Upgrading NCSA httpd

httpd 1.2 -> httpd 1.3

httpd 1.3 is a maintenance release designed to fix some of the bugs which were introduced in httpd 1.2.

Changes from httpd 1.2

Now compiles cleanly under A/UX and Solaris.
Directory indexing bugs repaired, new options to suppress last modified, size, and description columns (thanks Tanmoy.)
Wildcard based access control should work this time.
Fixed core dump related to recursive parsed document include.
Fixed bug by which httpd would not follow a symbolic link it should have.
Fixed file typing (no longer case sensitive like in 1.2.)
Parent directory escaped in indexes.
IdentityCheck should work again.
LAST_MODIFIED and #flastmod are now local zone.
Time related functions work with NeXT now.
Fixed spelling error in 500 error page.
Server will log proper timeout message for non-DNS hosts.
Added x-bit hack for people to use the x-bit of an HTML file to determine if it is parsed or not.
Added compile defines so people can customize the amount of DNS the server performs (for speed).

httpd 1.1 -> httpd 1.2

httpd 1.2 makes some significant changes over httpd 1.1. These changes make its "look and feel" a bit different than 1.1.

New features

The CGI interface is now revised to version 1.1. See the changes that were made.
A new logfile format was agreed upon which should simplify the lives of the authors of logfile analyzers. Quickly, the format is:
```
host rfc931 authuser [DD/Mon/YYYY:hh:mm:ss [+/-]HHMM] "request" status bytes
```
Host = hostname
rfc931 = RFC931 user name if IdentityCheck active, - if not.
authuser = HTTP/1.0 authenticated user, - if none.
DD/Mon/YYY:hh:mm:ss [+/-]HHMM: Local time of the request with timezone offset from GMT at end.
"request" = the request as sent by the client
status = the HTTP/1.0 status code from this transaction
bytes = the count of the bytes sent in this transaction, not including the header. If not applicable, this will be a - character.
CGI scripts are now allowed anywhere. See this tutorial on the new setup (and how it relates to the old setup), and how to disable this feature in places you don't want it.
The server side includes interface has been completely rewritten. See this tutorial to learn how to convert your old INC SRV documents, and to learn how to take advantage of the new features.
There is a new access control option to disable symbolic links only if the owner of the pointer is not the same as the owner of that which is pointed to. This means your users can have symbolic links to things they own, but not to dangerous things like /etc.
A new access control method called mutual-failure has been added. This method is a bit unorthodox, but allows you to allow hosts from one domain while excluding certain hosts (such as public access machines) from that domain.
Wildcard expressions are now allowed in various areas of server configuration, to allow patterns to be specified. This is most useful in the Directory directive.
Directory indexing has been revamped. It looks much different, and I've written a short tutorial on how to set it up.
Access Control Files now allow the indexing directives as well as the DefaultType directive.
require user now allows quotes for PGP usernames with spaces.
Server now explicitly kills CGI scripts when the client aborts.
Server now verifies the DNS hostname it gets from the IP number to prevent PTR spoofs.
Support for 304 and If-modified-since.

Bug fixes

All of the known bugs in 1.1 have now been fixed. Now it's time to find the ones I introduce with 1.2.

Fixed problem running scripts in ServerMode inetd under IRIX.
Fixed bad port problem under OSF/1.
Inserted missing return statement for the IdentityCheck directive.
Fixed problem whereby errors would stop being logged after a restart.
Fixed 256 character limitation on CGI URLs.

httpd 1.0 -> httpd 1.1

httpd 1.1 should plug right in if you already have httpd 1.0.

Introduced experimental PEM/PGP based encrypted user authentication. See this overview to read about trying it out.
Improved directory indexing. See the new directives in srm.conf to use it.
Cleaned up error output and fixed horrible output when server-side include error occurred
Fixed slight bug in buffering code
Directory indexing for user-supported directories fixed
Retrieval of user supported directory with no trailing slash issues redirect again
Now supports RFC931 identd for logging purposes. See the IdentityCheck directive.
stderr for scripts and server side includes now sent to error_log
Fixed bug in NCSA POST script code which would cause Location: to be ignored for local files
Removed misfeature wherein Location: url's were being escaped by the server
Args to INC SRVURL escaped to avoid unpleasant surprises
Location: /cgi-bin/foo?arg now works
HEAD only for CGI scripts now ignores body put out by stupid scripts

httpd 1.0a5 -> httpd1.0

httpd 1.0 is fairly similar to httpd 1.0a5.

Changes which directly require configuration changes

ScriptAlias now used for CGI scripts only, access your NCSA scripts with OldScriptAlias
Fixed AddType directive
The NCSA scripts are no longer included, CGI replacements are now included

Other changes

NCSA POST scripts now have REMOTE_HOST set
Added AddEncoding directive to srm.conf and .htaccess
error_log now logs all failed accesses and the reason for failure
Time headers are now RFC822 compliant
You can now alias or disable user-supported directories
Added a require directive to allow you to allow any valid user
I/O is now buffered into chunks for speed
Redirect no longer supported from .htaccess files.
Added -v and -f command line flags

Return to Overview

httpd@ncsa.uiuc.edu