Re: [RESULT] (Was: Re: [VOTE] Release Apache HTTP Server 2.2.9)

2008-06-13 Thread Joshua Slive
On Fri, Jun 13, 2008 at 3:49 PM, Jorge Schrauwen [EMAIL PROTECTED] wrote: I'd say tomorrow so most mirrors will be synced by then... unless they sync very fast... no idea how fast that is. You can see a histogram of last-sync times near the bottom of this page: http://www.apache.org/mirrors/

Re: svn commit: r654752 - in /httpd/httpd/branches/2.2.x: CHANGES STATUS modules/generators/mod_cgid.c

2008-05-09 Thread Joshua Slive
On Fri, May 9, 2008 at 8:27 AM, Jeff Trawick [EMAIL PROTECTED] wrote: On Fri, May 9, 2008 at 6:57 AM, [EMAIL PROTECTED] wrote: Author: trawick Date: Fri May 9 03:57:46 2008 New Revision: 654752 URL: http://svn.apache.org/viewvc?rev=654752view=rev Log: backport from trunk: *) mod_cgid:

Re: svn commit: r653856 - /httpd/httpd/trunk/docs/manual/mod/core.xml

2008-05-06 Thread Joshua Slive
On Tue, May 6, 2008 at 1:57 PM, [EMAIL PROTECTED] wrote: +note type=warningtitleNote/title + pThis directive will be ignored in a name-based virtual host context./p +/note That should just be an ordinary note with no type=. warning is for really-important stuff like

Re: Apache response time

2008-05-05 Thread Joshua Slive
2008/5/4 Niko Wilfritz Sianipar Sianipar [EMAIL PROTECTED]: How to get the response time in the apache log file in msec. Thank you. %D in the logformat string gives you microseconds. Joshua.

Re: IIS6 application pools feature in Apache..

2008-04-30 Thread Joshua Slive
On Wed, Apr 30, 2008 at 5:06 PM, Graham Leggett [EMAIL PROTECTED] wrote: The easiest way to do this would be to run a dedicated httpd process for each application (forming your pool), and then combine them into one website using a standard reverse proxy configuration.

Re: svn commit: r644357 - /httpd/httpd/branches/2.2.x/docs/conf/extra/httpd-dav.conf.in

2008-04-03 Thread Joshua Slive
On Thu, Apr 3, 2008 at 11:29 AM, [EMAIL PROTECTED] wrote: Author: wrowe Date: Thu Apr 3 08:28:59 2008 New Revision: 644357 URL: http://svn.apache.org/viewvc?rev=644357view=rev Log: Correct broken configuration in 2.2 - this example didn't run out of the box +AuthDigestProvider

Re: Adding stickysession cookie on the proxy

2008-03-06 Thread Joshua Slive
On Thu, Mar 6, 2008 at 3:05 PM, Jim Jagielski [EMAIL PROTECTED] wrote: The advantage of mod_headers is more flexibility that what could be comfortably added to the proxy module itself as well... This comes up maybe once or twice a year... I think I'll add it to my standard Apache 2.2

Re: r-user not logged for authenticated requests with handlers outside the protected area

2008-02-20 Thread Joshua Slive
On Wed, Feb 20, 2008 at 7:45 PM, Chris Stromsoe [EMAIL PROTECTED] wrote: All requests for php in /opt/html authenticate properly but don't set REMOTE_USER and are logged with r-user == NULL. I'm guessing that's because the handler is not inside the protected directory. Feature or bug?

Re: XSS vulnerability in mod_negotiation - status in 2.2.8?

2008-02-05 Thread Joshua Slive
On Feb 5, 2008 5:40 AM, Boyle Owen [EMAIL PROTECTED] wrote: Greetings, Our security guy noticed this alert about a XSS vulnerability in mod_negotiation: http://www.mindedsecurity.com/MSA01150108.html. According to the link, it applies to apache = 2.2.6, so no worries for 2.2.8. However,

Re: PCRE in Apache?

2008-01-25 Thread Joshua Slive
On Jan 25, 2008 5:28 PM, Chris H. [EMAIL PROTECTED] wrote: Greetings all, I'm toying with the idea of using PCRE in Apache 1.3. I see already that there is support for REGEX in the Configuration.tmpl that permits a choice of bundled or system (if available). But was wondering how hard, or if

Re: Apache 2 IP_Forwarding

2007-11-02 Thread Joshua Slive
On Nov 2, 2007 12:41 PM, Shaw, Dan [EMAIL PROTECTED] wrote: Good Morning, We are trying to identify the following and we have received one response and need to verify. We are looking for feedback or heck even a solution on the following In order to get the IP address of the client, instead

Re: Strange access log entry repeating

2007-10-15 Thread Joshua Slive
On 10/15/07, Marten Lehmann [EMAIL PROTECTED] wrote: I'm using httpd-2.2.4. If you don't have an idea, I can maybe track it down a bit further. But so far this simpelst thing I can explain is: With a pretty standard httpd.conf there is no long entry unless someone actually calls a URL. But

Re: AP_CONN_CLOSE on force-response-1.0

2007-10-09 Thread Joshua Slive
On 10/9/07, Jim Jagielski [EMAIL PROTECTED] wrote: All I'm saying is that, iirc, the intent of force-response-1.0 is to force a 1.0 response and disable keepalives... it was designed to work around buggy browsers that had problems with 1.1 features, including wonky 1.0-type keepalives. No,

Re: How to kill 1.3?

2007-10-03 Thread Joshua Slive
On 10/3/07, Roy T. Fielding [EMAIL PROTECTED] wrote: I don't care what the uptake graph says. I don't care what people outside this project mailing list think, period, about this project. And if five years from now there are three or more Apache committers that want to release 1.3.x, then no

Re: Proxying OPTIONS *

2007-10-01 Thread Joshua Slive
On 10/1/07, Jim Jagielski [EMAIL PROTECTED] wrote: I know Roy's already reported the proxy error as bogus, but I think the OPTIONS * BUGZ report is also bogus. As a test, I assumed that both www.apache.org and apache.webthing.com are reasonably configured servers: www.apache.org is using a

Re: Proxying OPTIONS *

2007-10-01 Thread Joshua Slive
On 10/1/07, William A. Rowe, Jr. [EMAIL PROTECTED] wrote: But I'm rather against breaking this in 2.2 to solve (what are, today) configuration quirks. Let's get this right for 2.4 and call out the change very clearly in (our overlong) CHANGES? I'm thinking of a new second-priority category

Re: Proxying OPTIONS *

2007-10-01 Thread Joshua Slive
On 10/1/07, William A. Rowe, Jr. [EMAIL PROTECTED] wrote: Joshua Slive wrote: Should be in this, rather sparse file: http://httpd.apache.org/docs/trunk/new_features_2_4.html But it's not a feature-per say. It's a bugfix, so the name new_features doesn't tell admins they have to adopt

Re: Patching PR#13986

2007-09-26 Thread Joshua Slive
On 9/26/07, Nick Kew [EMAIL PROTECTED] wrote: We really need to fix this issue of inappropriate DefaultTypes. An approach that deals with this without loss of back-compatibility is to hand the decision to systems administrators: #to suppress setting content-type when the server has no

Re: What is httpd -X?

2007-09-20 Thread Joshua Slive
On 9/20/07, Ashwani Kumar Sharma [EMAIL PROTECTED] wrote: What is httpd –X See: http://httpd.apache.org/docs/2.2/programs/httpd.html Whether I can use this –X option for the deployment. The better question is: why would you want to? You mention nothing about what problem you are trying to

Re: What is httpd -X?

2007-09-20 Thread Joshua Slive
On 9/20/07, Ashwani Kumar Sharma [EMAIL PROTECTED] wrote: I want to start the httpd web server through my own application and then I would like to shut down the web server once I wish to bring my application down, normally or abnormally (in case). Will it be fine if I spawn the Apache web

Re: Increasing the size of allow_options_t and overrides_t

2007-09-01 Thread Joshua Slive
On 9/1/07, Graham Leggett [EMAIL PROTECTED] wrote: Hi all, I am working on a patch that needs to widen the two bitmaps below, as they have run out of bits. Would such a change be backport-able to v2.2, and what kind of MMN bump would it need if so? I think that'll break the binary API, which

Re: About modules/metadata/mod_expires.c (apache 2.2)

2007-08-26 Thread Joshua Slive
On 8/26/07, Julien Perez [EMAIL PROTECTED] wrote: Hello everybody, While setting up a reverse proxy squid + apache w/ mod_expires.c in order to decrease the load on the web server, I discovered that mod_expires.c was working by checking the mimetype of the content generated by the web server

Re: default content type

2007-08-25 Thread Joshua Slive
On 8/25/07, Roy T. Fielding [EMAIL PROTECTED] wrote: For standards conformance, I am going to start removing the default content type settings from trunk tomorrow. http://issues.apache.org/bugzilla/show_bug.cgi?id=13986 If you have any problems with that, let them be known here. +1

Re: Conditional RequestHeader patch not reflected in documentation?

2007-08-10 Thread Joshua Slive
On 8/10/07, Rich Bowen [EMAIL PROTECTED] wrote: Received this query from a friend and colleague: ... I've been working on an issue at work, where we're trying to remove some headers from a (proxied) request. Whilst I was looking for a solution I came across this patch:

Re: Vhosts running as different userids (was: Re: Inclusion of mpm-itk into HEAD)

2007-08-05 Thread Joshua Slive
On 8/5/07, Vegard Svanberg [EMAIL PROTECTED] wrote: * William A. Rowe, Jr. [EMAIL PROTECTED] [2007-08-05 05:15]: I've looked through the archives, but have not seen this mentioned again since then. I was wondering if this has been discussed any further, possibly moved to other mailing

Re: 1.3 bugs

2007-08-02 Thread Joshua Slive
On 8/2/07, Nick Kew [EMAIL PROTECTED] wrote: As for 2.x bugs, there are quite a few which are going to be harder to deal with. Perhaps we want a new Archived status, for PRs which have merit but which aren't going to get 'fixed'. Particularly those with PatchAvailable. I would just use

Re: [PATCH]: mod_cache: don't store headers that will never be used

2007-07-29 Thread Joshua Slive
On 7/29/07, Graham Leggett [EMAIL PROTECTED] wrote: Niklas Edmundsson wrote: The solution is to NOT rewrite the on-disk headers when the following conditions are true: - The body is NOT stale (ie. HTTP_NOT_MODIFIED when revalidating) - The on-disk header hasn't expired. - The request

Re: Apache configuration (throughput of connection)

2007-06-28 Thread Joshua Slive
On 6/28/07, Niko Wilfritz Sianipar Sianipar [EMAIL PROTECTED] wrote: I have some questions about apache configuration: 1. Does apache can be configured so he can order the clients according to their throughput? I don't know what you mean by order the clients. 2. How can apache know the

Re: Inclusion of mpm-itk into HEAD

2007-06-27 Thread Joshua Slive
On 6/27/07, Nick Kew [EMAIL PROTECTED] wrote: This is a problem that could be solved by documentation. Maybe not quite as simple, but when the alternative is accepting new connections whilst running as root. Here's a start: http://wiki.apache.org/httpd/Recipes/Privilege_Separation It could

Re: Inclusion of mpm-itk into HEAD

2007-06-27 Thread Joshua Slive
On 6/27/07, Rici Lake [EMAIL PROTECTED] wrote: If the user servers are listening on high ports, then they can be started as the user/group rather than as root, and the owner could have quite a bit of flexibility in configuring their server. It's quite possible that less reliance on .htaccess

Re: Inclusion of mpm-itk into HEAD

2007-06-25 Thread Joshua Slive
On 6/25/07, William A. Rowe, Jr. [EMAIL PROTECTED] wrote: That said, have you considered a design where there are separate pools of processes per-user, and these would be dispatched after the headers are processed to the appropriate child? The simplest option is to simply reuse the features

Re: mod_rewrite

2007-06-20 Thread Joshua Slive
On 6/20/07, sonia mukherjee [EMAIL PROTECTED] wrote: Hi All, could any one give me information on whether any Api call is present with Apche 2.2 that gives indication that Rwrite Rule is configured for a particular URL. And if possible with full info on what are the flags that are set (flags

Re: [Issue] External links @ the wiki, aka pagechange wars

2007-05-24 Thread Joshua Slive
On 5/24/07, Yoav Shapira [EMAIL PROTECTED] wrote: Hi, On 5/24/07, Craig McClanahan [EMAIL PROTECTED] wrote: On 5/23/07, William A. Rowe, Jr. [EMAIL PROTECTED] wrote: We have a serious issue to determine, and I've asked for a 48 hour cooldown of wiki.apache.org/httpd/ to make a decision,

Re: [Issue] External links @ the wiki, aka pagechange wars

2007-05-24 Thread Joshua Slive
On 5/24/07, Rich Bowen [EMAIL PROTECTED] wrote: On May 24, 2007, at 04:23, Tony Stevenson wrote: AskApache has had several email conversations with both myself, and Rich. In which he was asked politely, but firmly to not use links to content on his site. NOTE: NOT because external links

Re: [Issue] External links @ the wiki, aka pagechange wars

2007-05-24 Thread Joshua Slive
On 5/24/07, William A. Rowe, Jr. [EMAIL PROTECTED] wrote: [for infra, who is bcc'ed - three * bullets below] * ask infra to reopen the wiki to general write access, * aks infra to please revoke AskApache/their ip from the httpd wiki. +1.

Re: mod_rewrite

2007-05-23 Thread Joshua Slive
Cross-posted and already answered on [EMAIL PROTECTED] On 5/23/07, Marco Polo [EMAIL PROTECTED] wrote: I need to change a bahaviour on the rewrite of the apache server. Right now, if I type in a path that does not exist (like /nopage.html) Apache will serve up the 404 page (/html/404.html),

Re: svn commit: r537429 - in /httpd/httpd/trunk/modules/proxy: mod_proxy.c mod_proxy.h

2007-05-12 Thread Joshua Slive
On 05/12/2007 04:12 PM, [EMAIL PROTECTED] wrote: Author: jim Date: Sat May 12 07:12:24 2007 New Revision: 537429 URL: http://svn.apache.org/viewvc?view=revrev=537429 Log: Add regex pattern matching to ProxyPass, allowing, for example: ProxyPass ~ \.gif balancer://imagecluster On

Re: svn commit: r534533 - in /httpd/httpd/trunk: include/http_core.h modules/aaa/mod_access_compat.c modules/aaa/mod_auth.h modules/aaa/mod_authz_core.c modules/aaa/mod_authz_default.c server/core.c s

2007-05-02 Thread Joshua Slive
On 5/2/07, [EMAIL PROTECTED] [EMAIL PROTECTED] wrote: Author: bnicholes Date: Wed May 2 09:31:39 2007 New Revision: 534533 URL: http://svn.apache.org/viewvc?view=revrev=534533 Log: re-introduce ap_satisfies API back into core and modify how the access_checker, check_user_id and auth_checker

Re: svn commit: r534533 - in /httpd/httpd/trunk: include/http_core.h modules/aaa/mod_access_compat.c modules/aaa/mod_auth.h modules/aaa/mod_authz_core.c modules/aaa/mod_authz_default.c server/core.c s

2007-05-02 Thread Joshua Slive
On 5/2/07, Brad Nicholes [EMAIL PROTECTED] wrote: Yeah, that's where I mentioned that things might look a little confusing. There actually is a good reason to have both and yes some of the functionality can overlap. The reason for having mod_authz_host is so that host, IP, ENV, etc. can

Re: SatisfyOne

2007-04-30 Thread Joshua Slive
On 4/27/07, Brad Nicholes [EMAIL PROTECTED] wrote: It's beginning to look like Order, Allow, Deny, Satisfy can't be deprecated after all. However I still think that there is a usefulness for the same type of authorization rules defined by require. I don't really understand why you say

Re: Apache Http Server Authentication/Authorisation

2007-04-27 Thread Joshua Slive
On 4/27/07, FORAMITTI Laurent [EMAIL PROTECTED] wrote: So I would like to know how is it possible to configure Apache to send some informations about the authenticated user to my AppServer ? Is it possible to add some values to the http header before that the mod_jk or mod_wl forward the

Re: SatisfyOne

2007-04-27 Thread Joshua Slive
On 4/27/07, Patrick Welche [EMAIL PROTECTED] wrote: I expected not to be prompted to login by the above configuration. (also tried AuthBasicAuthoritative Off, and have read the fine manual..) Just to eliminate the obvious, have you actually checked the access_log to verify that the IP

Re: inconsistency in the Order documentation

2007-03-26 Thread Joshua Slive
On 3/26/07, Joe Schaefer [EMAIL PROTECTED] wrote: Since forever, the documentation for Order claims this: Yes, it's broken. It hasn't been that way forever, just since we tried to improve the Order docs last year. I don't think a patch is really necessary -- it is an easy enough fix. I'll see

Re: mime-types

2007-03-23 Thread Joshua Slive
On 3/23/07, System Support [EMAIL PROTECTED] wrote: Randomly the mime-type of my .css files changes from text/css to text/plain. There were a couple of similar bugs reported against caching, but they are shown as being fixed. I did try disabling caching, but it did not seem to help. I

Re: Apache dev site outdated

2007-03-21 Thread Joshua Slive
On 3/21/07, Jan van den Berg [EMAIL PROTECTED] wrote: http://httpd.apache.org/dev/patches.html So who keeps this page up to date? Any reason why this info isn't yet updated? Because nobody has submitted a patch. (Kind of a circular problem, I realize ;-) Feel free to contribute. Joshua.

Re: The right way to report problems (was: uninitialized variable in ap_directory_walk)

2007-03-15 Thread Joshua Slive
On 3/15/07, Torsten Foertsch [EMAIL PROTECTED] wrote: The bug is simple, the patch is simple. Why haven't I got a single reply to my mail? The bug is also still marked as new. What is the right way to report problems? You're doing fine. See: http://httpd.apache.org/dev/patches.html#ignored

cleaned up dist/httpd/binaries

2007-03-09 Thread Joshua Slive
I just deleted all our binary releases from before 2005 that were sitting in our recommended releases directory. They are, of course, all still available from archive.apache.org. With the exception of a few platforms, we just aren't in the business of providing binaries anymore. I don't think

Re: Determining Apache version uppon compilation of module ?

2007-03-06 Thread Joshua Slive
On 3/6/07, Joost de Heer [EMAIL PROTECTED] wrote: Xavier Beaudouin schreef: Hello, I am trying to find a portable way to find what is the version of apache during compilation of a third party module. In include/ap_release.h, the macros AP_SERVER_MAJORVERSION_NUMBER,

Re: How to cache the responses for XMLHttpRquest

2007-03-05 Thread Joshua Slive
On 3/5/07, Erica Zhang [EMAIL PROTECTED] wrote: Hi, I want to cache the responses for XMLHttpRequest, that is dynamic content. I have configureed http.conf using Expires to add headers to those responses. However, I still could not find those responses to be able to be cached by use of web

Re: Questions on configuring Apache Server

2007-02-26 Thread Joshua Slive
On 2/26/07, Erica Zhang [EMAIL PROTECTED] wrote: Hi, I am developing some component, which need Apache to be able to listen to two ports, instead of only one default port. I do not know if there is some way to configure Apache http server to work in this way. I do not want to configure it to be

Re: Redesigning Limit from the ground up.

2007-02-13 Thread Joshua Slive
On 2/13/07, Nick Kew [EMAIL PROTECTED] wrote: Location /limited/ methods=GET POST HEAD I like that a lot. It makes it clear that methods is an option (and hence doesn't generally need to be there), and skirts the whole ordering mess you get by adding a Method container. Directory /dir/

Re: mod_cache: MISS or HIT

2007-02-12 Thread Joshua Slive
On 2/12/07, Dziugas Baltrunas [EMAIL PROTECTED] wrote: I'm trying to figure out the way how to put information in access log (via mod_log_config) whether the request was a cache hit or miss (similar to what squid does - TCP_MISS and TCP_HIT). I think this information is necessary for any proxy

Re: Large Resource Consumption by One User Access to mp3 File

2007-02-08 Thread Joshua Slive
On 2/8/07, Greg Sims [EMAIL PROTECTED] wrote: This consumption of server resource by one user is unfair to everyone else trying to use http at the same time. Is it possible to control resource allocation so that it is fair to all users? The user in question is using some kind of download

Re: Large Resource Consumption by One User Access to mp3 File

2007-02-08 Thread Joshua Slive
On 2/8/07, Greg Sims [EMAIL PROTECTED] wrote: This consumption of resource seems unfair to other users that are trying to use the system at the same time. Is it possible to control resource allocation so that it is fair to all users? Is there something about the response I made to your

Re: Large Resource Consumption by One User Access to mp3 File

2007-02-08 Thread Joshua Slive
On 2/8/07, Joshua Slive [EMAIL PROTECTED] wrote: On 2/8/07, Greg Sims [EMAIL PROTECTED] wrote: This consumption of resource seems unfair to other users that are trying to use the system at the same time. Is it possible to control resource allocation so that it is fair to all users

Re: IE7 wrecks language negotiation

2006-12-11 Thread Joshua Slive
On 12/11/06, Fenlason, Josh [EMAIL PROTECTED] wrote: Is there any way Apache could do the following? 1. Search for a match in the language and language-locale list the client provides 2. If no match was found above, strip off the locale and try again. 3. If there still

Re: IE7 wrecks language negotiation

2006-12-11 Thread Joshua Slive
On 12/11/06, Fenlason, Josh [EMAIL PROTECTED] wrote: I swear that's the behavior I was seeing, but I must have had something messed up. I just tested to verify my complaint and it appears to be working the way I said I wanted it to. Not sure what I messed up, but I must have gotten confused

IE7 wrecks language negotiation

2006-12-08 Thread Joshua Slive
Following up on a question on the users list, I found this blog entry: http://blogs.msdn.com/ie/archive/2006/10/17/accept-language-header-for-internet-explorer-7.aspx which says that IE7 now uses only language/locale pairs in the Accept-Language header. They follow this up with: If a given

Re: vote on concept of ServerTokens Off

2006-12-06 Thread Joshua Slive
On 12/6/06, Jeff Trawick [EMAIL PROTECTED] wrote: We're up to two great answers to disable some output from the server that isn't required by the HTTP protocol anyway: 1) modify the source 2) install third-party module My support for the idea has nothing to do with improving the operation of

Re: vote on concept of ServerTokens Off

2006-12-05 Thread Joshua Slive
On 12/5/06, Joe Orton [EMAIL PROTECTED] wrote: On Tue, Dec 05, 2006 at 06:39:30AM -0500, Jeff Trawick wrote: A lot of opinions were offered back in August. Some were negative but I don't see anything that looks like a veto.

Re: Some authorisation clarification

2006-11-29 Thread Joshua Slive
On 11/29/06, Graham Leggett [EMAIL PROTECTED] wrote: On Wed, November 29, 2006 2:19 pm, Nick Kew wrote: When the configuration is merged, the one that appears later in httpd.conf overrides the other where there is conflict. What constitutes a conflict? What Satisfy value are you using?

Re: svn commit: r467326 - in /httpd/httpd/trunk: ./ docs/manual/mod/ include/ modules/ssl/ server/

2006-10-24 Thread Joshua Slive
On 10/24/06, [EMAIL PROTECTED] [EMAIL PROTECTED] wrote: + dtcodesem/code/dt + ddThis directive tells the SSL Module to pick the best semaphore + implementation available to it, choosing between Posix and SystemV IPC, + in that order. It is only available when the underlying

Re: svn commit: r449514 - in /httpd/httpd: branches/2.2.x/docs/manual/mod/core.xml trunk/docs/manual/mod/core.xml

2006-09-24 Thread Joshua Slive
On 9/24/06, [EMAIL PROTECTED] [EMAIL PROTECTED] wrote: Author: niq Date: Sun Sep 24 15:29:59 2006 New Revision: 449514 URL: http://svn.apache.org/viewvc?view=revrev=449514 Log: Add extra explanatory clause to VirtualHost docs Modified: httpd/httpd/branches/2.2.x/docs/manual/mod/core.xml

Re: [Vote] create [EMAIL PROTECTED]

2006-09-01 Thread Joshua Slive
On 9/1/06, William A. Rowe, Jr. [EMAIL PROTECTED] wrote: Project Committee Members... Adopt [EMAIL PROTECTED], seeded from [EMAIL PROTECTED] current subscribers, for module authors to use for peer developer support? (API 'users', essentially.) +1 Joshua.

Re: Upgrade 2.0.55 - 2.0.59 hangs SSL server

2006-08-28 Thread Joshua Slive
On 8/28/06, Henk Fictorie [EMAIL PROTECTED] wrote: Hi, We tried to upgrade our Apache server from 2.0.55 to 2.0.59. For HTTP traffic this was successful. However for HTTPS the server would hang after a couple of hours (serveral hundred thousands request). Our HTTP and HTTPS servers are

Re: mod_define ported to httpd 2.0/2.2

2006-08-25 Thread Joshua Slive
On 8/25/06, Rainer Jung [EMAIL PROTECTED] wrote: I put the code up on http://people.apache.org/~rjung/mod_define/ Comments are welcome. For big sites and well trained admins having an external tool like m4, scripting languages, ant etc. might be the better way to use config templates. But for

Re: 1.3 modification question

2006-08-22 Thread Joshua Slive
On 8/22/06, hbeaumont hbeaumont [EMAIL PROTECTED] wrote: Are there any obvious flaws? Horrible performance? Thanks for any comments or direction to a better place to ask. Search the archives of this list and the users list for any thread mentioning perchild. You'll find the challenges

Re: CGI Script Source Code Disclosure Vulnerability in Apache for Windows

2006-08-20 Thread Joshua Slive
On 8/20/06, Carsten Wiedmann [EMAIL PROTECTED] wrote: You have some examples? http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0017 A HTTP server must process the abs_path from an URI in a case-sensitive manner. Thus with a case-sensitive filesystem it's enough to build a canonical /

Re: CGI Script Source Code Disclosure Vulnerability in Apache for Windows

2006-08-20 Thread Joshua Slive
On 8/20/06, Guy Hulbert [EMAIL PROTECTED] wrote: On Sun, 2006-20-08 at 08:36 -0400, Joshua Slive wrote: But why is there the Directive ScriptAlias? -- This Directive should then better be removed. It could easily be removed. It is a convenience directive for the Not if you don't want

Re: [PATCH 40026] ServerTokens Off

2006-08-20 Thread Joshua Slive
On 8/20/06, Lars Eilebrecht [EMAIL PROTECTED] wrote: For offering such an option with Apache I've only seen two arguments: 1. Making the server more secure by not revealing any (or fake) server information. 2. Saving bandwidth. 3. Make all the crazy people go away. There may be no

Re: CGI Script Source Code Disclosure Vulnerability in Apache for Windows

2006-08-19 Thread Joshua Slive
On 8/19/06, Carsten Wiedmann [EMAIL PROTECTED] wrote: Why is it really bad to have a ScriptAlias inside the DocumentRoot? It's only another file system location. And it's only one line in the config file instead of four. You have only a problem because of the unexpected behavior of httpd with

Re: CGI Script Source Code Disclosure Vulnerability in Apache for Windows

2006-08-19 Thread Joshua Slive
On 8/19/06, Carsten Wiedmann [EMAIL PROTECTED] wrote: [I don't agree with large chunks of what you wrote, but the crux of the matter is here:] And why are sometimes (part of) the URI is case-sensitive and somtimes not and what happens in consequence because of this behavior. And this behavior

Re: CGI Script Source Code Disclosure Vulnerability in Apache for Windows

2006-08-18 Thread Joshua Slive
On 8/18/06, Mark J Cox [EMAIL PROTECTED] wrote: See http://marc.theaimsgroup.com/?l=bugtraqm=115527423727441w=2 which basically reports if you put cgi-bin under docroot then you can view cgi scripts on OS which have case insensitive filesystems Joe replied:

Re: CGI Script Source Code Disclosure Vulnerability in Apache for Windows

2006-08-18 Thread Joshua Slive
On 8/18/06, Carsten Wiedmann [EMAIL PROTECTED] wrote: Joshua Slive schrieb: On 8/18/06, Mark J Cox [EMAIL PROTECTED] wrote: I think the right response here is to make it more explicit in the documentation that putting a ScriptAlias cgi-bin inside document root is bad. Yes

Re: [PATCH 40026] ServerTokens Off

2006-08-12 Thread Joshua Slive
On 8/12/06, Eli Marmor [EMAIL PROTECTED] wrote: But if this option is a so strong dream for somebody, the minimum that can be done to help a little, is a strong recommendation against using this option, in the documentation. I'm +1 on the concept for this patch (I haven't reviewed the code).

Re: Tracking CGI Exec Calls

2006-08-11 Thread Joshua Slive
On 8/11/06, Silvio Mazzaro [EMAIL PROTECTED] wrote: Guy Hulbert wrote: What is the problem you are trying to solve ? I'd like to know who's using sendmail from the Web. This is a hint ... do you want to prevent CGI scripts from calling sendmail ? No, It's important for my users to use

Re: Tracking CGI Exec Calls

2006-08-11 Thread Joshua Slive
On 8/11/06, Guy Hulbert [EMAIL PROTECTED] wrote: On Fri, 2006-11-08 at 09:47 -0400, Joshua Slive wrote: On 8/11/06, Silvio Mazzaro [EMAIL PROTECTED] wrote: Guy Hulbert wrote: What is the problem you are trying to solve ? I'd like to know who's using sendmail from the Web. snip

Re: svn commit: r427780 - in /httpd/httpd/trunk: docs/manual/mod/mod_authz_core.xml modules/aaa/mod_auth.h modules/aaa/mod_authz_core.c

2006-08-01 Thread Joshua Slive
On 8/1/06, [EMAIL PROTECTED] [EMAIL PROTECTED] wrote: Author: bnicholes Date: Tue Aug 1 15:54:38 2006 New Revision: 427780 URL: http://svn.apache.org/viewvc?rev=427780view=rev Log: Converted the reject directive to be definitive and enabled directory_merge to merge all of the authorization

Re: svn commit: r424817 - /httpd/httpd/trunk/docs/conf/extra/httpd-dav.conf.in

2006-07-23 Thread Joshua Slive
On 7/23/06, William A. Rowe, Jr. [EMAIL PROTECTED] wrote: @@ServerRoot@@ doesn't guarantee that either :-/ grrr - please don't start commit wars by reverting without some small post to discuss? Here's the reply I sent to your original commit (msgid [EMAIL PROTECTED]). I didn't receive a

Re: svn commit: r410757 - /httpd/httpd/trunk/docs/conf/extra/httpd-info.conf.in

2006-06-01 Thread Joshua Slive
On 6/1/06, [EMAIL PROTECTED] [EMAIL PROTECTED] wrote: Add example/default allow-from for localhost, please??? Location /server-status SetHandler server-status Require host .example.com +Allow from 127 /Location I think you are looking for Require ip 127 or something like

Re: svn commit: r410758 - /httpd/httpd/trunk/docs/conf/extra/httpd-dav.conf.in

2006-06-01 Thread Joshua Slive
On 6/1/06, [EMAIL PROTECTED] [EMAIL PROTECTED] wrote: Ewww... can't we be consistant with our workfiles paths? -DavLockDB @@ServerRoot@@/var/DavLock +DavLockDB @exp_runtimedir@/DavLock I believe the issue here is that exp_runtimedir is writable only by root, while DavLockDB needs to be

Re: svn commit: r410761 - /httpd/httpd/trunk/docs/conf/extra/httpd-mpm.conf.in

2006-06-01 Thread Joshua Slive
On 6/1/06, [EMAIL PROTECTED] [EMAIL PROTECTED] wrote: Author: wrowe Date: Wed May 31 22:42:13 2006 New Revision: 410761 URL: http://svn.apache.org/viewvc?rev=410761view=rev Log: That's the point, isn't it? All mpm's in one basket? Sure, but windows has its own config file where we left

Re: Disable multiple file extension support?

2006-05-25 Thread Joshua Slive
On 5/25/06, Rich Bowen [EMAIL PROTECTED] wrote: The folks at Drupal have apparently just discovered that something.php.bar is executed as PHP, and, thus, checking to see if a file ends with .php is not sufficient to ensure that their file upload feature can't be exploited. In fact, they have a

Re: How do I get PATH_INFO from 2.0

2006-05-18 Thread Joshua Slive
On 5/18/06, pradeep kumar [EMAIL PROTECTED] wrote: Hi, Is there any other way of getting PATH_INFO without using mod_include? More details please. PATH_INFO works find in 2.x. Perhaps you need to look at the AllowPathInfo directive. Joshua.

Re: changing request priority in Apache2.2

2006-05-10 Thread Joshua Slive
On 5/10/06, Tiago Semprebom [EMAIL PROTECTED] wrote: Hello, I'm developing a new handler module in apache, in this module I need to do some changes in the incoming requests, like change the request priority, for example: I need to intercept the request and in some away to change or set a

Re: Laying undead myths to rest

2006-05-08 Thread Joshua Slive
On 5/8/06, Joseph Dane [EMAIL PROTECTED] wrote: Joshua Slive [EMAIL PROTECTED] writes: In very early versions of the Apache HTTP Server, the directiveAddType/directive directive was also used to activate special server-side processing (such as modulemod_include/module or PHP) by assigning

Re: apr_brigade_insert_file() LFS/Linux issues

2006-05-03 Thread Joshua Slive
On 5/3/06, Joe Orton [EMAIL PROTECTED] wrote: On Wed, May 03, 2006 at 02:39:33PM +0200, Niklas Edmundsson wrote: I've run into apr_brigade_insert_file() creating brigades that's not possible to sendfile() (EINVAL), this is with httpd-2.2.2 on Ubuntu Breezy Linux amd64 (64bit). The file in

Re: Email address on mail archive (fwd)

2006-04-28 Thread Joshua Slive
On 4/28/06, Justin Erenkrantz [EMAIL PROTECTED] wrote: On 4/27/06, Joshua Slive [EMAIL PROTECTED] wrote: I know there are people who still hold the idealistic view that we shouldn't be obscuring email addresses at all. Although I agree in principle, I think the world has passed that view

Fwd: Email address on mail archive (fwd)

2006-04-27 Thread Joshua Slive
This type of request is becoming more and more common. Although mod_mbox obscures the basic to and from address, there are still two problems: 1. It doesn't obscure email addresses in the body of the message (which could be from forwarded/quoted messages). 2. The raw link still gives access to

Re: 304 response handling with Apache 2.0.53

2006-04-24 Thread Joshua Slive
On 4/24/06, Swapan Gupta [EMAIL PROTECTED] wrote: Hi, I am using Apache 2.0.53. I am observing that when a 304 Not Modified response is returned accompanied by the Location header, the Location does not reach the user. I could see that this header is not mentioned in the RFC for 304

Re: copyright notices

2006-04-21 Thread Joshua Slive
On 4/21/06, Roy T. Fielding [EMAIL PROTECTED] wrote: I don't know of any reason to hurry a 2.0.x release (heck, I don't know of any reason to continue its development), but I also don't think releasing one with modified copyright years is any more or less legal than continuing to distribute

Re: HTTP_X_FORWARDED_FOR in mod_proxy

2006-04-20 Thread Joshua Slive
On 4/20/06, Matthias Behrens [EMAIL PROTECTED] wrote: thx doesnt seem to work on 2.0 its a 2.2 feature isnt it? The early option, which may be necessary here, is a 2.2 feature. Joshua.

Re: HTTP_X_FORWARDED_FOR in mod_proxy

2006-04-19 Thread Joshua Slive
On 4/18/06, Matthias Behrens [EMAIL PROTECTED] wrote: hi is there a way to overwrite the HTTP_X_FORWARDED_FOR instead of adding to it? the problem is that the content of this headerline is sometimes totally chaotic so its very difficult to parse. other possible solutions would be: - to

Re: Protecting a file with a password

2006-03-06 Thread Joshua Slive
On 3/6/06, Graham Leggett [EMAIL PROTECTED] wrote: Hi all, I have just tried to convince httpd v2.2.0 to password protect a single file on the filesystem, but without any success. Does anybody know whether this is possible? I tried Location /cgi-bin/dir/file.cgi and Files

Re: Integration Apache2.0.48 and an existing server

2006-02-25 Thread Joshua Slive
On 2/25/06, Arshad Ahamad [EMAIL PROTECTED] wrote: Hello all, I have configure Apache-2.0.48 successfully.Now I would like to integrate Apache-2.0.48 and existing server. So I am unable to start this work ,I am too much confused either Apache embedded into the existing server OR

Re: how does this get changed?

2006-02-17 Thread Joshua Slive
On 2/17/06, Joost de Heer [EMAIL PROTECTED] wrote: 'Breaking a config file' is IMO that you can't just copy your 2.0 config file and it works. And the new mod_auth(n|z) structure just did that: A 2.0 config file needed changes to work in 2.2. Only if you are using dynamically loaded modules.

Re: how does this get changed?

2006-02-16 Thread Joshua Slive
On 2/16/06, David Reid [EMAIL PROTECTED] wrote: Rather than try and piece it together, can someone simply answer this simple question? Maybe then this mail and your reply will help other poor souls trying to make the change. Convert this Order deny,allow Deny from all Require all denied

Re: how does this get changed?

2006-02-16 Thread Joshua Slive
On 2/16/06, Graham Leggett [EMAIL PROTECTED] wrote: Ian Holsman wrote: maybe if mod_access_compat is included by default statically into httpd itself? (unless explicitly disabled) we could make it optional in 2.6 (and remove docs on it), and remove in 2.8 or something. this will give

Re: Change in how to configure authorization

2006-02-10 Thread Joshua Slive
On 2/10/06, David Reid [EMAIL PROTECTED] wrote: Joshua Slive wrote: On 1/26/06, Ian Holsman [EMAIL PROTECTED] wrote: Hi Joshua: httpd.conf.in has the new structure httpd-std.conf (the one I was looking at) didn't ;( Hmmm... httpd-std.conf doesn't exist in trunk. Just ran

mod_mbox cores on ajax

2006-02-09 Thread Joshua Slive
I hadn't checked in a while, but there seem to be lots of mod_mbox cores on ajax again. Here's one backtrace: #0 mbox_cte_escape_html (p=0x60343ca8, s=0x602f5a68 --_=_NextPart_001_01C3C08D.F854E1E0\nContent-Type: text/html;Content-Transfer-Encoding:

  1   2   3   4   5   6   >