Re: Fwd: mod_substitute buggy execution order

2011-12-20 Thread William A. Rowe Jr.
On 12/20/2011 1:44 AM, Nick Gearls wrote: That's very different from other modules. Most (all?) modules do the opposite: first global, then local - ex: rewrite Furthermore, narrowing does not work the way you expect as Location /test/ Substitute s/aaa/local1/inq /Location

[Result] [Vote] .htaccess logic abuse

2011-12-20 Thread William A. Rowe Jr.
On 11/18/2011 4:38 PM, William A. Rowe Jr. wrote: After several prods, it seems the security@ and hackathon participants can't be drawn out of their shells on to dev@. So I'll simply call for a majority vote on the following statement... Resource abuse of an .htaccess config in the form of

Re: CVE-2011-3607, int overflow ap_pregsub()

2011-12-20 Thread William A. Rowe Jr.
We should come to a conclusion on this. On 11/15/2011 8:22 AM, Plüm, Rüdiger, VF-Group wrote: The patch is fine on trunk because the affected code is not within AP_DECLARE(char *) ap_pregsub(...) but within static apr_status_t regsub_core(apr_pool_t *p, char **result,

Re: svn commit: r1220867 - in /httpd/httpd/branches/2.4.x: ./ CHANGES Makefile.in build/rpm/httpd.spec.in build/rules.mk.in support/Makefile.in test/Makefile.in

2011-12-20 Thread Graham Leggett
On 20 Dec 2011, at 9:34 AM, William A. Rowe Jr. wrote: -PROGRAMS= $(PROGRAM_NAME) -TARGETS = $(PROGRAMS) $(shared_build) $(other_targets) +sbin_PROGRAMS = $(PROGRAM_NAME) +TARGETS = $(sbin_PROGRAMS) $(shared_build) $(other_targets) Yow. That defies every naming

Windows 32 and 64 binaries 2.3.16 available

2011-12-20 Thread Steffen
at http://www.apachelounge.com , plus eg. php (5.3.8, 5.3.9 and 5.4.0) handlers and mod_security 2.6.3 (to be released this week) Steffen

[ANNOUNCE] Apache HTTP Server 2.3.16-beta RELEASED

2011-12-20 Thread Jim Jagielski
Apache HTTP Server 2.3.16-beta Released The Apache Software Foundation and the Apache HTTP Server Project are pleased to announce the release of version 2.3.16-beta of the Apache HTTP Server (Apache). This version of Apache is our fifth beta release (and is considered as our first

Re: svn commit: r1220867 - in /httpd/httpd/branches/2.4.x: ./ CHANGES Makefile.in build/rpm/httpd.spec.in build/rules.mk.in support/Makefile.in test/Makefile.in

2011-12-20 Thread Jeff Trawick
On Tue, Dec 20, 2011 at 6:35 AM, Graham Leggett minf...@sharp.fm wrote: On 20 Dec 2011, at 9:34 AM, William A. Rowe Jr. wrote: -PROGRAMS        = $(PROGRAM_NAME) -TARGETS         = $(PROGRAMS) $(shared_build) $(other_targets) +sbin_PROGRAMS   = $(PROGRAM_NAME) +TARGETS         =

Re: svn commit: r1220867 - in /httpd/httpd/branches/2.4.x: ./ CHANGES Makefile.in build/rpm/httpd.spec.in build/rules.mk.in support/Makefile.in test/Makefile.in

2011-12-20 Thread Graham Leggett
On 20 Dec 2011, at 3:10 PM, Jeff Trawick wrote: None of these require the user to be administrator, except to use the apxs -i option. Not really sure if these make sense. Any pointers to a decent canonical definition of sbin v bin? You're right, the current split doesn't seem to make much

Re: svn commit: r1215525 - in /httpd/httpd/trunk: ./ docs/manual/mod/ docs/manual/programs/ modules/debugging/ support/

2011-12-20 Thread William A. Rowe Jr.
On Dec 18, 2011, at 11:45 AM, Graham Leggett wrote: Given that mod_firehose is significantly simpler than mod_policy, I am struggling to understand given both your stated preference above, and the preferences of others already stated, why suddenly this is a big issue. Simpler? Far more

Re: svn commit: r1220867 - in /httpd/httpd/branches/2.4.x: ./ CHANGES Makefile.in build/rpm/httpd.spec.in build/rules.mk.in support/Makefile.in test/Makefile.in

2011-12-20 Thread William A. Rowe Jr.
On 12/20/2011 7:23 AM, Graham Leggett wrote: On 20 Dec 2011, at 3:10 PM, Jeff Trawick wrote: None of these require the user to be administrator, except to use the apxs -i option. Not really sure if these make sense. Any pointers to a decent canonical definition of sbin v bin? You're

Re: svn commit: r1220867 - in /httpd/httpd/branches/2.4.x: ./ CHANGES Makefile.in build/rpm/httpd.spec.in build/rules.mk.in support/Makefile.in test/Makefile.in

2011-12-20 Thread William A. Rowe Jr.
On 12/20/2011 5:35 AM, Graham Leggett wrote: This is the standard convention that's used by automake, I'm not keen on inventing another arbitrary format if I can avoid it: Ahhh. We don't speak automake :) I find the convention very irritating, but will leave it at that and let others chime