forked from lighttpd/lighttpd1.4
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathNEWS
2006 lines (1856 loc) · 103 KB
/
NEWS
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
====
NEWS
====
- 1.4.51
- 1.4.50 - 2018-08-13
* [mod_extforward] allow explict IPs to be untrusted (#2860)
* [core] fix crash if 'host' empty in config (fixes #2876)
* [mod_magnet] fix regression in lighty.stat (fixes #2877)
* [core] minor code cleanup in gw_recv_response()
* [core] fix rare race condition from backends (fixes #2878)
* [mod_proxy] fix segfault in Set-Cookie reverse map (fixes #2879)
* [core] fdevent_accept_listenfd() nonblock cloexec
* [build] remove m4 AC_PATH_PROG for PKG_CONFIG
* [core] some header cleanup
* [mod_wstunnel] better Sec-WebSocket-Protocol parse
* [mod_magnet] code reuse
* [mod_magnet] reduce buffer copies
* [mod_fastcgi,mod_scgi] fastcgi.balance,scgi.balance (fixes #2882)
* [core] check if SOCK_NONBLOCK is ignored (fixes #2883)
* [core] buffer_append_string_encoded_hex_lc()
* [core] more efficient hex2int()
* [mod_secdownload] compare bin MAC instead of hex
* [core] li_tohex_lc() explicitly uses lc hex chars
* [core] buffer_append_uint_hex_lc() uses lc hex
* [core] buffer_append_string_encoded() uc hex
* [tests] reduce test_base64 brute force tests
* [tests] remove test_buffer output, except on error
* [core] check for continuation in server.tag
* [core] CONNECT must be handled before fs hooks
* [mod_redirect, mod_rewrite] code reuse (sharing)
* [core] data_config_pcre_compile,exec()
* [tests] test_request unit tests
* [core] http_kv.[ch] method, status, version str
* [core] remove unused get_http_status_body_name()
* [core] remove proc_open.[ch], reduce stdio.h use
* [tests] move src/test_*.c to src/t/
* [core] server.http-parseopts URL normalization opt (fixes #1720)
* [core] inline some buffer.[ch] routines
* [core] remove some duplicative code in log.c
* [core] debug server.log-request-header-on-error
* [mod_redirect,mod_rewrite] short-circuit earlier
* [core] fix buffer_to_upper()
* [mod_cgi] handle CGI partial response header write
* [mod_redirect,mod_rewrite] pass request URI info
* [mod_redirect,mod_rewrite] encoding options (fixes #443, fixes #911)
* [mod_redirect,mod_rewrite] fix segfault w/ invalid syntax (fixes #2892)
* [mod_fastcgi] fix memleak with FastCGI auth,resp (fixes #2894)
* [mod_alias] security: potential path traversal with specific configs
* [mod_wstunnel] quiet 32-bit compiler warnings
* [core] POLLRDHUP handling for transparent proxying
* [mod_redirect,mod_rewrite] support up to 19 match
* [core] add missing includes to quiet compiler warn
* [mod_redirect,mod_rewrite] base64url encoding opt
* [mod_rewrite] require rewrite result to begin '/'
* [core] security: use-after-free invalid Range req
* [core] reset var if FAMMonitorDirectory() fails
* [core] option to propagate TCP FIN to backend host
* mod_sockproxy - socket forwarding
* [core] workaround Coverity cov-build bug with gcc7
* [build] add missing file for test_burl
* [core] quell insignificant coverity warning
* [core] extend server.http-parseopts
* [mod_alias] security: path traversal in mod_alias (in some use cases) (fixes #2898)
* [core] security: use-after-free after invalid Range request (fixes #2899)
- 1.4.49 - 2018-03-11
* [core] adjust offset if response header blank line
* [mod_accesslog] %{canonical,local,remote}p (fixes #2840)
* [core] support POLLRDHUP, where available (#2743)
* [mod_proxy] basic support for HTTP CONNECT method (#2060)
* [mod_deflate] fix deflate of file > 2MB w/o mmap
* [core] fix segfault if tempdirs fill up (fixes #2843)
* [mod_compress,mod_deflate] try mmap MAP_PRIVATE
* [core] discard from socket using recv MSG_TRUNC
* [core] report to stderr if errorlog path ENOENT (fixes #2847)
* [core] fix base64 decode when char is unsigned (fixes #2848)
* [mod_authn_ldap] fix mem leak when ldap auth fails (fixes #2849)
* [core] warn if mod_indexfile after dynamic handler
* [core] do not reparse request if async cb
* [core] non-blocking write() to piped loggers
* [mod_openssl] minor code cleanup; reduce var scope
* [mod_openssl] elliptic curve auto selection (fixes #2833)
* [core] check for path-info forward down path
* [mod_authn_ldap] auth with ldap referrals (fixes #2846)
* [core] code cleanup: separate physical path sub
* [core] merge redirect/rewrite pattern substitution
* [core] fix POST with chunked request body (fixes #2854)
* [core] remove unused func
* [doc] minor update to *outdated* doc
* [mod_wstunnel] fix for frames larger than 64k (fixes #2858)
* [core] fix 32-bit compile POST w/ chunked request body (#2854)
* [core] add include sys/poll.h on Solaris (fixes #2859)
* [core] fix path-info calculation in git master (fixes #2861)
* [core] pass array_get_element_klen() const array *
* [core] increase stat_cache abstraction
* [core] open additional fds O_CLOEXEC
* [core] fix CONNECT w strict header parsing enabled
* [mod_extforward] CIDR support for trusted proxies (fixes #2860)
* [core] re-enable overloaded backends w/ multi wkrs
* [autoconf] reduce minimum automake version to 1.13
* [mod_auth] constant time compare plain passwords
* [mod_auth] check that digest realm matches config
* [core] fix incorrect hash algorithm impl
- 1.4.48 - 2017-11-11
* [mod_webdav] fix crash if stat fails, not ENOENT
* [core] fix build --disable-ipv6 (fixes #2832)
* [scons] Merge branch 'personal/stbuehler/scons-cleanup'
* [autobuild] Merge branch 'personal/stbuehler/autobuild-cleanup'
* [meson] new build system
* [core] fix var.CWD (regression in 1.4.46) (fixes #2835)
* [core] fix implicit wildcard IPv4 and IPv6 listen
* [autobuild] remove obsolete warning about mmap use
* [core] isolate sock_addr manipulation
* [stat_cache] remove debug code littered in file
* [core] cleanup unused ifndef
* [core] cleanup: consolidate FAM code in stat_cache
* [core] consolidate backend network write handlers
* [autobuild] allow sendfile() in cross-compile (fixes #2836)
* [core] quiet pedantic cc warning for excess comma
* [core] isolate backend fdevent handler defs
* [mod_openssl] error if ssl.engine in wrong section (fixes #2837)
* [core] fix lighttpd -1 one-shot graceful shutdown
* [mod_cgi] quiet trace if mod_cgi sends SIGTERM (fixes #2838)
* [build] fix link of test_configfile.c
* [core] quiet coverity false positive
* [mod_openssl] more pedantic check of return values
* [mod_openssl] allow specifying server cert chain (fixes #2692)
* [mod_openssl] ssl.openssl.ssl-conf-cmd (fixes #2758)
* [doc] NEWS - fix improper format line breaks
* [mod_authn_ldap] replace use of deprecated funcs
* [mod_authn_sasl] SASL auth (new) (fixes #2275)
* [mod_openssl] quiet trace from TCP probes (#2784)
* [core] fix dup typedef compiler warning
* [scons] fix various python2/3 incompatibilities
* [doc] fix doc/config/conf.d/fastcgi.conf example
- 1.4.47 - 2017-10-22
* [mod_authn_gssapi] needs -lcom_err under Darwin
* [core] stricter validation of request-URI begin
* [core] fix 1.4.46 regression in config match (fixes #2830)
* [core] normalize config addrs for != match (#2830)
* [core] normalize config addrs for eq and ne (#2830)
* [doc] use https:// URLs to .lighttpd.net resources
* [core] fix 1.4.46 regression in Last-Modified
- 1.4.46 - 2017-10-21
* [TLS] mark code that uses -lcrypto but not -lssl
* remove redundant calls to end-of-request hooks
* [mod_mysql_vhost] remove dev debug code
* [core] con interface for read/write; isolate SSL
* [core] new plugin hooks to help isolate SSL
* [mod_openssl] new module (preliminary layout)
* [core] move network_open_file_chunk() to chunk.c
* [mod_openssl] move openssl code into mod_openssl
* [mod_openssl] move openssl config into mod_openssl
* [core] move connection_read_cq() to connections.c
* [mod_geoip] call from handle_request_env hook
* [build] only mod_openssl depends on -lssl
* [mod_auth] enable optional authz if extern authn (fixes #2481)
* [mod_openssl] allow ssl.verifyclient on url paths (fixes #2245)
* [core] do not emit req/response hdrs w/ blank val
* [mod_setenv] directives to overwrite/remove hdrs (fixes #650, fixes #2295)
* [mod_secdownload] new directives modify hash path (fixes #646, fixes #1904)
* [core] move con throttling to connections-glue.c
* [core] support Expect: 100-continue with HTTP/1.1 (fixes #377, #1017, #1953, #2438)
* [mod_openssl] use TLS SNI to set host-based certs
* [mod_ssi] send #exec cmd="..." output to temp file
* [mod_scgi] tests/mod-scgi.t unit tests
* [mod_auth] support LDAP groups for HTTP auth (fixes #1817)
* [core] use getaddrinfo,inet_pton vs gethostbyname (fixes #2783)
* [mod_auth] LDAP escape username in DN and filters
* mod_vhostdb* (dbi,mysql,pgsql,ldap) (fixes #485, fixes #1936, fixes #2297)
* [mod_auth] have LDAP template replace '?'
* apply debian/patches/spelling.patch
* [core] permit connection-level state in modules
* [TLS] include <openssl/opensslv.h> in rand.c
* [core] config match w/ arbitrary HTTP request hdrs (fixes #1556)
* [mod_flv_streaming] add end pos param (fixes #1887)
* [core] X-LIGHTTPD-KBytes-per-second from backends (fixes #954)
* [core] improve accuracy of bandwidth write limits
* [core] quicker graceful shutdown
* [tests] remove unused file depending on CGI.pm
* [doc] doc/initscripts.txt (fixes #2782)
* [core] check issetugid() early in main()
* [core] combine duplicated getrlimit, network_init
* [core] move interval timer near worker event loop
* [core] initialize globals at top of main()
* [core] graceful restart with SIGUSR1 (fixes #2785)
* [mod_authn_mysql] fix minor memleak at shutdown
* [mod_rrdtool] no error if loaded but no config
* [doc] SIGUSR1 doc and lighttpd-angel SIGUSR1
* [mime.conf] add text/markdown to utf-8 list, regenerate mime.conf
* [mod_cgi] RFC3875 CGI local-redir strict adherence (#2108)
* [mod_cgi] do not send "Status" back to client
* [core] add label for 308 Permanent Redirect
* [mod_openssl] inherit ssl.* from global scope
* [core] handle if backend sends Transfer-Encoding (#2786)
* [core] use kqueue in level-triggered mode (fixes #2788)
* [mod_fastcgi,mod_scgi] backend spawn EINTR retry (#2788)
* [core] config opt to intercept dynamic handler err (fixes #974)
* [core] set default server_tag in server.c
* [core] include lighttpd vers in server started msg
* [core] move version.h logic into server.c
* [core] issue trace if max-fds too large (fixes #2789)
* [mod_fastcgi,mod_scgi] consistent waitpid handling (fixes #2791)
* [mod_cgi] fix CGI local-redir w/ url.rewrite-once (fixes #2793)
* [mod_scgi] fix unused_procs bidirectional-links
* [mod_scgi] fix potential repeated use of proc->id
* [mod_fastcgi,mod_scgi] consolidate backend process accounting (#2788)
* [mod_cgi] status 200 OK if no hdrs (deprecated) (#2786)
* [core] fix regex condition subst w/ mod_extforward (fixes #2794)
* [tests] correct skip count for mod-scgi.t
* [mod_vhostdb_ldap] fix inverted logic (coverity)
* [mod_cgi] cgi.local-redir = [enable|disable] (#2108, #2793)
* [core] $REQUEST_HEADER[...] subsumes other config (#1556)
* [mod_usertrack] usertrack.cookie-attrs config opt (fixes #2795)
* [core] default server.max-fds=4096 if unspecified (#2789)
* update .gitignore, add .gitattributes
* [core] reduce con allocation for small max_conns
* [config] more specific checks for array lists
* [mod_authn_gssapi] needs -lcom_err under cygwin
* [mod_cgi,fastcgi,scgi,proxy] fix streaming response (fixes #2796)
* [mod_auth] Digest nonce on system with time <=1978
* [doc] simple-vhost.debug takes an integer value (fixes #2797)
* [core] fix crash if invalid config file (fixes #2798)
* [core] remove unused member con->in_joblist
* [mod_proxy] remove use of con->got_response
* [core] consolidate dynamic handler response parse
* [core] remove now-unused buffer_search_string_len
* [mod_cgi] eliminate warning when compiled -Os
* [mod_scgi] do not reconnect after connect succeeds
* [tests] reduce time waiting for backends to start
* [core] server.syslog-facility (fixes #2800)
* [core] server.syslog-facility (use -1 for unset) (#2800)
* [core] allow overriding prior config values (fixes #2799)
* [mod_proxy] set Content-Length, if available
* [mod_proxy] set X-Forwarded-Host (fixes #418)
* [core] remove redundant Content-Length digit check
* [core] remove some unused header includes
* [core] use con->dst_addr_buf instead of ip recalc
* [core] include "fdevent.h" where needed
* [core] make stat_cache private to stat_cache.c
* [core] collect ioctl FIONREAD code
* [core] include <netdb.h> where needed
* [core] report file path when mkstemp() fails (fixes #2802)
* [core] export http_request_host_policy() for reuse
* [mod_extforward] simplify header search
* [mod_extforward] consolidate ipstr_to_sockaddr()
* [mod_extforward] upd scheme after ipstr validated
* [mod_extforward] rearrange code; prep Forwarded
* [mod_extforward] support Forwarded HTTP Extension (#2703)
* [mod_proxy] support Forwarded HTTP Extension (fixes #2703)
* [core] inet_pton(), inet_ntop() on (sock_addr *)
* [core] save connection-level proto in con->proto
* [mod_extforward] support HAProxy "PROXY" protocol (fixes #2804)
* [mod_extforward] fix typos in Forwarded handling
* [core] fix stat_cache initialization error
* [core] perf: stat_cache_mimetype_by_ext()
* [core] inet_ntop_cache now 4-element cache
* [mod_openssl] free local_send_buffer at exit
* [core] extend mimetype search w/o leading '.'
* [core] no SOCK_CLOEXEC on Linux kernel < 2.6.27
* [core] inline simple buffer is empty checks
* [core] buffer_substr_replace()
* [core] sys-strings.h abstraction for strings.h
* [mod_proxy] fix backslash escaping
* [core] omit default port from normalized host str
* [core] fix build issue without ipv6 support
* [core] permit strings and integers in config array
* [mod_accesslog] flag high precision ts for %T (fixes #2807)
* [core] permit strings,ints,arrays in config array
* [core] calloc plugin_config for consistent init
* [mod_proxy] simple host/url mapping in headers (fixes #152)
* [mod_uploadprogress] handle query str progress ID (fixes #2808)
* [mod_fastcgi] consolidate backend read code
* [mod_proxy,mod_scgi] fix truncated error trace
* [core] skip socket shutdown() if con->fd negative
* [core] act as transparent proxy after con Upgrade
* [core] remove redundant resets of fde_ndx
* [core] configparser: fix resource handling in error cases (fixes #2809)
* [core] fix crash for invalid syntax in config file (fixes #2810)
* [core] prep mod transitions to transparent proxy
* [mod_proxy] basic support for Upgrade: websocket (fixes #2811)
* [mod_extforward] compile on OSX
* [core] set server.max-keep-alive-requests = 100 (fixes #2205)
* [core] perf: skip redundant strlen() if len known
* [core] optional condition in config "else" clause (fixes #1268)
* [mod_cgi] basic support for Upgrade: websocket
* [core] buffer to disk streaming to slow backends
* [core] silence compiler warnings if !HAVE_FORK
* [build] -Werror if --enable-extra-warnings=error
* [build] autotools use AC_PROG_CC_STDC macro
* [mod_openssl] ssl.ca-crl-file for CRL (fixes #2319)
* [mod_openssl] ssl.ca-dn-file (fixes #2694)
* [mod_proxy] fix typo identified by coverity
* [mod_openssl] ignore client verification error if not enforced
* [mod_openssl] fix compile with openssl 1.1.0
* [mod_extforward] quiet clang compiler warning
* [mod_dirlisting] sort "../" to top of names
* [mod_openssl] safer_X509_NAME_oneline() (fixes #2693)
* [core] allow earlier plugin init for SSL/TLS
* [mod_openssl] adjust use of ssl.ca-dn-file
* [core] fix compiler warnings on Mac OS X
* [core] server.socket-perms to set perms on unix (fixes #656)
* [core] get port from sock_addr if AF_INET,AF_INET6
* [core] server.error_handler_404 X-Sendfile ENOENT (#2474)
* [core] consolidate fork()/execve() code (#1393)
* [core] mv log_error_{open,cycle.close} to server.c
* [core] rename fd_close_on_exec()
* [core] remove unused includes of stat_cache.h
* [core] add missing include of stdlib.h
* [core] reduce exposure of unistd.h, other includes
* [core] sock_addr_from_str_hints reusable name res
* [core] continue collecting use of netdb.h
* [core] continue collecting use of netdb.h
* [core] continue collecting use of netdb.h
* [core] fdevent_connect_status() shared code
* [core] add const to reduce .data segment size
* [mod_proxy] move data_fastcgi into mod_proxy.c
* [mod_proxy] store address family at config time
* [mod_fastcgi] slightly simplify counters
* [mod_fastcgi] consolidate connect() error handling
* [mod_fastcgi] set request_id in fcgi_create_env()
* [mod_fastcgi] move delayed connect() into switch()
* [mod_fastcgi,mod_scgi] consistent connect() error
* [mod_scgi] remove unused parse_response member
* [mod_fastcgi,mod_scgi] struct member consistency
* [mod_fastcgi,mod_scgi] parse bin_path at startup
* [mod_fastcgi,mod_scgi] use temp buffer for cgi_env
* [core] shared code for socket backends
* [core] spread load on socket backend procs
* [core] store sockaddr for socket backend procs
* [core] resolve DNS at startup for socket backends
* [core] adaptive spawning for socket backend procs (fixes #1162)
* quell compiler warnings for -Wimplicit-fallthrough
* [doc] update README
* [core] fdevent_cycle_logger()
* [core] reap lighttpd worker pids precisely
* [core] restart piped loggers if they exit (fixes #1393)
* [mod_webdav] PROPFIND getetag attr must match GET
* [core] consistent behavior w/ and w/o SA_SIGINFO
* [core] do not remove pid-file in test mode
* [core] add public domain SHA1() if no crypto
* [mod_wstunnel] websocket tunnel to other protocol
* [core] forward SIGHUP only to lighttpd workers
* [mod_dirlisting] treat README and HEADER as paths (fixes #2818)
* [core] set one-shot mode fd O_NONBLOCK, FD_CLOEXEC
* [core] remove fdevent fcntl_set hook
* [mod_extforward] typo in comment
* [mod_cgi] add missing #include
* [core] fix invalid sizeof() identified by coverity
* [core] add missing #include
* [core] base_decls.h to quiet compiler warnings
* [core] set socket perms after bind, before listen
* [core] warn if backend server config contains '_'
* [mod_extforward] PROXY proto and SSL_CLIENT_VERIFY
* [core] workaround for AIX mmap define
* [mod_accesslog] flush access logs every 4 seconds
* [mod_cgi] fix bug to properly exec interpreter
* [mod_fastcgi] fix return when streaming min buffer
* [core] attempt to quiet coverity false positives
* [core] attempt to quiet coverity false positives
* [core] attempt to quiet compiler warning in LEDE
* [core] SIGCHLD handle_waitpid hook for modules
* [mod_rrdtool] handle_trigger returns HANDLER_GO_ON
* [mod_openssl] ssl.read-ahead="disable" for stream
* [mod_cgi] add FDEVENT_IN upon CGI exit
* [mod_cgi] omit cgi_handle_fdevent after proc exit
* [mod_webdav] check HAVE_UUID for -luuid
* [core] adjust li_rand_pseudo* interfaces
* [mod_wstunnel] fix config parsing bug
* [core] fdevent setsockopt() helper functions
* [core] make strftime_cache_get() 16-element cache
* [core] disable Nagle if streaming to backend
* [core] fix triggered assert on HTTP chunked input (fixes #2822)
* [mod_wstunnel] fix NULL ptr deref
* [algo_sha1] fix compile break and warnings
* [lemon] fix gcc implicit-fallthrough warning
* [core] URI scheme is case-insensitive
* [network] do not append port to unix socket paths
* [unittests] consolidate base64 test code
* [core] use sun_path for addr string for AF_UNIX (fixes #2826)
* [core] cleaner code; remove goto from network.c
* [core] /dev/stdin listener for inetd wait yes
* [core] compare listen addrs after DNS resolution
* [core] inline chunkqueue_is_empty()
* [core] limit use of TCP_CORK
* [core] return from http_response_read if small rd
* [core] gateways might Upgrade con before body read
* [mod_wstunnel] set Sec-WebSocket-Protocol if bin
* [mod_wstunnel] remove invalid appended '\0'
* [core] quiet coverity warning
* [core] handle fds pending close after poll timeout (fixes #2827)
* [core] fix $REQUEST_HEADER[...] parsing in config (#1556)
* [mod_dirlisting] custom js date parse func (fixes #2823)
* [core] remove fd interest if create_env returns
* [mod_openssl] copy data for larger SSL packets
* [mod_openssl] remove erroneous SSL_set_shutdown()
* [core] permit LF to end lines if !header-strict
* [core] add back REQUEST_SCHEME for backends
* [core] remove fdevent_sched_run from fdevent_libev (#2827)
* [mod_openssl] ssl.read-ahead="disable" by default
* [core] adjust parser for valid variable expansion
* [cmake] handle WITH_WEBDAV_LOCKS option
* [cmake] fix attr header detection and linking
* [cmake] link mod_cml with memcached
* [core] reproducible build: hide __DATE__ __TIME__ (fixes #2828)
* [core] perf: more efficient fdevent_sched_run()
* [core] translate DNS to IP str for cond socket cmp
- 1.4.45 - 2017-01-14
* [mod_cgi] skip local-redir handling if to self (fixes #2779, #2108)
* [mod_webdav] fix crash when plugin_ctx cleaned up (fixes #2780)
* [mod_fastcgi] detect child exit, restart proactively
* [mod_scgi] detect child exit, restart proactively
* [TLS] ssl.read-ahead = "disable" for low mem (fixes #2778)
- 1.4.44 - 2016-12-24
* [mod_scgi] fix segfault (fixes #2762)
* [mod_authn_gssapi] fix memory leak
* [config] warn if mod_authn_ldap,mysql not listed
* [mod_magnet] fix magnet_cgi_set() set of env vars (fixes #2763)
* [mod_cgi] FreeBSD 9.3/MacOSX does not have pipe2() (fixes #2765)
* [mod_extforward] fix crash on invalid IP (fixes #2766)
* [mod_fastcgi] fix segfault if all backends down (fixes #2768)
* [mod_cgi] fix out of sockets error for POST to CGI (fixes #2771)
* [mod_auth] compile fix for Mac OS X XCode (fixes #2772)
* [mod_authn_gssapi] better resource cleanup
* [core] compile fix for Mac OS X 10.6 (old) (fixes #2773)
* fix race in dynamic handler configs (reentrancy) (fixes #2774)
* [mod_authn_mysql] close mysql_conn in cleanup
* [mod_webdav] compile fix when locking not enabled
* load mod_auth & mod_authn_file in sample/test.conf
* comment out auth.backend.ldap.* in tests/*.conf
* [mod_fastcgi,mod_scgi] warn if invalid "bin-path"
* RAND_pseudo_bytes() is deprecated in openssl 1.1.0
* openssl 1.1.0 init and cleanup
* [mod_cgi] remove direct calls to network_backend*
* [build] build network_*.c into lighttpd executable
* suggest inclusion of mod_geoip... before mod_ssi.
* set systemd settings similar to lighttpd2
* [doc] remove reference to Linux rt-signals
* [mod_authn_gssapi] fix missing error ret, coverity
* [core] rename li_rand() to li_rand_pseudo_bytes()
* remove #include "stream.h" where not used
* [mod_cml] include lua headers before base.h
* [core] combine duplicated connection reset code
* [mod_ssi] produce content in subrequest hook
* [core] remove srv->entropy[]
* [core] defer li_rand_init() until first use
* [core] permit connection-level state in modules
* [mod_dirlisting] render dirlisting as HTML (fixes #2767)
* [mod_proxy] replace HTTP Host sent to backend (fixes #2770)
* [mod_ssi] basic recursive SSI include virtual (fixes #536)
* [mod_ssi] implement, ignore <!--#comment ... -->
* [core] consolidate duplicated read-to-close code
* [core] fix segfault when parsing a bad config file
* [core] support Transfer-Encoding: chunked req body (fixes #2156)
* [autobuild] set NO_RDYNAMIC=yes for midipix
* [mod_proxy] proxy.balance = "sticky" option (fixes #2117)
* [mod_secdownload] warn if SHA used w/o SSL crypto
* [build] compile fixes for AIX
* [build] check for pipe2() at configure time
* [mod_evhost] fix an incorrect error trace
* [tests] mark tests/docroot/www/*.pl scripts a+x
* [mod_cgi] fall back to pipe() if pipe2() fails
* fix SCons fullstatic build with glibc pthreads
* [TLS] openssl 1.1.0 makes SSL_OP_NO_SSLv2 no-op
- 1.4.43 - 2016-10-31
* [autobuild] remove mod_authn_gssapi dep on resolv
* [mod_deflate] ignore '*' in deflate.mimetypes
* [autobuild] omit module stubs when missing deps
* [TLS] openssl 1.1.0 hides struct bignum_st
* [autobuild] move http_cgi_ssl_env() for Mac OS X (fixes #2757)
* [core] use paccept() on NetBSD (replace accept4())
* [TLS] remote IP conditions are valid for TLS SNI (fixes #2272)
* [doc] lighttpd-angel.8 (fixes #2254)
* [cmake] build fcgi-auth, fcgi-responder for tests
* [mod_accesslog] %{ratio}n logs compression ratio (fixes #2133)
* [mod_deflate] skip deflate if loadavg too high (fixes #1505)
* [mod_expire] expire by mimetype (fixes #423)
* [mod_evhost] partial matching patterns (fixes #1194)
* build: use CC_FOR_BUILD for lemon when cross-compiling
* [mod_dirlisting] config header and readme files
* [config] warn if mod_authn_ldap,mysql not listed
* fix FastCGI, SCGI, proxy reconnect on failure
* [core] network_open_file_chunk() temp file opt
* [mod_rewrite] add more info in error log msg
* [core] fix fd leak when using libev (fixes #2761)
* [core] fix potential streaming tempfile corruption (fixes #2760)
* [mod_scgi] fix prefix matching to always match url
* [autobuild] adjust Makefile.am for FreeBSD
* [build] move some build scripts to scripts/
* [autotools] fix configure.ac for opensuse 13.2
- 1.4.42 - 2016-10-16
* [TLS] SSL_shutdown() only if handshake finished
* [mod_proxy,mod_scgi] shutdown remote only if local (#2743)
* [core] check if client half-closed TCP if POLLHUP (#2743)
* [core] enforce wait for POLLWR after EINPROGRESS (fixes #2744)
* [core] do not enter handler twice after read body
* [core] proxy,scgi omit shutdown() to backend (fixes #2743)
* [mod_dirlisting] dirlist does not handle POST
* [mod_dirlisting] js column sort for dirlist table (fixes #613, fixes #2315)
* [mod_auth] Digest auth fails after rewrite (fixes #2745)
* [mod_auth] refactor out auth backend code
* [mod_auth] extensible interface for auth backends
* [core] better DragonFlyBSD support (fixes #2746)
* [mod_auth] include base.h for USE_OPENSSL def
* [mod_auth] support CRYPT-MD5-NTLM algorithm (fixes #1743)
* [mod_auth] terminate salt for CRYPT-MD5-NTLM
* [core] fix crash if ready events on abandoned fd (fixes #2748)
* [mod_auth] http_auth_md5_hex2bin()
* [mod_auth] remove empty mod_auth.h
* [mod_auth] mod_authn_mysql.c MySQL auth backend (fixes #752, fixes #1845)
* [mod_cgi] permit CGI exec of unreadable files (fixes #2374)
* [mod_uploadprogress] add to default build
* [mod_geoip] add to default build (fixes #2705, fixes #2101, fixes #2092, fixes #2025, fixes #1962, fixes #1938)
* [mod_fastcgi] Authorizer support with Responder (fixes #321, fixes #322)
* [tests] test coverage for issues (#321, #322)
* dynamic handlers store debug flag in handler_ctx
* [mod_fastcgi] allow authorizer, responder for same path/ext (#321)
* backport mod_deflate to lighttpd 1.4 (fixes #1824, fixes #2753)
* [autobuild] test_configfile might need vector.c (fixes #2752)
* [mod_deflate] fix longjmp clobber compiler warning
* remove unused array type TYPE_COUNT data_count
* [mod_auth] structured data, register auth schemes
* [mod_auth] mod_authn_gssapi Kerberos auth backend (fixes #1899)
* [autobuild] skip two new tests if no fcgi-auth
* [SCons] define with_krb5 for SCons build
* [SCons] fix syntax error in SConstruct
* [SCons] define with_geoip for SCons build
* [CMake] fix clang -Wcast-align warnings in lemon.c
* remove excess initializers (fix compiler warnings)
* fix errors detected by Coverity Scan
* performance: use Linux extended syscalls and flags
* [mod_scgi] add uwsgi protocol support
* [mod_auth] refactor LDAP code into smaller funcs
* [mod_auth] HTTP Basic auth backends also do authz (#1817)
* [mod_auth] ldap filter subst user for multiple '$' (fixes #1508)
* [mod_auth] permit specifying ldap DN; skip search (fixes #1248)
* [autobuild] update module/feature report
* [cmake] build mod_authn_gssapi if WITH_KRB5
* [mod_auth] fix printing of IP in error trace
* [mod_mysql_vhost] support multiple '?' replacement (fixes #2163)
* [core] make server.max-request-size scopeable (#1901)
* [core] server.max-request-field-size (fixes #2130)
* [core] optional condition in config "else" clause (fixes #1268)
* [core] restrict where config "else" clauses occur (#1268)
* silence warnings from clang ccc-analyzer
* consistent, shared code to create CGI env
* [TLS] replace env entries in https_add_ssl_entries
* [TLS] set SSL_CLIENT_M_SERIAL w/ client cert SN (fixes #2268)
* [TLS] set SSL_CLIENT_VERIFY w/ client cert (#1288, #2693)
* [TLS] set SSL_PROTOCOL, SSL_CIPHER* (fixes #2511)
* [core] rand.[ch] to use better RNGs when available
* [mod_cgi] fix pipe_cloexec() when no O_CLOEXEC
* ignore return value from fcntl() FD_CLOEXEC
* build w/o compiler warnings if no zlib or bz2lib
- 1.4.41 - 2016-07-31
* remove long-deprecated, non-functional config opts
* [config] inherit server.use-ipv6 and server.set-v6only (fixes #678)
* [mod_auth] fix Digest auth to be better than Basic (fixes #1844)
* [mod_ssi] fix #config sizefmt="bytes"
* [autobuild] move inet_pton detection later
* [core] #include <sys/filio.h> for FIONREAD (fixes #2726)
* [autobuild] clock_gettime() -lrt with glibc < 2.17
* [security] do not emit HTTP_PROXY to CGI env
* [build_cmake] clock_gettime() -lrt w/ glibc < 2.17 (fixes #2737)
* [core] avoid spurious trace and error abort
* [core] stay in CON_STATE_CLOSE until done with req
* [core] $HTTP["remoteip"] must handle IPv6 w/o []
* [mod_status] show keep-alive status w/ text output (fixes #2740)
* do not set REDIRECT_URI in mod_magnet, mod_rewrite (#2738)
* revert 1.4.40 swap of REQUEST_URI, REDIRECT_URI (fixes #2738)
* [core] permit IPv6 address scope identifier
* [TLS] better handling of SSL_ERROR_WANT_READ/WRITE
* [TLS] read all available records from SSL_read()
* [core] try AF_INET after AF_INET6 if use-ipv6
* [core] set chunkqueue tempdirs at startup
* [security] ensure gid != 0 if server.username set (fixes #2725)
* [security] disable stat_cache if !follow-symlink (fixes #2724)
* [core] fix buffer_copy_string_hex() assert (fixes #2742)
* [security] encode quoting chars in HTML and XML
* [cmake] always define _GNU_SOURCE
* [cmake] enable warnings for GCC and Clang
* [cmake] set cmake_minimum_required to 2.8.2
- 1.4.40 - 2016-07-16
* [mod_ssi] enhance support for ssi vars (thx fbrosson)
* add handling for lua 5.2 and 5.3 (fixes #2674)
* use libmemcached instead of deprecated libmemcache
* add force_assert for more allocation results
* [mod_cgi] use MAP_PRIVATE to mmap temporary file (fixes #2715)
* [core] do not send SIGHUP to process group unless server.max-workers is used (fixes #2711)
* [mod_cgi] edge case chdir "/" when docroot "/" (fixes #2460)
* [mod_cgi] issue trace and exit if execve() fails (closes #2302)
* [configparser] don't continue after parse error (fixes #2717)
* [core] never evaluate else branches until the previous branches are ready (fixes #2598)
* [core] fix conditional cache handling
* [core] improve conditional enabling (thx Gwenlliana, #2598)
* [mod_compress] case-insensitive content-codings (fixes #2645)
* [plugins] don't include dlfcn.h if not needed (fixes #2548)
* [mod_fastcgi] 404 for X-Sendfile file not found (fixes #2474)
* [mod_cgi] send 500 if CGI ends and there is no response (fixes #2542)
* [mod_cgi] consolidate CGI cleanup code
* [mod_cgi] simplify mod_cgi_handle_subrequest()
* [mod_cgi] kill CGI if fail to write request body
* [mod_proxy] use case-insensitive comparision to filter headers, send Connection: Close to backend (fixes #421)
* [mod_dirlisting] dir-listing.hide-dotfiles = "enabled" by default (fixes #1081)
* [mod_secdownload] fix buffer overflow in secdl_verify_mac (reported by Fortify Open Review Project)
* [mod_fastcgi,mod_scgi] fix leaking file-descriptor when backend spawning failed (reported by Fortify Open Review Project)
* [core] improve array API to prevent memory leaks
* [core] refactor array search; raise array size limit to SSIZE_MAX
* [core] fix memory leak in configparser_merge_data
* [core] provide array_extract_element and use it
* [core] configparser: error on duplicate keys in array merge (fixes #2685)
* [core] more careful parse of $SERVER["socket"] config str (prepare #2204)
* [core] accept $SERVER["socket"] without port, use server.port as fallback (fixes #2204)
* [mod_magnet] define lua_pushglobaltable (for lua5.1) and use it (fixes #2719)
* [ssl] support disabling ssl.verifyclient.activate in SNI callback (fixes #2531)
* restart (some) syscalls after SIGCHLD interrupted them; should fix LDAP problems (fixes #2464)
* [core] log remote address on request timeouts (fixes #652)
* [autobuild] use AC_CANONICAL_HOST instead of AC_CANONICAL_TARGET (fixes #1866)
* [core] fix request_start in keep-alive requests to mark time when received first byte (fixes #2412)
* [core] truncate pidfile on exit (fixes #2695)
* consistent inclusion of config.h at top of files (fixes #2073)
* [core] add generic vector implementation
* [core] replace array weakref with vector
* [base64] fix crash due to broken force_assert
* [unittests] add test_buffer and test_base64 unit tests
* [buffer] refactor buffer_path_simplify (fixes #2560)
* validate return values from strtol, strtoul (fixes #2564)
* [mod_ssi] Add SSI vars SCRIPT_{URI,URL} and REQUEST_SCHEME (fixes #2721)
* [config] warn if server.upload-dirs has non-existent dirs (fixes #2508)
* [mod_proxy] accept LF delimited headers, not just CRLF (fixes #2594)
* [core] wait for grandchild to be ready when daemonizing (fixes #2712, thx pasdVn)
* [core] respond 411 Length Required if request has Transfer-Encoding: chunked (fixes #631)
* [core] fixed the loading for default modules if they are specified explicitly
* [core] lighttpd -tt performs preflight startup checks (fixes #411)
* [stat] mimetype.xattr-name global config option (fixes #2631)
* [mod_webdav] allow Depth: Infinity lock on file (fixes #2296)
* [mod_status] use snprintf() instead of sprintf()
* pass buf size to li_tohex()
* use li_[iu]tostrn() instead of li_[iu]tostr()
* [stream] fstat() after open() to obtain file size
* [core] clean up srv before exiting for lighttpd -[vVh]
* [mod_fastcgi,mod_scgi] check for spawning on same unix socket (fixes #319)
* [mod_cgi] always set QUERY_STRING (fixes #1339)
* [mod_auth] send charset="UTF-8" in WWW-Authenticate (fixes #1468)
* [mod_magnet] rename var for clarity (fixes #1483)
* [mod_extforward] reset cond_cache for scheme (fixes #1499)
* [mod_webdav] readdir POSIX compat (fixes #1826)
* [mod_expire] reset caching response headers for error docs (fixes #1919)
* [mod_status] page refresh option (fixes #2170)
* [mod_status] table w/ count of con states (fixes #2427)
* [mod_dirlisting] class for dir <tr> (fixes #2304)
* [core] define __STDC_WANT_LIB_EXT1__ (fixes #2722)
* [core] setrlimit max-fds <= rlim_max for non-root (fixes #2723)
* [mod_ssi] config ssi.conditional-requests
* [mod_ssi] config ssi.exec (fixes #2051)
* [mod_redirect,mod_rewrite] short-circuit if blank replacement (fixes #2085)
* [mod_indexfile] save physical path to env (fixes #448, #892)
* [core] open fd when appending file to cq (fixes #2655)
* [config] server.listen-backlog option (fixes #1825, #2116)
* [core] retry tempdirs on partial write, ENOSPC (fixes #2588)
* [core] compile with upcoming openssl 1.1.0 release (fixes #2727)
* [core] improve dynamic handler control flow logic
* [core] defer reading request body until handle subrequest (fixes #2541)
* [core] always poll for client POLLHUP/POLLERR events (fixes #399)
* [mod_fastcgi,mod_scgi,mod_proxy] handlers can read response before sending req body (fixes #131, #2566)
* [mod_cgi] asynchronous send of request body to CGI
* [core] compile with upcoming openssl 1.1.0 release (fixes #2727)
* [core] set REDIRECT_STATUS to error_handler_saved_status (fixes #1828)
* [core] server.error-handler new directive for error pages (fixes #2702)
* [core] support IPv6 in $HTTP["remote-ip"] CIDR cond match (fixes #2706)
* [core] http_response_send_file() shared code (#2017)
* [mod_fastcgi] use http_response_xsendfile() (fixes #799, fixes #851, fixes #2017, fixes #2076)
* [mod_scgi] X-Sendfile feature (fixes #2253)
* [mod_cgi] X-Sendfile feature (fixes #2313)
* [mod_webdav] lseek,read if fs can not mmap (#2666, fixes #962)
* [mod_compress] use mmap and trap SIGBUS (#2666, fixes #1879)
* fallback to lseek()/read() if mmap() fails (#fixes 2666)
* [mod_auth] skip blank lines and comment lines (fixes #2327)
* [core] fallback to write if sendfile not supported (fixes #471, #987)
* [core] preserve PATH_INFO case on case-insensitive fs (fixes #406)
* [mod_ssi, mod_cml] set DOCUMENT_ROOT to basedir (fixes #2383)
* [core] cmd line opt to shutdown after idle time limit (fixes #2696)
* [core] lighttpd -1 handles single request on stdin socket (fixes #1584)
* [mod_fastcgi,mod_scgi] IPv6 support (fixes #2372)
* [mod_status] add JSON output option (fixed #2432)
* [mod_webdav] map COPY/MOVE Destination to aliases (fixes #1787)
* [mod_webdav] improve PROPFIND,PROPPATCH (#1818, #1953)
* [core] reset response headers, write_queue for error docs
* build with libressl
* static build instructions using SCons or make
* [mod_auth] preserve WWW-Authenticate for error docs (fixes #2730)
* check close() return code after writing to file
* adjustments for openssl 1.1.0 pre-release
* [config] support include file glob (fixes #1221)
* [mod_evasive] 302 redirect option if limit reached (fixes #2199)
* [build] enhancements for cross-compiling (fixes #2276)
* [mod_accesslog] report aborted con state with %X (fixes #1890)
* [mod_ssi] fix SSI statement parser
* [mod_ssi] include relative to alias,userdir (fixes #222)
* [mod_ssi] add PCRE_* options to constrain regex
* [mod_ssi] more flexible quoting (fixes #1768)
* [core] wrap IPv6 literal in "[]" in redirect URL
* [mod_ssi] fix parse of tag across buf boundary (fixes #2732)
* [mod_cgi,mod_scgi] X-Sendfile sets file_started (fixes #2733)
* [mod_fastcgi] no chunked response w/ X-Sendfile (fixes #2733)
* [config] opts for http header parsing strictness (fixes #551, fixes #1086, fixes #1184, fixes #2143, #2258, #2281, fixes #946, fixes #1330, fixes #602, #1016)
* [config] normalize IP strings in lighttpd.conf
* [build_cmake] use MODULE on Mac OS X (fixes #1761)
* [config] server.bsd-accept-filter option
* [mod_webdav] create file w/ LOCK request if ENOENT
* [core] buffer large responses to tempfiles (fixes #758, fixes #760, fixes #933, fixes #1387, #1283, fixes #2083)
* [core] stream response to client (#949)
* [TLS] release openssl buffers as used (fixes #1265, fixes #1283, #881)
* [config] config options to stream request/response (#949, #376)
* [core] option to stream request body to backend (fixes #376)
* [core] option to stream response body to client (fixes #949, #760, #1283, #1387)
* drain backend socket/pipe bufs upon FDEVENT_HUP
* remove excess calls to joblist_append()
* defer choosing "Transfer-Encoding: chunked"
* asynchronous, bidirectional streaming options
* fix errors detected by Coverity Scan
* [cygwin] fix mod_proxy and mod_fastcgi ioctl use
* [mod_webdav] remove excess SQL param to UNLOCK
* graceful shutdown without unnecessary 1 sec delay
* [core] disable Nagle algorithm (TCP_NODELAY)
* [core] add declarations to fdevent.h (#2373)
* [tests] remove dependency on CGI.pm
* [TLS] fix return value checks during cert init
* [core] fix server.max-request-size to be precise (fixes #2131)
* [mod_webdav] fix proppatch mem leak, other fixes (#fixes 1334, #fixes 2000)
* [autobuild] CMake check for struct tm tm_gmtoff (fixes #2014)
* [mod_uploadprogress] fix mem leak (#1858)
* [core] make server.max-request-size scopeable (fixes #1901)
* [mod_fastcgi,mod_scgi] check for spawning on same unix socket (#319)
* [mod_accesslog] %a %A %C %D %k %{}t %{}T (fixes #1145, fixes #1415, fixes #2081)
* [mod_access] new directive url.access-allow (fixes #1421)
* [core] fdevent_libev: update use of ev_timer
* [mod_cgi] handle local redirect response (fixes #2108)
- 1.4.39 - 2016-01-02
* [core] fix memset_s call (fixes #2698)
* [chunk] fix use after free / double free (fixes #2700)
- 1.4.38 - 2015-12-05
* [stat-cache] fix handling of collisions, might have returned wrong data (fixes #2669)
* [core] allocate at least 4k buffer for incoming data
* [core] fix search for header end if split across chunks (fixes #2670)
* [core] check configparserAlloc() result with force_assert
* [mod_auth] implement and use safe_memclear, using memset_s or explicit_bzero if available (thx loganaden)
* [core] don't buffer request bodies smaller than 64k on disk
* add force_assert for many allocations and function results
* [mod_secdownload] use a hopefully constant time comparison to check hash (fixes #2679)
* [config] check config option scope; warn if server option is given in conditional
* [core] revert increase of temp file size back to 1MB, provide a configure option "server.upload-temp-file-size" instead (fixes #2680)
* [core] add '~' to safe characters in ENCODING_REL_URI/ENCODING_REL_URI_PART encoding
* [core] encode path with ENCODING_REL_URI in redirect to directory (fixes #2661, thx gstrauss)
* [mod_secdownload] add required algorithm option; old behaviour available as "md5", new options "hmac-sha1" and "hmac-sha256"
* [mod_fastcgi/mod_scgi] zero sockaddr structs before use (fixes #2691, thx Kyle J. McKay)
* [network] add darwin-sendfile backend (fixes #2687, thx Kyle J. McKay)
* [core] show correct crypt support result (fixes #2690, thx Kyle J. McKay)
- 1.4.37 - 2015-08-30
* [mod_proxy] remove debug log line from error log (fixes #2659)
* [mod_dirlisting] fix dir-listing.set-footer not showing
* fix out-of-filedescriptors when uploading "large" files (fixes #2660, thx rmilecki)
* increase upload temporary chunk file size from 1MB to 16MB
* fix undefined integer shift
* rewrite network sendfile/mmap/writev/write backends
* fix some unchecked return value warnings
* [kqueue] fix kevent call
* [autoconf] define HAVE_CRYPT when crypt() is present
* [bsd xattr] fix compile break with BSD extended attributes in stat_cache
* [mod_cgi] rewrite mmap and generic (post body) send error handling
* [mmap] fix mmap alignment
* [plugins] when modules are linked statically still only load the modules given in the config
* [mmap] handle SIGBUS in network; those get triggered if the file gets smaller during reading
* fix some warnings found by coverity ("leak" in setup phase, not catching too long unix socket paths in mod_proxy)
- 1.4.36 - 2015-07-26
* use keep-alive timeout while waiting for HTTP headers; use always the read timeout while waiting for the HTTP body
* fix bad shift in conditional netmask ".../0" handling
* add more mime types and a script to generate mime.conf (fixes #2579)
* add support for (Free)BSD extended attributes
* [build] use fortify flags with "extra-warnings"
* [mod_dirlisting,mod_redirect,mod_rewrite] abort config parsing if pcre-compile fails or isn't available
* [ssl] disable SSL3.0 by default
* fixed typo in example config found by openSUSE user (boo# 907709)
* [network] fix compile break in calculation of sockaddr_un size if SUN_LEN is not defined (fixes #2609)
* [connections] fix bug in connection state handling
* print backtrace in assert logging with libunwind
* major refactoring of internal buffer/chunk handling
* [mod_auth] use crypt_r instead of crypt if available
* fix error message for T_CONFIG_ARRAY config values if an entry value is not a string
* fix segfaults in many plugins if they failed configuration
* escape all strings for logging (fixes #2646 log file injection, reported by Jaanus Kääp)
* fix hex escape in accesslog (fixes #2559)
* show extforward re-run warning only with debug.log-request-handling (fixes #2561)
* parse If-None-Match for ETag validation (fixes #2578)
* fix memory leak in mod_status when no counters are set (found by coverity)
* [mod_magnet] fix segfault when accessing not existing lighty.req_env[] entry (found by coverity)
* fix segfault when temp file for upload couldn't be created (found by coverity)
* mime.conf: add some new mime types, remove .dat, .sha1, .md5, update .vcf
* [mod_proxy] add unix domain socket support (fixes #2653)
* [configfile] fix reading uninitialized variable (found by Willian B.)
- 1.4.35 - 2014-03-12
* [network/ssl] fix build error if TLSEXT is disabled
* [mod_fastcgi] fix use after free (only triggered if fastcgi debug is active)
* [mod_rrdtool] fix invalid read (string not null terminated)
* [mod_dirlisting] fix memory leak if pcre fails
* [mod_fastcgi,mod_scgi] fix resource leaks on spawning backends
* [mod_magnet] fix memory leak
* add comments for switch fall throughs
* remove logical dead code
* [buffer] fix length check in buffer_is_equal_right_len
* fix resource leaks in error cases on config parsing and other initializations
* add force_assert() to enforce assertions as simple assert()s are disabled by -DNDEBUG (fixes #2546)
* [mod_cml_lua] fix null pointer dereference
* force assertion: setting FD_CLOEXEC must work (if available)
* [network] check return value of lseek()
* fix unchecked return values from stream_open/stat_cache_get_entry
* [mod_webdav] fix logic error in handling file creation error
* check length of unix domain socket filenames
* fix SQL injection / host name validation (thx Jann Horn)
- 1.4.34 - 2014-01-20
* [mod_auth] explicitly link ssl for SHA1 (fixes #2517)
* [mod_extforward] fix compilation without IPv6, (not) using undefined var (fixes #2515, thx mm)
* [ssl] fix SNI handling; only use key+cert from SNI specific config (fixes #2525, CVE-2013-4508)
* [doc] update ssl.cipher-list recommendation
* [stat-cache] FAM: fix use after free (CVE-2013-4560)
* [stat-cache] fix FAM cleanup/fdevent handling
* [core] check success of setuid,setgid,setgroups (CVE-2013-4559)
* [ssl] fix regression from CVE-2013-4508 (client-cert sessions were broken)
* maintain physical.basedir (the "acting" doc-root as prefix of physical.path) in more places
* [core] decode URL before rewrite, enabling it to work in $HTTP["url"] conditionals (fixes #2526)
* [auto* build] remove -no-undefined from linker flags, as we actually link modules with undefined symbols (fixes #2533)
* [mod_mysql_vhost] fix memory leak on config init (#2530)
* [mod_webdav] fix fd leak found with parfait (fixes #2530, thx kukackajiri)
- 1.4.33 - 2013-09-27
* mod_fastcgi: fix mix up of "mode" => "authorizer" in other fastcgi configs (fixes #2465, thx peex)
* fix handling of If-Modified-Since if If-None-Match is present (don't return 412 for date parsing errors);
follow current draft for HTTP/1.1, which tells us to ignore If-Modified-Since if we have matching etags.
* [mod_fastcgi,log] support multi line logging (fixes #2252)
* call ERR_clear_error only for ssl connections in CON_STATE_ERROR
* reject non ASCII characters in HTTP header names
* [mod_auth] use crypt() on encrypted password instead of extracting salt first (fixes #2483)
* [mod_auth] add htpasswd -s (SHA1) support if openssl is used (needs openssl for SHA1). This doesn't use any salt, md5 with salt is probably better.
* [mod_auth] fix base64_decode (#2484)
* fix some bugs found with canalyze (fixes #2484, thx Zhenbo Xu)
* fix undefined stuff found with clang
* [cmake] Use TARGET_LINK_LIBRARIES instead of LINK_FLAGS for library dependencies, also add -Wl,--as-needed to extra warnings (fixes #2448)
* [mod_auth] fix invalid read in digest qop=auth-int handling (fixes #2478)
* [auto* build] simplify autogen.sh, handle automake 1.13 test running (fixes #2490)
* [mod_userdir] add userdir.active option, "enabled" by default
* [core] return 501 Not Implemented in static file mode for all methods except GET/POST/HEAD/OPTIONS
* [core] recognize more http methods to forward to backends (fixes #2346)
* [ssl] use DH only if openssl supports it (fixes #2479)
* [network] use constants available at compile time for maximum number of chunks for writev instead of calling sysconf (fixes #2470)
* [ssl] Fix $HTTP["scheme"] conditional, could be "http" for ssl connections if the ssl $SERVER["socket"] conditional was nested (fixes #2501)
* [ssl] accept ssl renegotiations if they are not disabled (fixes #2491)
* [ssl] add option ssl.empty-fragments, defaulting to disabled (fixes #2492)
* [auth] put REMOTE_USER into cgi environment, making it accessible to lua via lighty.req_env (fixes #2495)
* [auth] new method "extern" to use already present REMOTE_USER (from magnet, ssl, ...) (fixes #2436)
* [core] remove requirement that default doc-root has to exist, there are reasonable scenarios not requiring static files at all
* [core] check whether server.chroot exists
* [mod_simple_vhost] fix cache; skip module if simple-vhost.server-root is empty (thx rm for reporting)
* [mod_accesslog] add accesslog.syslog-level option (fixes #2480)
* [core] allow files to be used as document-root (fixes #2475)
* [core] set signal handlers before forking child processes in modules/plugins_call_set_defaults (fixes #2502)
- 1.4.32 - 2012-11-21
* Code cleanup with clang/sparse (fixes #2437, thx kibi)
* Ignore EPIPE/ECONNRESET after SSL_shutdown
* Handle ENAMETOOLONG, return 404 Not Found (fixes #2396, thx dererkazo)
* configure.ac: remove old stuff, add some new to fix warnings in automake 1.12 (fixes #2419, thx blino)
* add PATCH method (fixes #2424)
* fix :port handling in $HTTP["host"] checks (fixes #2135. thx liming)
* network_server_init: fix double free and memleak on error (fixes #2440, thx kyprizel)
* detect "x-gzip"/"x-bzip2" as separate encodings, more strict encoding matching (fixes #2443)
* tests: make sure mod_proxy doesn't leave running processes (fixes #2435, thx kibi)
* mod_extforward: log address of untrusted proxy with debug.log-request-handling
* fix DoS in Connection header value split (reported by Jesse Sipprell, CVE-2012-5533)
* remove whitespace at end of header keys
- 1.4.31 - 2012-05-31
* [ssl] fix segfault in counting renegotiations for openssl versions without TLSEXT/SNI (thx carpii for reporting)
* Move fdevent subsystem includes to implementation files to reduce conflicts (fixes #2373)
* [mod_compress] fix handling if etags are disabled but cache-dir is set - may lead to double response
* disable mmap by default (fixes #2391)
* buffer_caseless_compare: always convert letters to lowercase to get transitive results, fixing array lookups (fixes #2405)
* Fix handling of empty header list entries in http_request_split_value, fixing invalid read in valgrind (fixes #2413)
* Fix access log escaping of " and \\ (fixes #1551)
* [mod_auth] Fix digest "md5-sess" implementation (Errata ID 1649, RFC 2617) (fixes #2410)
* [auth] Add "AUTH_TYPE" environment (for *cgi), remove fastcgi specific workaround, add fastcgi test case (fixes #889)
* [mod_*cgi,mod_accesslog] Fix splitting :port with ipv6 (fixes #2333, thx simoncpu)
* Detect multiple -f options: show error message instead of assert (fixes #2416)
* [mod_extforward] Support ipv6 addresses (fixes #1889)
* [mod_redirect] Support url.redirect-code option (fixes #2247)
* Fix --enable-mmap handling in configure.ac
- 1.4.30 - 2011-12-18
* Always use our 'own' md5 implementation, fixes linking issues on MacOS (fixes #2331)
* Limit amount of bytes we send in one go; fixes stalling in one connection and timeouts on slow systems.
* [ssl] fix build errors when Elliptic-Curve Diffie-Hellman is disabled
* Add static-file.disable-pathinfo option to prevent handling of urls like .../secret.php/image.jpg as static file
* Don't overwrite 401 (auth required) with 501 (unknown method) (fixes #2341)
* Fix mod_status bug: always showed "0/0" in the "Read" column for uploads (fixes #2351)
* [mod_auth] Fix signedness error in http_auth (fixes #2370, CVE-2011-4362)
* [ssl] count renegotiations to prevent client renegotiations
* [ssl] add option to honor server cipher order (fixes #2364, BEAST attack)
* [core] accept dots in ipv6 addresses in host header (fixes #2359)
* [ssl] fix ssl connection aborts if files are larger than the MAX_WRITE_LIMIT (256kb)
* [libev/cgi] fix waitpid ECHILD errors in cgi with libev (fixes #2324)
- 1.4.29 - 2011-07-03
* Fix mod_proxy waiting for response even if content-length is 0 (fixes #2259)
* Silence annoying "connection closed: poll() -> ERR" error.log message (fixes #2257)
* mod_cgi: make read buffer as big as incoming data block
* [build] Fix detection of libev (fixes #2300)
* ssl: Support for Diffie-Hellman and Elliptic-Curve Diffie-Hellman key exchange (fixes #2301)
add ssl.use-sslv3 (fixes #2246)
load all algorithms (fixes #2239)
* [ssl/md5] prefix our own md5 implementation with li_ so it doesn't conflict with the openssl one (fixes #2269)
* [ssl/build] some minor fixes; fix compile without ssl, cleanup ssl config buffers
* [proc,include_shell] log error if exec shell fails (fixes #2280)
* [*cgi] Use physical base dir (alias, userdir) as DOCUMENT_ROOT in cgi environments (fixes #2216)
* [doc] Move docs to outdated/ subdir and refer to wiki instead (fixes #2248)
* fdevent: add solaris eventports (fixes #2171)
- 1.4.28 - 2010-08-22
* Rename fdevent_event_add to _set to reflect what the function does. Fix some handlers. (fixes #2249)
* Fix buffer.h to include stdio.h as it is needer for SEGFAULT() (fixes #2250)
- 1.4.27 - 2010-08-13
* Fix handling return value of SSL_CTX_set_options (fixes #2157, thx mlcreech)
* Fix mod_proxy HUP handling (send final chunk, fix usage counter)
* mod_proxy: close connection on write error (fixes #2114)
* Check uri instead of physical path for directory redirect
* Fix detecting git repository (fixes #2173, thx ncopa)
* [mod_compress] Fix segfault when etags are disabled (fixes #2169)
* Reset uri.authority before TLS servername handling, reset all "keep-alive" data in connection_del (fixes #2125)
* Print double quotes properly when dumping config file (fixes #1806)
* Include IP addresses on error log on password failures (fixes #2191)
* Fix stalls while reading from ssl sockets (fixes #2197)
* Fix etag formatting on boxes with 32-bit longs
* Fix two compiler warnings
* mod_accesslog: fix %p for ipv6 sockets (fixes #2228, thx jo.henke)
* mod_fastcgi: Send 502 "Bad Gateway" if we couldn't open the file for X-Sendfile (fixes #2226)
* mod_staticfile: add debug output if we ignore a file with static-file.exclude-extensions (fixes #2215)
* mod_cgi: fix race condition leaving response not forwarded to client (fixes #2217)
* mod_accesslog: Fix var declarations mixed in source (fixes #2233)
* mod_status: Add version to status page (fixes #2219)
* mod_accesslog: optimize accesslog_append_escaped (fixes #2236, thx crypt)
* openssl: silence annoying error messages for errno==0 (fixes #2213)
* array.c: improve array_get_unused_element to check data type; fix mem leak if unused_element didn't find a matching entry (fixes #2145)
* add check to stop loading plugins twice
* cleanup fdevent code, removed linux-rtsig handler, replaced some fprintf calls
* only require FDEVENT_IN bit to be set for listening connections (fixes #2227)
* add libev fdevent handler: server.event-handler = "libev"
* mod_proxy: return response as soon as it is available (fixes #2196)
* don't overwrite global server.force-lowercase-filenames setting (fixes #2042)
* bind to IPV6-only if ipv6 address was specified (https://redmine.lighttpd.net/projects/lighttpd/wiki/IPv6-Config)
- 1.4.26 - 2010-02-07
* Fix request parser to handle packets with splitted \r\n\r\n (fixes #2105)
* Remove dependency on automake >= 1.11 with m4_ifdef check
* mod_accesslog: support %e (fixes #2113, thx presbrey)
* Fix mod_cgi cgi.execute-x-only option in global block
* mod_fastcgi: x-sendfile2 parse error debugging
* Fix mod_proxy dead host detection if connect() fails
* Fix fd leaks in mod_cgi (fds not closed on pipe/fork failures, found by Rodrigo, fixes #2158, #2159)
* Fix segfault with broken rewrite/redirect patterns (fixes #2140, found by crypt)
* Append to previous buffer in con read, fix DoS/OOM vulnerability (fixes #2147, found by liming, CVE-2010-0295)
* Fix HUP detection in close-state if event-backend doesn't support FDEVENT_HUP (like select or poll on FreeBSD)
- 1.4.25 - 2009-11-21
* mod_magnet: fix pairs() for normal tables and strings (fixes #1307)
* mod_magnet: add traceback for printing lua errors
* mod_rewrite: fix compile error if compiled without pcre
* disable warning "CLOSE-read" (fixes #2091)
* mod_rrdtool: fix creating file if it doesn't exist (#1788)
* reset tlsext_server_name in connection_reset - fixes random hostnames in the $HTTP["host"] conditional
* export some SSL_CLIENT_* vars for client cert validation (fixes #1288, thx presbrey)
* mod_fastcgi: fix mod_fastcgi packet parsing
* mod_fastcgi: Don't reconnect after connect() succeeded (fixes #2096)
* Fix configure.ac to allow autoreconf, also enables make V=0