diff options
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/CGI.pm | 4 | ||||
| -rw-r--r-- | lib/CGI/Changes | 1169 | ||||
| -rw-r--r-- | lib/CGI/Cookie.pm | 4 |
3 files changed, 1173 insertions, 4 deletions
diff --git a/lib/CGI.pm b/lib/CGI.pm index 94c4e65990..08adf4fae6 100644 --- a/lib/CGI.pm +++ b/lib/CGI.pm @@ -18,8 +18,8 @@ use Carp 'croak'; # The most recent version and complete docs are available at: # http://stein.cshl.org/WWW/software/CGI/ -$CGI::revision = '$Id: CGI.pm,v 1.177 2005/03/09 21:04:48 lstein Exp $'; -$CGI::VERSION=3.06; +$CGI::revision = '$Id: CGI.pm,v 1.178 2005/03/14 16:30:20 lstein Exp $'; +$CGI::VERSION=3.07; # HARD-CODED LOCATION FOR FILE UPLOAD TEMPORARY FILES. # UNCOMMENT THIS ONLY IF YOU KNOW WHAT YOU'RE DOING. diff --git a/lib/CGI/Changes b/lib/CGI/Changes new file mode 100644 index 0000000000..7a6baf802e --- /dev/null +++ b/lib/CGI/Changes @@ -0,0 +1,1169 @@ + Version 3.07 + 1. Fixed typo in mod_perl detection. + + Version 3.06 + + 1. Fixed bare call to script() in start_html + 2. Moved Fh::DESTROY out of autoloaded functions so as to avoid + clobbering $@ when CGI functions are executed in an eval{} + context. + 3. mod_perl 2.0 version detection patch in CGI::Cookie provided by + Allen Day. + 4. autoEscape() flag is now respected when generating extra + attributes. + 5. Tests for *tag start/end generation from Shlomi Fish. + 6. Support for can() method provided by Ron Savage. + 7. Fix for lang='' when outputting XHTML. + 8. Added support for chunked transfer encoding, as suggested by + Hakan Ardo + 9. Fixed clobbering of row and column headers in tableized radio + and checkbox groups, as reported by Nicolas Thierry-Mieg. + 10. <Label> tags are now associated with form elements, as suggested + by accessibility guidelines. + 11. The <?xml> directive produced by start_html is now turned off by + default and the charset is specified in a <meta> directive. Apparently + IE6 (and maybe some versions of Opera) were getting confused by this. + 12. Support for tab indexes. + 13. Retired the HTML docs. The POD docs are now primary documentation. + 14. CGI::Carp now correctly detects and handles Apache::Dispatch. + 15. CGI::Util::utf8_chr now correctly sets the UTF8 flag on 5.006 or + higher perls (fix courtesy Slaven Rezic). + + + Version 3.05 + + 1. Fixed uninitialized variable warning on start_form() when running + from command line. + 2. Fixed CGI::_set_attributes so that attributes with a - are handled + correctly. + 3. Fixed CGI::Carp::die() so as to avoid problems from _longmess() + clobbering @_. + 4. If HTTP_X_FORWARDED_HOST is defined (i.e. running under a proxy), + the various functions that return HOST will use that instead. + 5. Fix for undefined utf8() call in CGI::Util. + 6. Changed the call to warningsToBrowser() in + CGI::Carp::fatalsToBrowser to call only after HTTP header is sent + (thanks to Didier Lebrun for noticing). + 7. Patches from Dan Harkless to make CGI.pm validatable against HTML + 3.2. + 8. Fixed an extraneous "foo=bar" appearing when extra style + parameters passed to start_html; + 9. Fixed cross-site scripting bug in startform() pointed out by Dan + Harkless. + 10. Fixed documentation to discuss list context behavior of + form-element generators explicitly. + 11. Fixed incorrect results from end_form() when called in OO manner. + 12. Fixed query string stripping in order to handle URLs containing + escaped newlines. + 13. During server push, set NPH to 0 rather than 1. This is supposed + to fix problems with Apache. + 14. Fixed incorrect processing of multipart form fields that contain + embedded quotes. There's still the issue of how to handle ones + that contain embedded semicolons, but no one has complained (yet). + 15. Fixed documentation bug in -style argument to start_html() + 16. Added -status argument to redirect(). + + Version 3.04 + + 1. Fixed the problem with mod_perl crashing when "defaults" button + pressed. + + Version 3.03 + + 1. Fix upload hook functionality + 2. Workaround for CGI->unescape_html() + 3. Bumped version numbers in CGI::Fast and CGI::Util for 5.8.3-tobe + + Version 3.02 + + 1. Bring in Apache::Response just in case. + 2. File upload on EBCDIC systems now works. + + Version 3.01 + + 1. No fix yet for upload failures when running on EBCDIC server. + 2. Fixed uninitialized glob warnings that appeared when file + uploading under perl 5.8.2. + 3. Added patch from Schlomi Fish to allow debugging of PATH_INFO from + command line. + 4. Added patch from Steve Hay to correctly unlink tmp files under + mod_perl/windows + 5. Added upload_hook functionality from Jamie LeTaul + 6. Workarounds for mod_perl 2 IO issues. Check that file upload and + state saving still working. + 7. Added code for underreads. + 8. Fixed misleading description of redirect() and relative URLs in + the POD docs. + 9. Workaround for weird interaction of CGI::Carp with Safe module + reported by William McKee. + 10. Added patches from Ilmari Karonen to improve behavior of + CGI::Carp. + 11. Fixed documentation error in -style argument. + 12. Added virtual_port() method for finding out what port server is + listening on in a virtual-host aware fashion. + + Version 3.00 + + 1. Patch from Randal Schwartz to fix bug introduced by cross-site + scripting vulnerability "fix." + 2. Patch from JFreeman to replace UTF-8 escape constant of 0xfe with + 0xfc. Hope this is right! + + Version 2.99 + + 1. Patch from Steve Hay to fix extra Content-type: appearing on + browser screen when FatalsToBrowser invoked. + 2. Patch from Ewann Corvellec to fix cross-site scripting + vulnerability. + 3. Fixed tmpdir routine for file uploading to solve problem that + occurs under mod_perl when tmpdir is writable at startup time, but + not at session time. + + Version 2.98 + + 1. Fixed crash in Dump() function. + + Version 2.97 + + 1. Sigh. Uploaded wrong 2.96 to CPAN. + + Version 2.96 + + 1. More bugfixes to the -style argument. + + Version 2.95 + + 1. Fixed bugs in start_html(-style=>...) support introduced in 2.94. + + Version 2.94 + + 1. Removed warning from reset() method. + 2. Moved + + and tags into the :html3 group. Hope this removes undefined CGI::Area + errors. + + Changed CGI::Carp to play with mod_perl2 and to (hopefully) restore + reporting of compile-time errors. + + Fixed potential deadlock between web server and CGI.pm when aborting + a read due to POST_MAX (reported by Antti Lankila). + + Fixed issue with tag-generating function not incorporating content + when first variable undef. + + Fixed cross-site scripting bug reported by obscure. + + Fixed Dump() function to return correctly formed XHTML - bug + reported by Ralph Siemsen. + + Version 2.93 + + 1. Fixed embarassing bug in mp1 support. + + Version 2.92 + + 1. Fix to be P3P compliant submitted from MPREWITT. + 2. Added CGI->r() API for mod_perl1/mod_perl2. + 3. Fixed bug in redirect() that was corrupting cookies. + 4. Minor fix to behavior of reset() button to make it consistent with + submit() button (first time this has been changed in 9 years). + 5. Patch from Dan Kogai to handle UTF-8 correctly in 5.8 and higher. + 6. Patch from Steve Hay to make CGI::Carp's error messages appear on + MSIE browsers. + 7. Added Yair Lenga's patch for non-urlencoded postings. + 8. Added Stas Bekman's patches for mod_perl 2 compatibility. + 9. Fixed uninitialized escape behavior submitted by William Campbell. + 10. Fixed tied behavior so that you can pass arguments to tie() + 11. Fixed incorrect generation of URLs when the path_info contains + + and other odd characters. + 12. Fixed redirect(-cookies=>$cookie) problem. + 13. Fixed tag generation bug that affects -javascript passed to + start_html(). + + Version 2.91 + + 1. Attribute generation now correctly respects the value of + autoEscape(). + 2. Fixed endofrm() syntax error introduced by Ben Edgington's patch. + + Version 2.90 + + 1. Fixed bug in redirect header handling. + 2. Added P3P option to header(). + 3. Patches from Alexey Mahotkin to make CGI::Carp work correctly with + object-oriented exceptions. + 4. Removed inaccurate description of how to set multiple cookies from + CGI::Cookie pod file. + 5. Patch from Kevin Mahony to prevent running out of filehandles when + uploading lots of files. + 6. Documentation enhancement from Mark Fisher to note that the + import_names() method transforms the parameter names into valid + Perl names. + 7. Patch from Dan Harkless to suppress lang attribute in <html> tag + if specified as a null string. + 8. Patch from Ben Edgington to fix broken XHTML-transitional 1.0 + validation on endform(). + 9. Custom html header fix from Steffen Beyer (first letter correctly + upcased now) + 10. Added a -verbatim option to stylesheet generation from Michael + Dickson + 11. Faster delete() method from Neelam Gupta + 12. Fixed broken Cygwin support. + 13. Added empty charset support from Bradley Baetz + 14. Patches from Doug Perham and Kevin Mahoney to fix file upload + failures when uploaded file is a multiple of 4096. + + Version 2.89 + + 1. Fixed behavior of ACTION tag when POSTING to a URL that has a + query string. + 2. Added Patch from Michael Rommel to handle multipart/mixed uploads + from Opera + + Version 2.88 + + 1. Fixed problem with uploads being refused under Perl 5.8 when under + Taint mode. + 2. Fixed uninitialized variable warnings under Perl 5.8. + 3. Fixed CGI::Pretty regression test failures. + + Version 2.87 + + 1. Security hole patched: when processing multipart/form-data + postings, most arguments were being untainted silently. Returned + arguments are now tainted correctly. This may cause some scripts + to fail that used to work (thanks to Nick Cleaton for pointing + this out and persisting until it was fixed). + 2. Update for mod_perl 2.0. + 3. Pragmas such as -no_xhtml are now respected in mod_perl + environment. + + Version 2.86 + + 1. Fixes for broken CGI::Cookie expiration dates introduced in 2.84. + + Version 2.85 + + 1. Fix for broken autoEscape function introduced in 2.84. + + Version 2.84 + + 1. Fix for failed file uploads on Cygwin platforms. + 2. HTML escaping code now replaced 0x8b and 0x9b with unicode + references < and *#8250; + + Version 2.83 + + 1. Fixed autoEscape() documentation inconsistencies. + 2. Patch from Ville Skyttä to fix a number of XHTML inconsistencies. + 3. Added Max-Age to list of CGI::Cookie headers. + + Version 2.82 + + 1. Patch from Rudolf Troller to add attribute setting and option + groups to form fields. + 2. Patch from Simon Perreault for silent crashes when using CGI::Carp + under mod_perl. + 3. Patch from Scott Gifford allows you to set the program name for + CGI::Carp. + + Version 2.81 + + 1. Removed extraneous slash from end of stylesheet tags generated by + start_html in non-XHTML mode. + 2. Changed behavior of CGI::Carp with respect to eval{} contexts so + that output behaves properly in mod_perl environments. + 3. Fixed default DTD so that it validates with W3C validator. + + Version 2.80 + + 1. Fixed broken messages in CGI::Carp. + 2. Changed checked="1" to checked="checked" for real XHTML + compatibility. + 3. Resurrected REQUEST_URI code so that url() works correctly with + multiviews. + + Version 2.79 + + 1. Changes to CGI::Carp to avoid "subroutine redefined" error + messages. + 2. Default DTD is now XHTML 1.0 Transitional + 3. Patches to support all HTML4 tags. + + Version 2.78 + + 1. Added ability to change encoding in <?xml> assertion. + 2. Fixed the old escapeHTML('CGI') ne "CGI" bug + 3. In accordance with XHTML requirements, there are no longer any + minimized attributes, such as "checked". + 4. Patched bug which caused file uploads of exactly 4096 bytes to be + truncated to 4094 (thanks to Kevin Mahony) + 5. New tests and fixes to CGI::Pretty (thanks to Michael Schwern). + + Version 2.77 + + 1. No new features, but released in order to fix an apparent CPAN + bug. + + Version 2.76 + + 1. New esc.t regression test for EBCDIC translations courtesy Peter + Prymmer. + 2. Patches from James Jurach to make compatible with FCGI-ProcManager + 3. Additional fields passed to header() (like -Content_disposition) + now honor initial capitalization. + 4. Patch from Andrew McNaughton to handle utf-8 escapes (%uXXXX + codes) in URLs. + + Version 2.752 + + 1. Syntax error in the autoloaded Fh::new() subroutine. + 2. Better error reporting in autoloaded functions. + + Version 2.751 + + 1. Tiny tweak to filename regular expression function on line 3355. + + Version 2.75 + + 1. Fixed bug in server push boundary strings (CGI.pm and CGI::Push). + 2. Fixed bug that occurs when uploading files with funny characters + in the name + 3. Fixed non-XHTML-compliant attributes produced by textfield() + 4. Added EPOC support, courtesy Olaf Flebbe + 5. Fixed minor XHTML bugs. + 6. Made escape() and unescape() symmetric with respect to EBCDIC, + courtesy Roca, Ignasi <ignasi.roca@fujitsu.siemens.es> + 7. Removed uninitialized variable warning from CGI::Cookie, provided + by Atipat Rojnuckarin <rojnuca@yahoo.com> + 8. Fixed bug in CGI::Pretty that causes it to print partial end tags + when the $INDENT global is changed. + 9. Single quotes are changed to character entity ' for compatibility + with URLs. + + Version 2.74 + + September 13, 2000 + 1. Quashed one-character bug that caused CGI.pm to fail on file + uploads. + + Version 2.73 + + September 12, 2000 + 1. Added -base to the list of arguments accepted by url(). + 2. Fixes to XHTML support. + 3. POST parameters no longer show up in the Location box. + + Version 2.72 + + August 19, 2000 + 1. Fixed the defaults button so that it works again + 2. Charset is now correctly saved and restored when saving to files + 3. url() now works correctly when given scripts with %20 and other + escapes in the additional path info. This undoes a patch + introduced in version 2.47 that I no longer understand the + rationale for. + + Version 2.71 + + August 13, 2000 + 1. Newlines in the value attributes of hidden fields and other form + elements are now escaped when using ISO-Latin. + 2. Inline script and style sections are now protected as CDATA + sections when XHTML mode is on (the default). + + Version 2.70 + + August 4, 2000 + 1. Fixed bug in scrolling_list() which omitted a space in front of + the "multiple" attribute. + 2. Squashed the "useless use of string in void context" message from + redirects. + + Version 2.69 + + 1. startform() now creates default ACTION for POSTs as well as GETs. + This may break some browsers, but it no longer violates the HTML + spec. + 2. CGI.pm now emits XHTML by default. Disable with -no_xhtml. + 3. We no longer interpret &#ddd sequences in non-latin character + sets. + + Version 2.68 + + 1. No longer attempts to escape characters when dealing with non + ISO-8861 character sets. + 2. checkbox() function now defaults to using -value as its label, + rather than -name. The current behavior is what has been + documented from the beginning. + 3. -style accepts array reference to incorporate multiple stylesheets + into document. + + 1. Fixed two bugs that caused the -compile pragma to fail with a + syntax error. + + Version 2.67 + + 1. Added XHTML support (incomplete; tags need to be lowercased). + 2. Fixed CGI/Carp when running under mod_perl. Probably broke in + other contexts. + 3. Fixed problems when passing multiple cookies. + 4. Suppress warnings from _tableize() that were appearing when using + -w switch with radio_group() and checkbox_group(). + 5. Support for the header() -attachment argument, which can give + pages a default file name when saving to disk. + + Version 2.66 + + 1. 2.65 changes in make_attributes() broke HTTP header functions + (including redirect), so made it context sensitive. + + Version 2.65 + + 1. Fixed regression tests to skip tests that require implicit fork on + machines without fork(). + 2. Changed make_attributes() to automatically escape any HTML + reserved characters. + 3. Minor documentation fix in javascript example. + + Version 2.64 + + 1. Changes introduced in 2.63 broke param() when retrieving parameter + lists containing only a single argument. This is now fixed. + 2. self_url() now defaults to returning parameters delimited with + semicolon. Use the pragma -oldstyle_urls to get the old "&" + delimiter. + + Version 2.63 + + 1. Fixed CGI::Push to pull out parameters correctly. + 2. Fixed redirect() so that it works with default character set + 3. Changed param() so as to returned empty string '' when referring + to variables passed in query strings like 'name1=&name2' + + Version 2.62 + + 1. Fixed broken ReadParse() function, and added regression tests + 2. Fixed broken CGI::Pretty, and added regression tests + + Version 2.61 + + 1. Moved more functions from CGI.pm proper into CGI/Util.pm. + CGI/Cookie should now be standalone. + 2. Disabled per-user temporary directories, which were causing grief. + + Version 2.60 + + 1. Fixed junk appearing in autogenerated HTML functions when using + object-oriented mode. + + Version 2.59 + + 1. autoescape functionality breaks too much existing code, removed + it. + 2. use escapeHTML() manually + + Version 2.58 + + This is the release version of 2.57. + + Version 2.57 + + 1. Added -debug pragma and turned off auto reading of STDIN. + 2. Default DTD updated to HTML 4.01 transitional. + 3. Added charset() method and the -charset argument to header(). + 4. Fixed behavior of escapeHTML() to respect charset() and to escape + nasty Windows characters (thanks to Tom Christiansen). + 5. Handle REDIRECT_QUERY_STRING correctly. + 6. Removed use_named_parameters() because of dependency problems and + general lameness. + 7. Fixed problems with bad HREF links generated by url(-relative=>1) + when the url is like /people/. + 8. Silenced a warning on upload (patch provided by Jonas Liljegren) + 9. Fixed race condition in CGI::Carp when errors occur during parsing + (patch provided by Maurice Aubrey). + 10. Fixed failure of url(-path_info=>1) when path contains % signs. + 11. Fixed warning from CGI::Cookie when receiving foreign cookies that + don't use name=value format. + 12. Fixed incompatibilities with file uploading on VMS systems. + + Version 2.56 + + 1. Fixed bugs in file upload introduced in version 2.55 + 2. Fixed long-standing bug that prevented two files with identical + names from being uploaded. + + Version 2.55 + + 1. Fixed cookie regression test so as not to produce an error. + 2. Fixed path_info() and self_url() to work correctly together when + path_info() modified. + 3. Removed manify warnings from CGI::{Switch,Apache}. + + Version 2.54 + + 1. This will be the last release of the monolithic CGI.pm module. + Later versions will be modularized and optimized. + 2. DOMAIN tag no longer added to cookies by default. This will break + some versions of Internet Explorer, but will avoid breaking + networks which use host tables without fully qualified domain + names. For compatibility, please always add the -domain tag when + creating cookies. + 3. Fixed escape() method so that +'s are treated correctly. + 4. Updated CGI::Pretty module. + + Version 2.53 + + 1. Forgot to upgrade regression tests before releasing 2.52. NOTHING + ELSE HAS CHANGED IN LIBRARY + + Version 2.52 + + 1. Spurious newline in checkbox() routine removed. (courtesy John + Essen) + 2. TEXTAREA linebreaks now respected in dump() routine. (courtesy + John Essen) + 3. Patches for DOS ports (courtesy Robert Davies) + 4. Patches for VMS + 5. More fixes for cookie problems + 6. Fix CGI::Carp so that it doesn't affect eval{} blocks (courtesy + Byron Brummer) + + Version 2.51 + + 1. Fixed problems with cookies not being remembered when sent to IE + 5.0 (and Netscape 5.0 too?) + 2. Numerous HTML compliance problems in cgi_docs.html; fixed thanks + to Michael Leahy + + Version 2.50 + + 1. Added a new Vars() method to retrieve all parameters as a tied + hash. + 2. Untainted tainted tempfile name so that script doesn't fail on + terminal unlink. + 3. Made picking of upload tempfile name more intelligent so that + doesn't fail in case of name collision. + 4. Fixed handling of expire times when passed an absolute timestamp. + 5. Changed dump() to Dump() to avoid name clashes. + + Version 2.49 + + 1. Fixes for FastCGI (globals not getting reset) + 2. Fixed url() to correctly handle query string and path under + MOD_PERL + + Version 2.48 + + 1. Reverted detection of MOD_PERL to avoid breaking PerlEX. + + Version 2.47 + + 1. Patch to fix file upload bug appearing in IE 3.01 for + Macintosh/PowerPC. + 2. Replaced use of $ENV{SCRIPT_NAME} with $ENV{REQUEST_URI} when + running under Apache, to fix self-referencing URIs. + 3. Fixed bug in escapeHTML() which caused certain constructs, such as + CGI->image_button(), to fail. + 4. Fixed bug which caused strong('CGI') to fail. Be careful to use + CGI::strong('CGI') and not CGI->strong('CGI'). The latter will + produce confusing results. + 5. Added upload() function, as a preferred replacement for the + "filehandle as string" feature. + 6. Added cgi_error() function. + 7. Rewrote file upload handling to return undef rather than dieing + when an error is encountered. Be sure to call cgi_error() to find + out what went wrong. + + Version 2.46 + + 1. Fix for failure of the "include" tests under mod_perl + 2. Added end_multipart_form to prevent failures during qw(-compile + :all) + + Version 2.45 + + 1. Multiple small documentation fixes + 2. CGI::Pretty didn't get into 2.44. Fixed now. + + Version 2.44 + + 1. Fixed file descriptor leak in upload function. + 2. Fixed bug in header() that prevented fields from containing double + quotes. + 3. Added Brian Paulsen's CGI::Pretty package for pretty-printing + output HTML. + 4. Removed CGI::Apache and CGI::Switch from the distribution. + 5. Generated start_* shortcuts so that start_table(), end_table(), + start_ol(), end_ol(), and so forth now work (see the docs on how + to enable this feature). + 6. Changed accept() to Accept(), sub() to Sub(). There's still a + conflict with reset(), but this will break too many existing + scripts! + + Version 2.43 + + 1. Fixed problem with "use strict" and file uploads (thanks to Peter + Haworth) + 2. Fixed problem with not MSIE 3.01 for the power_mac not doing file + uploads right. + 3. Fixed problem with file upload on IIS 4.0 when authorization in + use. + 4. -content_type and '-content-type' can now be provided to header() + as synonyms for -type. + 5. CGI::Carp now escapes the ampersand BEFORE escaping the > and < + signs. + 6. Fixed "not an array reference" error when passing a hash reference + to radio_group(). + 7. Fixed non-removal of uploaded TMP files on NT platforms which + occurs when server runs on non-C drive (thanks to Steve Kilbane + for finding this one). + + Version 2.42 + + 1. Too many screams of anguish at changed behavior of url(). Is now + back to its old behavior by default, with options to generate all + the variants. + 2. Added regression tests. "make test" now works. + 3. Documentation fixes. + 4. Fixes for Macintosh uploads, but uploads STILL do not work pending + changes to MacPerl. + + Version 2.41 + + 1. url() method now includes the path info. Use script_name() to get + it without path info(). + 2. Changed handling of empty attributes in HTML tag generation. Be + warned! Use table({-border=>undef}) rather than + table({-border=>''}). + 3. Changes to allow uploaded filenames to be compared to other + strings with "eq", "cmp" and "ne". + 4. Changes to allow CGI.pm to coexist more peacefully with + ActiveState PerlEX. + 5. Changes to prevent exported variables from clashing when importing + ":all" set in combination with cookies. + + Version 2.40 + + 1. CGI::Carp patched to work better with mod_perl (thanks to Chris + Dean). + 2. Uploads of files whose names begin with numbers or the Windows + \\UNC\shared\file nomenclature should no longer fail. + 3. The <STYLE> tag (for cascading style sheets) now generates the + required TYPE attribute. + 4. Server push primitives added, thanks to Ed Jordan. + 5. Table and other HTML3 functions are now part of the :standard set. + 6. Small documentation fixes. + + TO DO: + 1. Do something about the DTD mess. The module should generate + correct DTDs, or at least offer the programmer a way to specify + the correct one. + 2. Split CGI.pm into CGI processing and HTML-generating modules. + 3. More robust file upload (?still not working on the Macintosh?). + 4. Bring in all the HTML4 functionality, particular the accessibility + features. + + Version 2.39 + + 1. file uploads failing because of VMS patch; fixed. + 2. -dtd parameter was not being properly processed. + + Version 2.38 + + I finally got tired of all the 2.37 betas and released 2.38. The main + difference between this version and the last 2.37 beta (2.37b30) are + some fixes for VMS. This should allow file upload to work properly on + all VMS Web servers. + + Version 2.37, various beta versions + + 1. Added a CGI::Cookie::parse() method for lucky mod_perl users. + 2. No longer need separate -values and -labels arguments for + multi-valued form elements. + 3. Added better interface to raw cookies (fix courtesy Ken Fox, + kfox@ford.com) + 4. Added param_fetch() function for direct access to parameter list. + 5. Fix to checkbox() to allow for multi-valued single checkboxes + (weird problem). + 6. Added a compile() method for those who want to compile without + importing. + 7. Documented the import pragmas a little better. + 8. Added a -compile switch to the use clause for the long-suffering + mod_perl and Perl compiler users. + 9. Fixed initialization routines so that FileHandle and type globs + work correctly (and hash initialization doesn't fail!). + 10. Better deletion of temporary files on NT systems. + 11. Added documentation on escape(), unescape(), unescapeHTML() and + unescapeHTML() subroutines. + 12. Added documentation on creating subclasses. + 13. Fixed problem when calling $self->SUPER::foo() from inheriting + subclasses. + 14. Fixed problem using filehandles from within subroutines. + 15. Fixed inability to use the string "CGI" as a parameter. + 16. Fixed exponentially growing $FILLUNIT bug + 17. Check for undef filehandle in read_from_client() + 18. Now requires the UNIVERSAL.pm module, present in Perl 5.003_7 or + higher. + 19. Fixed problem with uppercase-only parameters being ignored. + 20. Fixed vanishing cookie problem. + 21. Fixed warning in initialize_globals() under mod_perl. + 22. File uploads from Macintosh versions of MSIE should now work. + 23. Pragmas now preceded by dashes (-nph) rather than colons (:nph). + Old style is supported for backward compatability. + 24. Can now pass arguments to all functions using {} brackets, + resolving historical inconsistencies. + 25. Removed autoloader warnings about absent MultipartBuffer::DESTROY. + 26. Fixed non-sticky checkbox() when -name used without -value. + 27. Hack to fix path_info() in IIS 2.0. Doesn't help with IIS 3.0. + 28. Parameter syntax for debugging from command line now more + straightforward. + 29. Added $DISABLE_UPLOAD to disable file uploads. + 30. Added $POST_MAX to error out if POSTings exceed some ceiling. + 31. Fixed url_param(), which wasn't working at all. + 32. Fixed variable suicide problem in s///e expressions, where the + autoloader was needed during evaluation. + 33. Removed excess spaces between elements of checkbox and radio + groups + 34. Can now create "valueless" submit buttons + 35. Can now set path_info as well as read it. + 36. ReadParse() now returns a useful function result. + 37. import_names() now allows you to optionally clear out the + namespace before importing (for mod_perl users) + 38. Made it possible to have a popup menu or radio button with a value + of "0". + 39. link() changed to Link() to avoid overriding native link function. + 40. Takes advantage of mod_perl's register_cleanup() function to clear + globals. + 41. <LAYER> and <ILAYER> added to :html3 functions. + 42. Fixed problems with private tempfiles and NT/IIS systems. + 43. No longer prints the DTD by default (I bet no one will complain). + 44. Allow underscores to replace internal hyphens in parameter names. + 45. CGI::Push supports heterogeneous MIME types and adjustable delays + between pages. + 46. url_param() method added for retrieving URL parameters even when a + fill-out form is POSTed. + 47. Got rid of warnings when radio_group() is called. + 48. Cookies now moved to their very own module. + 49. Fixed documentation bug in CGI::Fast. + 50. Added a :no_debug pragma to the import list. + + Version 2.36 + + 1. Expanded JavaScript functionality + 2. Preliminary support for cascading stylesheets + 3. Security fixes for file uploads: + + Module will bail out if its temporary file already exists + + Temporary files can now be made completely private to avoid + peeking by other users or CGI scripts. + 4. use CGI qw/:nph/ wasn't working correctly. Now it is. + 5. Cookie and HTTP date formats didn't meet spec. Thanks to Mark + Fisher (fisherm@indy.tce.com) for catching and fixing this. + + p + + Version 2.35 + + 1. Robustified multipart file upload against incorrect syntax in + POST. + 2. Fixed more problems with mod_perl. + 3. Added -noScript parameter to start_html(). + 4. Documentation fixes. + + Version 2.34 + + 1. Stupid typo fix + + Version 2.33 + + 1. Fixed a warning about an undefined environment variable. + 2. Doug's patch for redirect() under mod_perl + 3. Partial fix for busted inheritence from CGI::Apache + 4. Documentation fixes. + + Version 2.32 + + 1. Improved support for Apache's mod_perl. + 2. Changes to better support inheritance. + 3. Support for OS/2. + + Version 2.31 + + 1. New uploadInfo() method to obtain header information from uploaded + files. + 2. cookie() without any arguments returns all the cookies passed to a + script. + 3. Removed annoying warnings about $ENV{NPH} when running with the -w + switch. + 4. Removed operator overloading throughout to make compatible with + new versions of perl. + 5. -expires now implies the -date header, to avoid clock skew. + 6. WebSite passes cookies in $ENV{COOKIE} rather than + $ENV{HTTP_COOKIE}. We now handle this, even though it's O'Reilly's + fault. + 7. Tested successfully against new sfio I/O layer. + 8. Documentation fixes. + + Version 2.30 + + 1. Automatic detection of operating system at load time. + 2. Changed select() function to Select() in order to avoid conflict + with Perl built-in. + 3. Added Tr() as an alternative to TR(); some people think it looks + better that way. + 4. Fixed problem with autoloading of MultipartBuffer::DESTROY code. + 5. Added the following methods: + + virtual_host() + + server_software() + 6. Automatic NPH mode when running under Microsoft IIS server. + + Version 2.29 + + 1. Fixed cookie bugs + 2. Fixed problems that cropped up when useNamedParameters was set to + 1. + 3. Prevent CGI::Carp::fatalsToBrowser() from crapping out when + encountering a die() within an eval(). + 4. Fixed problems with filehandle initializers. + + Version 2.28 + + 1. Added support for NPH scripts; also fixes problems with Microsoft + IIS. + 2. Fixed a problem with checkbox() values not being correctly saved + and restored. + 3. Fixed a bug in which CGI objects created with empty string + initializers took on default values from earlier CGI objects. + 4. Documentation fixes. + + Version 2.27 + + 1. Small but important bug fix: the automatic capitalization of tag + attributes was accidentally capitalizing the VALUES as well as the + ATTRIBUTE names (oops). + + Version 2.26 + + 1. Changed behavior of scrolling_list(), checkbox() and + checkbox_group() methods so that defaults are honored correctly. + The "fix" causes endform() to generate additional <INPUT + TYPE="HIDDEN"> tags -- don't be surpised. + 2. Fixed bug involving the detection of the SSL protocol. + 3. Fixed documentation error in position of the -meta argument in + start_html(). + 4. HTML shortcuts now generate tags in ALL UPPERCASE. + 5. start_html() now generates correct SGML header: + <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN"> + + 6. CGI::Carp no longer fails "use strict refs" pragma. + + Version 2.25 + + 1. Fixed bug that caused bad redirection on destination URLs with + arguments. + 2. Fixed bug involving use_named_parameters() followed by + start_multipart_form() + 3. Fixed bug that caused incorrect determination of binmode for + Macintosh. + 4. Spelling fixes on documentation. + + Version 2.24 + + 1. Fixed bug that caused generation of lousy HTML for some form + elements + 2. Fixed uploading bug in Windows NT + 3. Some code cleanup (not enough) + + Version 2.23 + + 1. Fixed an obscure bug that caused scripts to fail mysteriously. + 2. Fixed auto-caching bug. + 3. Fixed bug that prevented HTML shortcuts from passing taint checks. + 4. Fixed some -w warning problems. + + Version 2.22 + + 1. New CGI::Fast module for use with FastCGI protocol. See pod + documentation for details. + 2. Fixed problems with inheritance and autoloading. + 3. Added TR() (<tr>) and PARAM() (<param>) methods to list of + exported HTML tag-generating functions. + 4. Moved all CGI-related I/O to a bottleneck method so that this can + be overridden more easily in mod_perl (thanks to Doug MacEachern). + 5. put() method as substitute for print() for use in mod_perl. + 6. Fixed crash in tmpFileName() method. + 7. Added tmpFileName(), startform() and endform() to export list. + 8. Fixed problems with attributes in HTML shortcuts. + 9. Functions that don't actually need access to the CGI object now no + longer generate a default one. May speed things up slightly. + 10. Aesthetic improvements in generated HTML. + 11. New examples. + + Version 2.21 + + 1. Added the -meta argument to start_html(). + 2. Fixed hidden fields (again). + 3. Radio_group() and checkbox_group() now return an appropriate + scalar value when called in a scalar context, rather than + returning a numeric value! + 4. Cleaned up the formatting of form elements to avoid unesthetic + extra spaces within the attributes. + 5. HTML elements now correctly include the closing tag when + parameters are present but null: em('') + 6. Added password_field() to the export list. + + Version 2.20 + + 1. Dumped the SelfLoader because of problems with running with taint + checks and rolled my own. Performance is now significantly + improved. + 2. Added HTML shortcuts. + 3. import() now adheres to the Perl module conventions, allowing + CGI.pm to import any or all method names into the user's name + space. + 4. Added the ability to initialize CGI objects from strings and + associative arrays. + 5. Made it possible to initialize CGI objects with filehandle + references rather than filehandle strings. + 6. Added the delete_all() and append() methods. + 7. CGI objects correctly initialize from filehandles on NT/95 systems + now. + 8. Fixed the problem with binary file uploads on NT/95 systems. + 9. Fixed bug in redirect(). + 10. Added '-Window-target' parameter to redirect(). + 11. Fixed import_names() so that parameter names containing funny + characters work. + 12. Broke the unfortunate connection between cookie and CGI parameter + name space. + 13. Fixed problems with hidden fields whose values are 0. + 14. Cleaned up the documentation somewhat. + + Version 2.19 + + 1. Added cookie() support routines. + 2. Added -expires parameter to header(). + 3. Added cgi-lib.pl compatability mode. + 4. Made the module more configurable for different operating systems. + 5. Fixed a dumb bug in JavaScript button() method. + + Version 2.18 + + 1. Fixed a bug that corrects a hang that occurs on some platforms + when processing file uploads. Unfortunately this disables the + check for bad Netscape uploads. + 2. Fixed bizarre problem involving the inability to process uploaded + files that begin with a non alphabetic character in the file name. + 3. Fixed a bug in the hidden fields involving the -override directive + being ignored when scalar defaults were passed. + 4. Added documentation on how to disable the SelfLoader features. + + Version 2.17 + + 1. Added support for the SelfLoader module. + 2. Added oodles of JavaScript support routines. + 3. Fixed bad bug in query_string() method that caused some parameters + to be silently dropped. + 4. Robustified file upload code to handle premature termination by + the client. + 5. Exported temporary file names on file upload. + 6. Removed spurious "uninitialized variable" warnings that appeared + when running under 5.002. + 7. Added the Carp.pm library to the standard distribution. + 8. Fixed a number of errors in this documentation, and probably added + a few more. + 9. Checkbox_group() and radio_group() now return the buttons as + arrays, so that you can incorporate the individual buttons into + specialized tables. + 10. Added the '-nolabels' option to checkbox_group() and + radio_group(). Probably should be added to all the other + HTML-generating routines. + 11. Added the url() method to recover the URL without the entire query + string appended. + 12. Added request_method() to list of environment variables available. + 13. Would you believe it? Fixed hidden fields again! + + Version 2.16 + + 1. Fixed hidden fields yet again. + 2. Fixed subtle problems in the file upload method that caused + intermittent failures (thanks to Keven Hendrick for this one). + 3. Made file upload more robust in the face of bizarre behavior by + the Macintosh and Windows Netscape clients. + 4. Moved the POD documentation to the bottom of the module at the + request of Stephen Dahmen. + 5. Added the -xbase parameter to the start_html() method, also at the + request of Stephen Dahmen. + 6. Added JavaScript form buttons at Stephen's request. I'm not sure + how to use this Netscape extension correctly, however, so for now + the form() method is in the module as an undocumented feature. Use + at your own risk! + + Version 2.15 + + 1. Added the -override parameter to all field-generating methods. + 2. Documented the user_name() and remote_user() methods. + 3. Fixed bugs that prevented empty strings from being recognized as + valid textfield contents. + 4. Documented the use of framesets and added a frameset example. + + Version 2.14 + + This was an internal experimental version that was never released. + + Version 2.13 + + 1. Fixed a bug that interfered with the value "0" being entered into + text fields. + + Version 2.01 + + 1. Added -rows and -columns to the radio and checkbox groups. No + doubt this will cause much grief because it seems to promise a + level of meta-organization that it doesn't actually provide. + 2. Fixed a bug in the redirect() method -- it was not truly HTTP/1.0 + compliant. + + Version 2.0 + + The changes seemed to touch every line of code, so I decided to bump + up the major version number. + 1. Support for named parameter style method calls. This turns out + to be a big win for extending CGI.pm when Netscape adds new HTML + "features". + 2. Changed behavior of hidden fields back to the correct "sticky" + behavior. This is going to break some programs, but it is for + the best in the long run. + 3. Netscape 2.0b2 broke the file upload feature. CGI.pm now handles + both 2.0b1 and 2.0b2-style uploading. It will probably break again + in 2.0b3. + 4. There were still problems with library being unable to distinguish + between a form being loaded for the first time, and a subsequent + loading with all fields blank. We now forcibly create a default + name for the Submit button (if not provided) so that there's + always at least one parameter. + 5. More workarounds to prevent annoying spurious warning messages + when run under the -w switch. -w is seriously broken in perl + 5.001! + + Version 1.57 + + 1. Support for the Netscape 2.0 "File upload" field. + 2. The handling of defaults for selected items in scrolling lists and + multiple checkboxes is now consistent. + + Version 1.56 + + 1. Created true "pod" documentation for the module. + 2. Cleaned up the code to avoid many of the spurious "use of + uninitialized variable" warnings when running with the -w switch. + 3. Added the autoEscape() method. v + 4. Added string interpolation of the CGI object. + 5. Added the ability to pass additional parameters to the <BODY> tag. + 6. Added the ability to specify the status code in the HTTP header. + + Bug fixes in version 1.55 + + 1. Every time self_url() was called, the parameter list would grow. + This was a bad "feature". + 2. Documented the fact that you can pass "-" to radio_group() in + order to prevent any button from being highlighted by default. + + Bug fixes in version 1.54 + + 1. The user_agent() method is now documented; + 2. A potential security hole in import() is now plugged. + 3. Changed name of import() to import_names() for compatability with + CGI:: modules. + + Bug fixes in version 1.53 + + 1. Fixed several typos in the code that were causing the following + subroutines to fail in some circumstances + 1. checkbox() + 2. hidden() + 2. No features added + + New features added in version 1.52 + + 1. Added backslashing, quotation marks, and other shell-style escape + sequences to the parameters passed in during debugging off-line. + 2. Changed the way that the hidden() method works so that the default + value always overrides the current one. + 3. Improved the handling of sticky values in forms. It's now less + likely that sticky values will get stuck. + 4. If you call server_name(), script_name() and several other methods + when running offline, the methods now create "dummy" values to + work with. + + Bugs fixed in version 1.51 + + 1. param() when called without arguments was returning an array of + length 1 even when there were no parameters to be had. Bad bug! + Bad! + 2. The HTML code generated would break if input fields contained the + forbidden characters ">< or &. You can now use these characters + freely. + + New features added in version 1.50 + + 1. import() method allows all the parameters to be imported into a + namespace in one fell swoop. + 2. Parameters are now returned in the same order in which they were + defined. + + Bugs fixed in version 1.45 + + 1. delete() method didn't work correctly. This is now fixed. + 2. reset() method didn't allow you to set the name of the button. + Fixed. + + Bugs fixed in version 1.44 + + 1. self_url() didn't include the path information. This is now fixed. + + New features added in version 1.43 + + 1. Added the delete() method. + + New features added in version 1.42 + + 1. The image_button() method to create clickable images. + 2. A few bug fixes involving forms embedded in <PRE> blocks. + + New features added in version 1.4 + + 1. New header shortcut methods + + redirect() to create HTTP redirection messages. + + start_html() to create the HTML title, complete with the + recommended <LINK> tag that no one ever remembers to include. + + end_html() for completeness' sake. + 2. A new save() method that allows you to write out the state of an + script to a file or pipe. + 3. An improved version of the new() method that allows you to restore + the state of a script from a file or pipe. With (2) this gives you + dump and restore capabilities! (Wow, you can put a "121,931 + customers served" banner at the bottom of your pages!) + 4. A self_url() method that allows you to create state-maintaining + hypertext links. In addition to allowing you to maintain the state + of your scripts between invocations, this lets you work around a + problem that some browsers have when jumping to internal links in + a document that contains a form -- the form information gets lost. + 5. The user-visible labels in checkboxes, radio buttons, popup menus + and scrolling lists have now been decoupled from the values sent + to your CGI script. Your script can know a checkbox by the name of + "cb1" while the user knows it by a more descriptive name. I've + also added some parameters that were missing from the text fields, + such as MAXLENGTH. + 6. A whole bunch of methods have been added to get at environment + variables involved in user verification and other obscure + features. + + Bug fixes + + 1. The problems with the hidden fields have (I hope at last) been + fixed. + 2. You can create multiple query objects and they will all be + initialized correctly. This simplifies the creation of multiple + forms on one page. + 3. The URL unescaping code works correctly now. diff --git a/lib/CGI/Cookie.pm b/lib/CGI/Cookie.pm index 3afeae22dd..a900ec0d7f 100644 --- a/lib/CGI/Cookie.pm +++ b/lib/CGI/Cookie.pm @@ -13,7 +13,7 @@ package CGI::Cookie; # wish, but if you redistribute a modified version, please attach a note # listing the modifications you have made. -$CGI::Cookie::VERSION='1.24'; +$CGI::Cookie::VERSION='1.25'; use CGI::Util qw(rearrange unescape escape); use overload '""' => \&as_string, @@ -26,7 +26,7 @@ if (exists $ENV{MOD_PERL}) { eval "require mod_perl"; if (defined $mod_perl::VERSION) { my $float = $mod_perl::VERSION; - $float = ~ s/^.+?([\d.]+).+$/$1/; + $float += 0; if ($float >= 1.99) { $MOD_PERL = 2; require Apache::RequestUtil; |