix segfault for appending matched parts if there was no regex matching (just give empty strings) (#1601) * merge: fixed wrong result of buffer_caseless_compare("a", "ab") (#1287) * Fix many warnings * Fix SERVER_NAME port stripping (fixes #1968) * Fix mod_cgi environment keys mangling (fixes #1969) * Fix max-age value in mod_expire for 'modification' (fixes #1978) * Allow using pcre with cross-compiling (pcre-config got fixed; fixes #1986) * Fix segfault with openssl (DoS, fixes #2003) * Improve chunkqueue cleanup (remove empty chunks after ssl failures) * Add "lighty.req_env" table to mod_magnet for setting/getting environment values for cgi (fixes #1967, thx presbrey) * Fix segfault in mod_expire after failed config parsing (fixes #1992) * Add ssi.content-type option (default text/html, fixes #615) * Fix distbuild (add mod-compress.conf to dist files) * Add support for "real" entropy from /dev/[u]random (fixes #1977) * Adding support for additional chars in LDAP usernames (fixes #1941) * Ignore multiple "If-None-Match" headers (only use first one, fixes #753) * Fix 100% cpu usage if time() < 0 (thx to gaspa and cate, fixes #1964) * Free wakeup_iosocket (thx peto, fixes #1808) * Free ssl cipher list (thx peto, fixes #1809) * Add gthread-freebsd-sendfile (thx peto, fixes #1795) * Send gthread dummy pointers to wake them up for faster exit (thx peto, fixes #1812) * Fix race condition with joblist thread condition/mutex (thx peto, fixes #1823) * Fix segfault if there is no mimetype for the error documents * Use unsigned int for secdownload.timeout (fixes #1966) * Add server.breakagelog, a "special" stderr (fixes #1863) * Silenced the annoying "request timed out" warning, enable with the "debug.log-timeouts" option (fixes #2018) * Hide some ssl errors per default, enable them with debug.log-ssl-noise (#397) * Add "cgi.execute-x-only" to mod_cgi, requires +x for cgi scripts (fixes #2013) * Fixed gthread-freebsd-sendfile (#1795) * cmake: check for strtoll * Fix FD_SETSIZE comparision warnings * Add "lua-5.1" to searched pkg-config names for lua * Set FD_CLOEXEC for bound sockets before pipe-logger forks (fixes #2026) * Report non-fatal ssl errors as "connection close" * Add '%_' pattern for complete hostname in mod_evhost (fixes #1737) * Allow digits in hostnames in more places (fixes #1148) * Allow all comparisons for $SERVER["socket"] - only bind for "==" * Fix mod_deflate bzip2 compression level (thx peto, fixes #2035) * Add proxy-core.disable-time (used for all disable-times), default value 1 sec (fixes #1038) * Add proxy-core.max-backlog-size (set to 0 to disable backlog, thx e-razor) * Enable linux-aio-sendfile for testing in cmake again, fix a small bug in it * Set tm.tm_isdst = 0 before mktime() (fixes #2047) * Allow chunkqueue_skip to skip all types of chunks * Use linux-epoll by default if available (fixes #2021) * Add TLS servername indication (SNI) support (fixes #386, thx Peter Colberg ) * Add SSL Client Certificate verification (#1288) * mod_accesslog: escape special characters (fixes #1551, thx icy) - 1.5.0-r19.. - * -F option added for spawn-fcgi * replaced mod_fastcgi, mod_scgi, mod_proxy with mod_proxy_core + backends * added query-string parsing for mod_uploadprogress * added threaded stat() * added threaded disk-read() support * added dir-listing.set-footer in mod_dirlisting (#1277) * added logging of the PID and UID of the sending process for SIGTERM and SIGINT * added support for AJP13 to mod_proxy_core * fixed the out-of-fd support * fixed crash in mod_expire if 'modification' is used and stat() failed (#1063) * fixed hardcoded font-sizes in mod_dirlisting (#1267) * fixed different ETag length on 32/64 platforms (#1279) * fixed conditional dir-listing.exclude (#930) * fixed CONTENT_LENGTH = -1 in mod_cgi (#1276) * fixed typecast of NULL on execl() (#1235) * fixed extra Content-Length header on 1xx, 204 and 304 (#1002) * fixed mysql server reconnects (#518) * fixed prctl() usage (#1310, #1333) * fixed FastCGI header overrun in mod_fastcgi (reported by mattias@secweb.se) * fixed mem-leak in mod_auth (reported by Stefan Esser) * fixed crash with md5-sess and cnonce not set in mod_auth (reported by Stefan Esser) * fixed missing check for base64 encoded string in mod_auth and Basic auth (reported by Stefan Esser) * fixed possible crash in Auth-Digest header parser on trailing WS in mod_auth (reported by Stefan Esser)