3605a3bec3use keep-alive timeout while waiting for HTTP headers; use always the read timeout while waiting for the HTTP bodyStefan Bühler2014-04-02 10:04:11 +00:00
e346794d59[auto* build] remove -no-undefined from linker flags, as we actually link modules with undefined symbols (fixes #2533)Stefan Bühler2014-01-10 12:05:02 +00:00
f0e5c1415d[core] decode URL before rewrite, enabling it to work in $HTTP["url"] conditionals (fixes #2526)Stefan Bühler2014-01-10 12:04:59 +00:00
17762fad01maintain physical.basedir (the "acting" doc-root as prefix of physical.path) in more placesStefan Bühler2014-01-10 12:04:57 +00:00
c8fbc16985[ssl] fix regression from CVE-2013-4508 (client-cert sessions were broken)Stefan Bühler2013-11-13 17:18:39 +00:00
1985df2a48add "packdist.sh" script to build (pre-) releasesStefan Bühler2013-11-10 13:41:12 +00:00
cb02c73860[autobuild] use autoreconf instead of calling tools manually; add generated files to .gitignoreStefan Bühler2013-11-10 13:41:09 +00:00
1af871fcef[ssl] fix SNI handling; only use key+cert+verify-client from SNI specific config (fixes #2525, CVE-2013-4508)Stefan Bühler2013-11-05 15:29:07 +00:00
3ce548c8d0remove unused members from struct server_socketStefan Bühler2013-11-05 15:29:04 +00:00
268c054c40[mod_extforward] fix compilation without IPv6, (not) using undefined var (fixes #2515, thx mm)Stefan Bühler2013-10-13 11:34:55 +00:00
29ff92d9ba[core] set signal handlers before forking child processes in modules/plugins_call_set_defaults (fixes #2502)Stefan Bühler2013-08-30 15:46:13 +00:00
916cf7cfc0[core] remove requirement that default doc-root has to exist, there are reasonable scenarios not requiring static files at allStefan Bühler2013-08-30 13:14:57 +00:00
f9d58670d5[auth] new method "extern" to use already present REMOTE_USER (from magnet, ssl, ...) (fixes #2436)Stefan Bühler2013-08-30 13:14:56 +00:00
2bcf65c285[mod_auth] some cleanup, only search for matching auth.require path onceStefan Bühler2013-08-30 13:14:54 +00:00
559b198f86[auth] put REMOTE_USER into cgi environment, making it accessible to lua via lighty.req_env (fixes #2495)Stefan Bühler2013-08-30 13:14:52 +00:00
6d4d2118c3[ssl] accept ssl renegotiations if they are not disabled (fixes #2491)Stefan Bühler2013-08-30 13:14:48 +00:00
292b8d621bmove ssl.disable-client-renegotiation and added note that it currently doesnt work inside conditionals
Marcus Rückert
2013-08-15 10:33:00 +00:00
f8e9462d2f[autoconf] pkg-config: search for lua5.1 and lua-5.1 before luaStefan Bühler2013-07-31 20:23:23 +00:00
05858f6cf2[ssl] Fix $HTTP["scheme"] conditional, could be "http" for ssl connections if the ssl $SERVER["socket"] conditional was nested (fixes #2501)Stefan Bühler2013-07-31 20:23:21 +00:00
25a3f2e826[network] use constants available at compile time for maximum number of chunks for writev instead of calling sysconf (fixes #2470)Stefan Bühler2013-06-29 12:46:02 +00:00
680b714543[cmake] Use TARGET_LINK_LIBRARIES instead of LINK_FLAGS for library dependencies, also add -Wl,--as-needed to extra warnings (fixes #2448)Stefan Bühler2013-06-29 09:45:23 +00:00
838d771550added mime type for json files
Marcus Rückert
2013-06-25 10:20:15 +00:00
c26b50d9ad[mod_auth] add htpasswd -s (SHA1) support if openssl is used (needs openssl for SHA1). This doesn't use any salt, md5 with salt is probably better.Stefan Bühler2013-04-29 13:08:25 +00:00
0342dfef1d[mod_auth] use crypt() on encrypted password instead of extracting salt first (fixes #2483)Stefan Bühler2013-04-29 13:08:23 +00:00
b5da12c008reject non ASCII characters in HTTP header namesStefan Bühler2013-03-25 17:22:36 +00:00
25a2d665aacall ERR_clear_error only for ssl connections in CON_STATE_ERRORStefan Bühler2013-03-25 17:22:34 +00:00
543bd249fbfix handling of If-Modified-Since if If-None-Match is present (don't return 412 for date parsing errors); follow current draft for HTTP/1.1, which tells us to ignore If-Modified-Since if we have matching etags.Stefan Bühler2013-01-22 13:08:21 +00:00
9cd8faa1b6mod_fastcgi: fix mix up of "mode" => "authorizer" in other fastcgi configs (fixes #2465, thx peex)Stefan Bühler2013-01-04 13:54:38 +00:00
6edfc40f93fix DoS in Connection header value split (reported by Jesse Sipprell, CVE-2012-5533)Stefan Bühler2012-11-21 12:01:44 +00:00
6200764f05tests: check different combination of empty values, leading/trailing spaces and commas in the Connection headerStefan Bühler2012-11-21 12:01:42 +00:00
29b126d5d3mod_extforward: log address of untrusted proxy with debug.log-request-handlingStefan Bühler2012-11-15 08:44:10 +00:00
Stefan Bühler
Marcus Rückert