{"id":537,"date":"2008-10-04T00:00:00","date_gmt":"2008-10-03T16:00:00","guid":{"rendered":"http:\/\/www.strongd.net\/?p=537"},"modified":"2011-03-19T13:45:45","modified_gmt":"2011-03-19T05:45:45","slug":"lighttpd-1-4-20%e5%8f%91%e5%b8%83","status":"publish","type":"post","link":"https:\/\/www.strongd.net\/?p=537","title":{"rendered":"lighttpd 1.4.20\u53d1\u5e03"},"content":{"rendered":"<p><span class=\"Apple-style-span\" style=\"font-family: Arial; font-size: 14px; line-height: 25px; \">9\u670830\u65e5lighttpd 1.4.20\u7248\u672c\u53d1\u5e03\u4e86\u3002lighttpd\u4e0d\u7528\u591a\u4ecb\u7ecd\u4e86\uff0c\u73b0\u5728\u975e\u5e38\u6d41\u884c\u7684\u8f7b\u91cf\u7ea7Web\u670d\u52a1\u5668\uff0c\u63d0\u4f9b\u826f\u597d\u7684Ruby on Rails\uff0cPHP\u548cPython\u7684FastCGI\/SCGI\u8fd0\u884c\u65b9\u5f0f\u7684\u652f\u6301\u3002\u00a0<\/p>\n<p>lighttpd1.4.20\u7248\u672c\u662f1.4.x\u7cfb\u5217\u7684\u6700\u65b0\u7684\u7ef4\u62a4\u7248\u672c\uff0c\u4fee\u590d\u4e86\u4ece1.4.19\u4ee5\u6765\u5927\u91cf\u7684\u5c0fbug\uff0c\u4e5f\u662f\u76ee\u524dlighttpd\u6700\u7a33\u5b9a\u6700\u597d\u7684\u7248\u672c\uff0c\u63a8\u8350\u5347\u7ea7\u3002\u8fd9\u4e2a\u7248\u672c\u6bd4\u8f83\u5173\u6ce8\u7684bug\u4fee\u590d\u662f\u4e00\u4e9bHTTP\u4e0d\u89c4\u8303\u7684400\u8bf7\u6c42\u9020\u6210\u7684\u5185\u5b58\u6cc4\u6f0f\u95ee\u9898\u4ee5\u53caSSL\u5904\u7406\u7684\u95ee\u9898\u9020\u6210\u7684DOS\u653b\u51fb\u3002\u4ee5\u4e0b\u662f\u8be6\u7ec6\u66f4\u65b0\u8bb0\u5f55\uff1a\u00a0<\/p>\n<div class=\"quote_title\" style=\"font-weight: bold; padding-top: 5px; padding-right: 5px; padding-bottom: 5px; padding-left: 5px; margin-top: 5px; margin-right: 0px; margin-bottom: 0px; margin-left: 15px; \">\u5f15\u7528<\/div>\n<div class=\"quote_div\" style=\"border-top-width: 1px; border-right-width: 1px; border-bottom-width: 1px; border-left-width: 1px; border-top-style: solid; border-right-style: solid; border-bottom-style: solid; border-left-style: solid; border-top-color: rgb(204, 204, 204); border-right-color: rgb(204, 204, 204); border-bottom-color: rgb(204, 204, 204); border-left-color: rgb(204, 204, 204); margin-top: 0px; margin-right: 5px; margin-bottom: 5px; margin-left: 15px; padding-top: 3px; padding-right: 3px; padding-bottom: 3px; padding-left: 3px; background-image: initial; background-repeat: initial; background-attachment: initial; -webkit-background-clip: initial; -webkit-background-origin: initial; background-color: rgb(250, 250, 250); background-position: initial initial; \">\u00a0\u00a0\u00a0 *\u00a0 Fix mod_compress to compile with old gcc version (#1592)\u00a0<br \/>\u00a0\u00a0\u00a0 * Fix mod_extforward to compile with old gcc version (#1591)\u00a0<br \/>\u00a0\u00a0\u00a0 * Update documentation for #1587\u00a0<br \/>\u00a0\u00a0\u00a0 * Fix #285 again: read error after SSL_shutdown (thx marton.illes@balabit.com) and clear the error queue before some other calls (CVE-2008-1531)\u00a0<br \/>\u00a0\u00a0\u00a0 * Fix mod_magnet: enable \u201crequest.method\u201d and \u201crequest.protocol\u201d in lighty.env (#1308)\u00a0<br \/>\u00a0\u00a0\u00a0 * Fix segfault for appending matched parts if there was no regex matching (just give empty strings) (#1601)\u00a0<br \/>\u00a0\u00a0\u00a0 * Use data_response_init in mod_fastcgi x-sendfile handling for response.headers, fix a small \u201cmemleak\u201d (#1628)\u00a0<br \/>\u00a0\u00a0\u00a0 * Don\u2019t send empty Server headers (#1620)\u00a0<br \/>\u00a0\u00a0\u00a0 * Fix conditional interpretation of core options\u00a0<br \/>\u00a0\u00a0\u00a0 * Enable escaping of % and $ in redirect\/rewrite; only two cases changed their behaviour: \u201c%\u201d => \u201c\u201d, \u201d$$\u201d => \u201d$\u201d\u00a0<br \/>\u00a0\u00a0\u00a0 * Fix accesslog port (should be port from the connection, not the \u201cserver.port\u201d) (#1618)\u00a0<br \/>\u00a0\u00a0\u00a0 * Fix mod_fastcgi prefix matching: match the prefix always against url, not the absolute filepath (regardless of check-local)\u00a0<br \/>\u00a0\u00a0\u00a0 * Overwrite Content-Type header in mod_dirlisting instead of inserting (#1614), patch by Henrik Holst\u00a0<br \/>\u00a0\u00a0\u00a0 * Handle EINTR in mod_cgi during write() (#1640)\u00a0<br \/>\u00a0\u00a0\u00a0 * Allow all http status codes by default; disable body only for 204,205 and 304; generate error pages for 4xx and 5xx (#1639)\u00a0<br \/>\u00a0\u00a0\u00a0 * Fix mod_magnet to set con->mode = p->id if it generates content, so returning 4xx\/5xx doesn\u2019t append an error page\u00a0<br \/>\u00a0\u00a0\u00a0 * Remove lighttpd.spec* from source, fixing all problems with it \ud83d\ude09\u00a0<br \/>\u00a0\u00a0\u00a0 * Do not rely on PATH_MAX (POSIX does not require it) (#580)\u00a0<br \/>\u00a0\u00a0\u00a0 * Disable logging to access.log if filename is an empty string\u00a0<br \/>\u00a0\u00a0\u00a0 * Implement a clean way to open \/dev\/null and use it to close stdin\/out\/err in the needed places (#624)\u00a0<br \/>\u00a0\u00a0\u00a0 * merge spawn-fcgi changes from trunk (from @2191)\u00a0<br \/>\u00a0\u00a0\u00a0 * let spawn-fcgi propagate exit code from spawned fcgi application\u00a0<br \/>\u00a0\u00a0\u00a0 * close connection after redirect in trigger_b4_dl (thx icy)\u00a0<br \/>\u00a0\u00a0\u00a0 * close connection in mod_magnet if returned status code\u00a0<br \/>\u00a0\u00a0\u00a0 * fix bug with IPv6 in mod_evasive (#1579)\u00a0<br \/>\u00a0\u00a0\u00a0 * fix scgi HTTP\/1.* status parsing (#1638), found by met@uberstats.com\u00a0<br \/>\u00a0\u00a0\u00a0 * [tests] fixed system, use foreground daemons and waitpid\u00a0<br \/>\u00a0\u00a0\u00a0 * [tests] removed pidfile from test system\u00a0<br \/>\u00a0\u00a0\u00a0 * [tests] fixed tests needing php running (if not running on port 1026, search php in env[PHP] or \/usr\/bin\/php-cgi)\u00a0<br \/>\u00a0\u00a0\u00a0 * fixed typo in mod_accesslog (#1699)\u00a0<br \/>\u00a0\u00a0\u00a0 * replaced buffer_{append,copy}_string with the _len variant where possible (#1732) (thx crypt)\u00a0<br \/>\u00a0\u00a0\u00a0 * case insensitive match for secdownload md5 token (#1710)\u00a0<br \/>\u00a0\u00a0\u00a0 * Handle only HEAD, GET and POST in mod_dirlisting (same as in staticfile) (#1687)\u00a0<br \/>\u00a0\u00a0\u00a0 * fixed mod_secdownload problem with unsigned time_t (#1688)\u00a0<br \/>\u00a0\u00a0\u00a0 * handle EAGAIN and EINTR for freebsd sendfile (#1675)\u00a0<br \/>\u00a0\u00a0\u00a0 * Use filedescriptor 0 for mod_scgi spawn socket, redirect STDERR to \/dev\/null (#1716)\u00a0<br \/>\u00a0\u00a0\u00a0 * fixed round-robin balancing in mod_proxy (#1715)\u00a0<br \/>\u00a0\u00a0\u00a0 * fixed EINTR handling for waitpid in mod_fastcgi\u00a0<br \/>\u00a0\u00a0\u00a0 * mod_{fast,s}cgi: overwrite environment variables (#1722)\u00a0<br \/>\u00a0\u00a0\u00a0 * inserted many con->mode checks; they should prevent two modules to handle the same request if they shouldn\u2019t (#631)\u00a0<br \/>\u00a0\u00a0\u00a0 * fixed url encoding to encode more characters (#266)\u00a0<br \/>\u00a0\u00a0\u00a0 * allow digits in [s]cgi env vars (#1712)\u00a0<br \/>\u00a0\u00a0\u00a0 * fixed dropping last character of evhost pattern (#161)\u00a0<br \/>\u00a0\u00a0\u00a0 * print helpful error message on conditionals in global block (#1550)\u00a0<br \/>\u00a0\u00a0\u00a0 * decode url before matching in mod_rewrite (#1720)\u00a0<br \/>\u00a0\u00a0\u00a0 * fixed conditional patching of ldap filter (#1564)\u00a0<br \/>\u00a0\u00a0\u00a0 * Match headers case insensitive in response (removing of X-{Sendfile,LIGHTTPD-*}, catching Date\/Server)\u00a0<br \/>\u00a0\u00a0\u00a0 * fixed bug with case-insensitive filenames in mod_userdir (#1589), spotted by \u201canders1\u201d\u00a0<br \/>\u00a0\u00a0\u00a0 * fixed format string bugs in mod_accesslog for SYSLOG\u00a0<br \/>\u00a0\u00a0\u00a0 * replaced fprintf with log_error_write in fastcgi debug\u00a0<br \/>\u00a0\u00a0\u00a0 * fixed mem leak in ssi expression parser (#1753), thx Take5k\u00a0<br \/>\u00a0\u00a0\u00a0 * hide some ssl errors per default, enable them with debug.log-ssl-noise (#397)\u00a0<br \/>\u00a0\u00a0\u00a0 * do not send content-encoding for 304 (#1754), thx yzlai\u00a0<br \/>\u00a0\u00a0\u00a0 * fix segfault for stat_cache(fam) calls with relative path (without \u2019\/\u2019, can be triggered by x-sendfile) (#1750)\u00a0<br \/>\u00a0\u00a0\u00a0 * fix splitting of auth-ldap filter\u00a0<br \/>\u00a0\u00a0\u00a0 * workaround ldap connection leak if a ldap connection failed (restarting ldap)\u00a0<br \/>\u00a0\u00a0\u00a0 * fix auth.backend.ldap.bind-dn\/pw problems (only read from global context for temporary ldap reconnects, thx ruskie)\u00a0<br \/>\u00a0\u00a0\u00a0 * fix memleak in request header parsing (#1774, thx qhy)\u00a0<br \/>\u00a0\u00a0\u00a0 * fix mod_rewrite memleak\/endless loop detection (#1775, thx phy \u2013 again!)\u00a0<br \/>\u00a0\u00a0\u00a0 * use decoded url for matching in mod_redirect (#1720)\u00a0<\/div>\n<p><\/span><\/p>\n<div><\/div>\n","protected":false},"excerpt":{"rendered":"<p>9\u670830\u65e5lighttpd 1.4.20\u7248\u672c\u53d1\u5e03\u4e86\u3002lighttpd\u4e0d\u7528\u591a\u4ecb\u7ecd\u4e86\uff0c\u73b0\u5728\u975e\u5e38\u6d41\u884c\u7684\u8f7b\u91cf\u7ea7Web\u670d\u52a1\u5668\uff0c\u63d0\u4f9b\u826f\u597d\u7684Ruby on Rails\uff0cPHP\u548cPython\u7684FastCGI\/SCGI\u8fd0\u884c\u65b9\u5f0f\u7684\u652f\u6301\u3002\u00a0 lighttpd1.4.20\u7248\u672c\u662f1.4.x\u7cfb\u5217\u7684\u6700\u65b0\u7684\u7ef4\u62a4\u7248\u672c\uff0c\u4fee\u590d\u4e86\u4ece1.4.19\u4ee5\u6765\u5927\u91cf\u7684\u5c0fbug\uff0c\u4e5f\u662f\u76ee\u524dlighttpd\u6700\u7a33\u5b9a\u6700\u597d\u7684\u7248\u672c\uff0c\u63a8\u8350\u5347\u7ea7\u3002\u8fd9\u4e2a\u7248\u672c\u6bd4\u8f83\u5173\u6ce8\u7684bug\u4fee\u590d\u662f\u4e00\u4e9bHTTP\u4e0d\u89c4\u8303\u7684400\u8bf7\u6c42\u9020\u6210\u7684\u5185\u5b58\u6cc4\u6f0f\u95ee\u9898\u4ee5\u53caSSL\u5904\u7406\u7684\u95ee\u9898\u9020\u6210\u7684DOS\u653b\u51fb\u3002\u4ee5\u4e0b\u662f\u8be6\u7ec6\u66f4\u65b0\u8bb0\u5f55\uff1a\u00a0 \u5f15\u7528 \u00a0\u00a0\u00a0 *\u00a0 Fix mod_compress to compile with old gcc version (#1592)\u00a0\u00a0\u00a0\u00a0 * Fix mod_extforward to compile with old gcc version (#1591)\u00a0\u00a0\u00a0\u00a0 * Update documentation for #1587\u00a0\u00a0\u00a0\u00a0 * Fix #285 again: read error after SSL_shutdown (thx marton.illes@balabit.com) and clear the error queue before some other calls (CVE-2008-1531)\u00a0\u00a0\u00a0\u00a0 * Fix mod_magnet: &hellip; <a href=\"https:\/\/www.strongd.net\/?p=537\" class=\"more-link\">Continue reading <span class=\"screen-reader-text\">lighttpd 1.4.20\u53d1\u5e03<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-537","post","type-post","status-publish","format-standard","hentry","category-linux"],"_links":{"self":[{"href":"https:\/\/www.strongd.net\/index.php?rest_route=\/wp\/v2\/posts\/537","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.strongd.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.strongd.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.strongd.net\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.strongd.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=537"}],"version-history":[{"count":1,"href":"https:\/\/www.strongd.net\/index.php?rest_route=\/wp\/v2\/posts\/537\/revisions"}],"predecessor-version":[{"id":659,"href":"https:\/\/www.strongd.net\/index.php?rest_route=\/wp\/v2\/posts\/537\/revisions\/659"}],"wp:attachment":[{"href":"https:\/\/www.strongd.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=537"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.strongd.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=537"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.strongd.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=537"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}