*) SECURITY: CVE-2015-0228 (cve.mitre.org)
mod_lua: A maliciously crafted websockets PING after a script
calls r:wsupgrade() can cause a child process crash.
[Edward Lu <Chaosed0 gmail.com>]
Discovered by Guido Vranken <guidovranken gmail.com>
Submitted by: Edward Lu
Committed by: covener
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1664118 13f79535-47bb-0310-9956-ffa450edef68
Fix bit-shifting of websockets frame fields that would yield wrong opcodes
when the FIN bit was set. Results in PING not being recognized
by mod_lua. PR57524
Submitted By: Edward Lu
Committed By: covener
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1664117 13f79535-47bb-0310-9956-ffa450edef68
*) SECURITY: CVE-2014-8109 (cve.mitre.org)
mod_lua: Fix handling of the Require line when a LuaAuthzProvider is
used in multiple Require directives with different arguments.
PR57204 [Edward Lu <Chaosed0 gmail.com>]
Submitted By: Edward Lu
Committed By: covener
Submitted by: covener
Reviewed/backported by: jim
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1642861 13f79535-47bb-0310-9956-ffa450edef68
Add missing APLOGNO.
Refactor to keep APLOGNO on the same line as ap_log_error, when applicable.
Add missing APLOGNO.
Refactor some lines to keep APLOGNO on the same line as ap_log_error, when applicable.
Split lines longer than 80.
Improve alignment.
Submitted by: jailletc36
Reviewed/backported by: jim
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1622706 13f79535-47bb-0310-9956-ffa450edef68
SECURITY (CVE-2014-0226): Fix a race condition in scoreboard handling,
which could lead to a heap buffer overflow. Thanks to Marek Kroemeke
working with HP's Zero Day Initiative for reporting this.
* include/scoreboard.h: Add ap_copy_scoreboard_worker.
* server/scoreboard.c (ap_copy_scoreboard_worker): New function.
* modules/generators/mod_status.c (status_handler): Use it.
* modules/lua/lua_request.c (lua_ap_scoreboard_worker): Likewise.
Reviewed by: trawick, jorton, covener, jim
Submitted by: jorton, covener
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1610499 13f79535-47bb-0310-9956-ffa450edef68
- IVM changed to use shm
- More verbose error logging (no functional change)
- Miscellaneous refactoring that was in trunk but not in 2.4.x (no functional change as such)
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1604339 13f79535-47bb-0310-9956-ffa450edef68
for LuaMapHandler. This fixes a bug where FallbackResource invalidates the
LuaMapHandler directive in certain cases by changing the URI before the map
handler code executes [Daniel Gruno].
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1577145 13f79535-47bb-0310-9956-ffa450edef68
mod_lua: Fix r:setcookie() to add, rather than replace,
the Set-Cookie header. PR56105
Submitted By: Kevin J Walters <kjw ms com>, Edward Lu <Chaosed0 gmail com>
Committed By: covener
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1567328 13f79535-47bb-0310-9956-ffa450edef68
mod_lua: Fix compiler warning by using correct
APR_SIZE_T_FMT and APR_OFF_T_FMT format macro
in debug logging.
Submitted by: rjung
Reviewed/backported by: jim
NOTE: Not sure about CHANGES... is there a BUGZ on this?
In general, CHANGES is for userland visible changes or
BUGZ bug fixes, and not sure if this really applies
here. But it's OK if someone wants to add something
to CHANGES.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1546976 13f79535-47bb-0310-9956-ffa450edef68
Spin off module-specific build options into separate build vars.
[second try, supersedes r1385214]
Add MOD_CFLAGS, MOD_LDFLAGS variables etc. to the build commands,
which are available to modules for customization on a per-subdir
basis (by adding definitions to modules.mk). Reduces the risk
of side-effects when a module needs to add CFLAGS, LDFLAGS etc.
and these would be added to the global settings (ALL_CFLAGS etc.).
Adapt build settings for mod_ssl, mod_socache_dc, mod_deflate,
mod_xml2enc, mod_proxy_html, and mod_lua to use the new MOD_xxx
build variables.
Change PICFLAGS, SHLTCFLAGS and LTCFLAGS into config vars, instead
of AC_SUBSTing them in build/rules.mk.in. For support/ab, introduce
ab_CFLAGS and ab_LDFLAGS, and define explicit make targets where
they appear at the proper position in the build commands.
Consistently use "--with-xxx=PATH" in configure help strings which
are used to specify a path to the installation directory of an
auxiliary package.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1390518 13f79535-47bb-0310-9956-ffa450edef68
Add new directive LuaAuthzProvider to allow implementing an
authorization provider in lua
There is only one global provider name space, therefore allow
LuaAuthzProvider only in global scope.
Remove unnecessary server config field.
Submitted by: sf
Reviewed/backported by: jim
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1374252 13f79535-47bb-0310-9956-ffa450edef68
