*) SECURITY: CVE-2017-9798 (cve.mitre.org)
Corrupted or freed memory access. <Limit[Except]> must now be used in the
main configuration file (httpd.conf) to register HTTP methods before the
.htaccess files. [Yann Ylavic]
*) event: Avoid possible blocking in the listener thread when shutting down
connections. PR 60956. [Yann Ylavic]
*) mod_speling: Don't embed referer data in a link in error page.
PR 38923 [Nick Kew]
*) htdigest: prevent a buffer overflow when a string exceeds the allowed max
length in a password file.
[Luca Toscano, Hanno Böck <hanno hboeck de>]
*) mod_proxy: loadfactor parameter can now be a decimal number (eg: 1.25).
[Jim Jagielski]
*) mod_proxy_wstunnel: Allow upgrade to any protocol dynamically.
PR 61142.
*) mod_watchdog/mod_proxy_hcheck: Time intervals can now be spefified
down to the millisecond. Supports 'mi' (minute), 'ms' (millisecond),
's' (second) and 'hr' (hour!) time suffixes. [Jim Jagielski]
*) mod_http2: Fix for stalling when more than 32KB are written to a
suspended stream. [Stefan Eissing]
*) build: allow configuration without APR sources. [Jacob Champion]
*) mod_ssl, ab: Fix compatibility with LibreSSL. PR 61184.
[Bernard Spil <brnrd freebsd.org>, Michael Schlenker <msc contact.de>,
Yann Ylavic]
*) core/log: Support use of optional "tag" in syslog entries.
PR 60525. [Ben Rubson <ben.rubson gmail.com>, Jim Jagielski]
*) mod_proxy: Fix ProxyAddHeaders merging. [Joe Orton]
*) core: Disallow multiple Listen on the same IP:port when listener buckets
are configured (ListenCoresBucketsRatio > 0), consistently with the single
OBS-URL: https://build.opensuse.org/package/show/Apache/apache2?expand=0&rev=527
*) COMPATIBILITY: mod_lua: Remove the undocumented exported 'apr_table'
global variable when using Lua 5.2 or later. This was exported as a
side effect from luaL_register, which is no longer supported as of
Lua 5.2 which deprecates pollution of the global namespace.
[Rainer Jung]
*) COMPATIBILITY: mod_http2: Disable and give warning when using Prefork.
The server will continue to run, but HTTP/2 will no longer be negotiated.
[Stefan Eissing]
*) COMPATIBILITY: mod_proxy_fcgi: Revert to 2.4.20 FCGI behavior for the
default ProxyFCGIBackendType, fixing a regression with PHP-FPM. PR 61202.
[Jacob Champion, Jim Jagielski]
*) mod_lua: Improve compatibility with Lua 5.1, 5.2 and 5.3.
PR58188, PR60831, PR61245. [Rainer Jung]
*) mod_http2: Simplify ready queue, less memory and better performance. Update
mod_http2 version to 1.10.7. [Stefan Eissing]
*) Allow single-char field names inadvertantly disallowed in 2.4.25.
PR 61220. [Yann Ylavic]
*) htpasswd / htdigest: Do not apply the strict permissions of the temporary
passwd file to a possibly existing passwd file. PR 61240. [Ruediger Pluem]
*) core: Avoid duplicate HEAD in Allow header.
This is a regression in 2.4.24 (unreleased), 2.4.25 and 2.4.26.
PR 61207. [Christophe Jaillet]
- drop upstreamed patch:
* httpd-2.4.12-lua-5.2.patch (see upstream's PR#58188 for details)
OBS-URL: https://build.opensuse.org/package/show/Apache/apache2?expand=0&rev=518
- Added new HTTP2 option to sysconfig to ease enabling http2
- Added new protocols.conf which is included globally
- Enable http2 also for Leap 42.2+ and SLE12_SP2+
Sorry for the shifted lines: OBS/OSC or whatever always tends to shift lines around in the spec-file and to shorten lines like "%doc %{_mandir}/man..." to "%{_mandir}/man..."
The spec's diff seems to be incomplete in the GUI
OBS-URL: https://build.opensuse.org/request/show/449682
OBS-URL: https://build.opensuse.org/package/show/Apache/apache2?expand=0&rev=497
- add patch: httpd-2.4.12-lua-5.2.patch
* lua_dump introduced a new strip option in 5.3, set it to 0
to get the old behavior
* luaL_register was deprecated in 5.2, use luaL_setfuncs and
luaL_newlib instead
* luaL_optint was deprecated in 5.3, use luaL_optinteger instead
* lua_strlen and lua_objlen wad deprecated in 5.2, use lua_rawlen
instead
OBS-URL: https://build.opensuse.org/request/show/317328
OBS-URL: https://build.opensuse.org/package/show/Apache/apache2?expand=0&rev=455
- change Provides: from suse_maintenance_mmn = # to
suse_maintenance_mmn_#
- apache2 Suggests:, not Recommends: apache2-prefork; that means
for example, that `zypper in apache2-worker` will not pull
apache2-prefork also
- installing /usr/sbin/httpd link:
* do not try to install it in '%post <MPM>' when apache2 (which
includes /usr/share/apache2/script-helpers) is not installed
yet (fixes installation on 11sp3)
* install it in '%post' if apache2 is installed after
apache2-<MPM> to be sure it is there
OBS-URL: https://build.opensuse.org/request/show/317068
OBS-URL: https://build.opensuse.org/package/show/Apache/apache2?expand=0&rev=454
- access_compat shared also for 11sp3
- apache2-implicit-pointer-decl.patch renamed to
httpd-implicit-pointer-decl.patch to align with other
patches names
- apachectl is now wrapper to start_apache2; therefore, it honors
HTTPD_INSTANCE variable, see README-instances.txt for details
+ httpd-apachectl.patch
- httpd-2.4.10-apachectl.patch
- a2enmod/a2dismod and a2enflag/a2disflag now respect
HTTPD_INSTANCE=<instance_name> environment variable, which can be
used to specify apache instance name; sysconfig file is expected
at /etc/sysconfig/apache2@<instance_name>
(see README-instances.txt for details)
- provides suse_maintenance_mmn symbol [bnc#915666] (internal)
- credits to Roman Drahtmueller:
* add reference to /etc/permissions.local to output of %post if
setting the permissions of suexec2 fails
* do not enable mod_php5 by default any longer
* httpd-2.0.49-log_server_status.dif obsoleted
* apache2-mod_ssl_npn.patch removed because not used
* include mod_reqtimeout.conf in httpd.conf
* added cgid-timeout.conf, include
it in httpd.conf
- fix default value APACHE_MODULES in sysconfig file
- %service_* macros for apache2@.service
OBS-URL: https://build.opensuse.org/request/show/316550
OBS-URL: https://build.opensuse.org/package/show/Apache/apache2?expand=0&rev=453
- allow to run multiple instances of Apache on one system
[fate#317786] (internal)
* distributed httpd.conf no longer includes sysconfig.d, nor this
directory is shipped. httpd.conf includes loadmodule.conf and
global.conf which are former sysconfig.d/loadmodule.conf and
sysconfig.d/global.conf for default /etc/sysconfig/apache2
global.conf and loadmodule.conf are not included when
sysconfig variables could have been read by start_apache2
startup script (run with systemd services). Therefore, when
starting server via /usr/sbin/httpd, sysconfig variables
are not taken into account.
* some not-maintained scripts are moved from
/usr/share/apache2 to /usr/share/apache2/deprecated-scripts
* all modules comment in sysconfig file is not generated
anymore
* added README-instances.txt
* removed Sources:
load_configuration
find_mpm
get_module_list
get_includes
find_httpd_includes
apache-find-directives
* added Sources:
deprecated-scripts.tar.xz
apache2-README-instances.txt
apache2-loadmodule.conf
apache2-global.conf
apache2-find-directives
apache2@.service
OBS-URL: https://build.opensuse.org/request/show/314699
OBS-URL: https://build.opensuse.org/package/show/Apache/apache2?expand=0&rev=452
