Releases

2009-05-22 Thread Jim Jagielski
Considering that APR is looking at a release of 1.3 soon, I think it's time to start the ball regarding 2.2.12. I offer to RM. Also, I'd like to also look into another beta of mod_ftp and review on whether the show-stopper should be considered one (I'd like to get a 1.0.0 out).

DO NOT REPLY [Bug 30586] Apache htdbm utility buffer overflows/format strings

2009-05-22 Thread Nick Kew
On Fri, 22 May 2009 07:38:16 -0700 (PDT) bugzi...@apache.org wrote: [ouch, just replied to bugs@ - sorry] > https://issues.apache.org/bugzilla/show_bug.cgi?id=30586 > --- Comment #1 from Dan Poirier 2009-05-22 > 07:38:14 PST --- It looks like this is still a potential issue in > trunk. Looks

Re: svn commit: r773881 - in /httpd/httpd/branches/2.2.x: CHANGES STATUS include/http_core.h modules/filters/mod_include.c server/config.c server/core.c

2009-05-22 Thread Joe Orton
On Thu, May 21, 2009 at 02:39:57PM -0400, Jeff Trawick wrote: > On Wed, May 20, 2009 at 8:53 AM, Joe Orton wrote: > > Given that the semantics of the options has changed, I don't think it's > > worth changing httpd to maintain any pretence of compile-time or > > run-time compatibility here. Any c

Re: svn commit: r773881 - in /httpd/httpd/branches/2.2.x: CHANGES STATUS include/http_core.h modules/filters/mod_include.c server/config.c server/core.c

2009-05-22 Thread Joe Orton
On Fri, May 22, 2009 at 05:26:07PM +0100, Joe Orton wrote: > Attaching my original analysis for security@ which hopefully answers > that question ;) attempt 2 I've now had a deeper look into this. I can't see a way to fix the problem without changing the semantics of the OPT_ bits used, as I

Re: svn commit: r773881 - in /httpd/httpd/branches/2.2.x: CHANGES STATUS include/http_core.h modules/filters/mod_include.c server/config.c server/core.c

2009-05-22 Thread Jeff Trawick
On Fri, May 22, 2009 at 12:33 PM, Fred Moyer wrote: > On Thu, May 21, 2009 at 12:25 PM, Jeff Trawick wrote: > > On Thu, May 21, 2009 at 3:08 PM, William A. Rowe, Jr. < > wr...@rowe-clan.net> > > wrote: > >> Jeff Trawick wrote: > >> > Does somebody else care to share their opinion on this? Which

Re: svn commit: r773881 - in /httpd/httpd/branches/2.2.x: CHANGES STATUS include/http_core.h modules/filters/mod_include.c server/config.c server/core.c

2009-05-22 Thread Jeff Trawick
On Thu, May 21, 2009 at 3:25 PM, Jeff Trawick wrote: > > > On Thu, May 21, 2009 at 3:08 PM, William A. Rowe, Jr. > wrote: > >> Jeff Trawick wrote: >> > Does somebody else care to share their opinion on this? Which of these >> > are okay? >> > >> > - existing mod_perl releases (and potentially o

Re: svn commit: r773881 - in /httpd/httpd/branches/2.2.x: CHANGES STATUS include/http_core.h modules/filters/mod_include.c server/config.c server/core.c

2009-05-22 Thread Torsten Foertsch
On Fri 22 May 2009, Jeff Trawick wrote: > Hmmm, after trying to use what seems like a cool feature, I find that > mod_perl was never taught to use the Apache 2's mod_include plug-in > interface. AFAIK, that is provided by Geoff's CPAN module Apache::IncludeHook or so. Torsten -- Need professio

Re: svn commit: r777499 - in /httpd/mod_ftp/trunk: CHANGES CHANGES-FTP LICENSE LICENSE-FTP NOTICE NOTICE-FTP README README-FTP STATUS STATUS-FTP

2009-05-22 Thread William A. Rowe, Jr.
j...@apache.org wrote: > Author: jim > Date: Fri May 22 12:49:41 2009 > New Revision: 777499 > > URL: http://svn.apache.org/viewvc?rev=777499&view=rev > Log: > No need (that I can see) to have the -FTP suffix here -1 Veto, reverting. Not even LICENSE, which would normally be just the AL 2.0 can

Re: svn commit: r773881 - in /httpd/httpd/branches/2.2.x: CHANGES STATUS include/http_core.h modules/filters/mod_include.c server/config.c server/core.c

2009-05-22 Thread William A. Rowe, Jr.
Joe Orton wrote: > > Having thought about this longer, I do agree that it would be reasonable > to provide OPT_INCNOEXEC as a noop integer for back-compat, but, it > turns out we're out of bits - allow_options_t is an unsigned char and > we're using 2^0 through 2^7 already. :( The C langauge p

Re: svn commit: r773881 - in /httpd/httpd/branches/2.2.x: CHANGES STATUS include/http_core.h modules/filters/mod_include.c server/config.c server/core.c

2009-05-22 Thread Jeff Trawick
On Fri, May 22, 2009 at 2:46 PM, Torsten Foertsch wrote: > On Fri 22 May 2009, Jeff Trawick wrote: > > Hmmm, after trying to use what seems like a cool feature, I find that > > mod_perl was never taught to use the Apache 2's mod_include plug-in > > interface. > > AFAIK, that is provided by Geoff's

Re: svn commit: r773881 - in /httpd/httpd/branches/2.2.x: CHANGES STATUS include/http_core.h modules/filters/mod_include.c server/config.c server/core.c

2009-05-22 Thread Jeff Trawick
On Fri, May 22, 2009 at 2:59 PM, William A. Rowe, Jr. wrote: > Joe Orton wrote: > > > > Having thought about this longer, I do agree that it would be reasonable > > to provide OPT_INCNOEXEC as a noop integer for back-compat, but, it > > turns out we're out of bits - allow_options_t is an unsigned

Re: svn commit: r773881 - in /httpd/httpd/branches/2.2.x: CHANGES STATUS include/http_core.h modules/filters/mod_include.c server/config.c server/core.c

2009-05-22 Thread Jeff Trawick
On Fri, May 22, 2009 at 4:21 PM, Jeff Trawick wrote: > > > On Fri, May 22, 2009 at 2:59 PM, William A. Rowe, Jr. > wrote: > >> Joe Orton wrote: >> > >> > Having thought about this longer, I do agree that it would be reasonable >> > to provide OPT_INCNOEXEC as a noop integer for back-compat, but,

Re: svn commit: r773881 - in /httpd/httpd/branches/2.2.x: CHANGES STATUS include/http_core.h modules/filters/mod_include.c server/config.c server/core.c

2009-05-22 Thread William A. Rowe, Jr.
Jeff Trawick wrote: > > Backing up a bit... > > I originally thought we could map bit values in 2.2.x to avoid affecting > modules, but that isn't possible since includes-with-exec is two bits > instead of one. Hold on... I think this can still work; * Retain new true 'Includes' bit as old In

[concept PATCH] CVE-2009-1195 tweaks to provide binary compatibility for stable branches

2009-05-22 Thread Jeff Trawick
(untested) ap_allow_options() is how applications, including our mod_include, access the enabled options for a given request (other than evil apps which define CORE_PRIVATE and locate the core_dir_config). As this is a callable function, it can map internal, hidden bitmaps as appropriate before r

Re: svn commit: r773881 - in /httpd/httpd/branches/2.2.x: CHANGES STATUS include/http_core.h modules/filters/mod_include.c server/config.c server/core.c

2009-05-22 Thread Jeff Trawick
On Fri, May 22, 2009 at 5:10 PM, William A. Rowe, Jr. wrote: > Jeff Trawick wrote: > > > > Backing up a bit... > > > > I originally thought we could map bit values in 2.2.x to avoid affecting > > modules, but that isn't possible since includes-with-exec is two bits > > instead of one. > > Hold on.

Re: [concept PATCH] CVE-2009-1195 tweaks to provide binary compatibility for stable branches

2009-05-22 Thread Jeff Trawick
On Fri, May 22, 2009 at 5:12 PM, Jeff Trawick wrote: > (untested) These references to OPT_ALL should be OPT_PVT_ALL. ./server/config.c:parms.override_opts = OPT_ALL | OPT_SYM_OWNER | OPT_MULTI; ./server/config.c:parms.override_opts = OPT_ALL | OPT_SYM_OWNER | OPT_MULTI; ./server/config