CHANGES - apreq - Git at Google

 /** @page apreq_changes CHANGES
 @brief List of major changes.


 @section v2_04_dev Changes with libapreq2-2.04-dev (released August 30, 2004)


 - Perl API [joes]
   Add TAINT checks, marking all parsed data as tainted.

 - C API [joes]
   Add body_status attribute to apreq_request_t, to allow the both
   environment and the parser to report any errors encountered.

 - C API [randyk, joes]
   Cookie parser was locking up on non-alphanumeric chars in cookie names.
   Also RFC Cookie attributes are always checked for quotes during bake(2),
   and the quotes are now stripped from incoming RFC cookies during parsing
   (but they are never stripped from the actual cookie value).

 - Perl API [joes]
   Apache::Cookie::Jar->new accepts a VALUE_CLASS argument, which effectively
   blesses all the jar's cookies into that class, which simplifies subclassing
   Apache::Cookie.   Accordingly Apache::Cookie->freeze($value) no longer accepts
   a freeze()-able object in $value.

 - C API [Markus Wichitill, randyk, joes]
   Drop APR_DELONCLOSE from apreq_file_mktemp implementation and install
   apreq_file_cleanup. When passed to apr_file_open on Win32, APR_DELONCLOSE
   sets the FILE_SHARED_DELETE flag, which is, unfortunately, a property that
   is preserved across NTFS "hard" links.  This breaks apps that link()
   the temp file to a permanent location, and subsequently expect to open it
   without FILE_SHARED_DELETE before the original tempfile is closed+deleted.
   In fact, even Apache::Upload does this, so it is a common enough event that
   the apreq_file_cleanup workaround is necessary.

 - C API [Ken Burcham, joes]
   Fix bug in url parser that occurs when a %XX-encoded sequence
   is split across multiple buckets.  Added apreq_decode_decodev
   to make this problem less inconvenient.

 - Perl API [joes]
   Exception objects inherit from the object which raised it,
   which allows $@ to invoke its methods with impunity (exceptions
   are disabled for objects which derive from an exception class).

 - Perl API [joes]
   Implement HOOK_DATA and UPLOAD_HOOK.

 - Perl API [joes]
   Add safe XS wrappers for $table->add, $table->set, $table->STORE,
   and $table_class->new.

 - Perl API [joes]
   Add exceptions to $upload->link, $upload->tempname, $upload->slurp,
   and $cookie->set_attr.  Return value of $upload->slurp is now the
   upload length.  Also document new $upload->io.

 - C API [joes]
   Restrict all apr_status_t codes to APR_SUCCESS, APR_INCOMPLETE,
   APR_EGENERAL, APR_EINIT, APR_ENOTIMPL, since any others will
   generate confusing error messages from apr_strerror.

 - Perl API [joes]
   Added $upload->io with a TIEHANDLE API layered over APR::Brigade.   $upload->fh
   remains implemented as an APR::PerlIO object, which is seekable but less efficient
   and currently suffers some portability issues associated with largefile support
   in perl and apr.

 - Perl API [joes]
   Added apreq_xs_croak for throwing APR::Error exceptions and included
   error-checking on $req->param, $req->args, $req->body, $req->upload,
   and $jar->get.

 - Perl API [joes]
   Added $jar->status, $req->args_status and $req->body_status to report
   parsing errors. Also add $upload->tempname per user request.

 - C API [joes]
   Dropped status attribute of apreq_value_t.  Added status field to
   apreq_jar_t and added args_status field to apreq_request_t. Parsers
   also must return their public status code when a NULL brigade is passed.
   apreq_hook_disable_uploads() is also added.
   .
   This is an ABI change affecting all versions of libapreq2 prior to 2.0.12.

 - Perl API [joes]
   $upload->info returns a proper APR::Table object now. Also implemented
   $upload->size, $upload->fh, and $upload->type.

 - C API [Jean-François Meesse]
   mfd parser fails to parse CRLF-terminated files when the terminating
   boundary string is at the start of a new bucket.  This is reportedly
   a common event for PDF files uploaded with Netscape 7.

 - Perl API [joes]
   Add back-compat support for Apache::Cookie->fetch() via
   Apache->request.

 - C API [joes]
   Add MaxBody, MaxBrigade, and TempDir per-dir directives to mod_apreq
   filter.

 - C API [joes]
   Replace free/tempnam dependency in apreq_file_mktemp() with
   apr_temp_dir_get().  Add additional gcc warning flags when
   --enable-maintainer-mode is set.

 - C API [joes, Scott Hutton]
   Replace apreq_brigade_copy with more effective APREQ_BRIGADE_COPY
   macro.  Also introduce APREQ_BRIGADE_SETASIDE to deal with buckets
   that need to be set aside for use in future function calls. mod_ssl
   generates transient buckets which tickled this bug.

 - Perl API [joes]
   Separate Apache::Upload module from Apache::Request for
   better organization.


 @section v2_03_dev Changes with libapreq2-2.03-dev (released June 12, 2004)


 - C API [joes]
   "Objectify" cookie/jar API: s/apreq_(make|serialize)_cookie/apreq_cookie_$1/
   and reordering args so the cookie/jar object is always the first argument.
   Macros added to provide source-compatibility with the old names.

 - Perl API [joes]
   Added $upload->slurp($data), which reads the contents of the file
   upload "$upload" into the scalar "$data".

 - C API [joes, randyk]
   apreq_run_(hook|parser) are macros, so they are capitalized now.
   Fixed apreq_params_as_string() and added apreq_params_as_array().
   Reworked definitions of APREQ_DECLARE_HOOK, APREQ_DECLARE_PARSER
   and apreq_(parser|hook)_t, hopefully to be more Win32 friendly.
   Also updated the documentation.

 - C API [joes]
   Compensate for a missing CRLF in empty file upload block, which
   actually complies with RFC 2046 Section 5.1.1.  Konqueror (version unknown)
   and Mozilla 0.9.7 are known to emit such blocks.

 - Perl API [joes]
   $req->upload() in list context failed to filter out non-uploads.
   Also $req->upload("nonexistent-key-name") segfaults.

 - Perl test suite
   t/TEST.PL must run parent class' pre_configure to get the
   configuration right

 - C API [joes]
   apreq_brigade_concat() wasn't supplying the final EOS bucket
   to large brigades (>256K), which somtimes caused the prefetch
   loop in mod_apreq.c's apreq_filter() to hang.

 - Documentation [joes]
   CHANGES file reformatted, removing dates & other clutter
   as Stas suggests.

 - C API [joes]
   Rewrote cgi_read() in apreq_env.c and reworked mod_apreq.c
   to enforce apreq_env_max_body() settings.

 - C API [joes]
   Fixed bug in url_parser code- missing context brigade was
   needed to track key-value pairs which span multiple buckets.

 - C API [joes]
   API modifications: removed struct apreq_cfg_t, adding
   new apreq_env hooks max_body, max_brigade_len, and temp_dir.
   Folded apreq_parsers.h into apreq_params.h and modified the arguments
   to apreq_run_parser() and apreq_run_hook(). Renamed
   apreq_parser_t's content_type as enctype and apreq_copy_brigade()
   as apreq_brigade_copy().
   These changes make libapreq2.so.2.0.5 incompatible with earlier
   versions.

 - Perl API [stas]
   Include ppport.h from blead-perl to support older perls.
   Add a proper support for ithreads.

 - C API [Swen Schillig, joes]
   Fixed bug in calculation of Netscape cookie expiration dates.
   apr_time_t is measured in microseconds, not seconds, which
   threw off the arithmetic; apr_time_from_sec was needed for
   the conversion.

 - C API [Max Kellermann]
   Fix segfault caused by invalid %-escape sequence in query string.


 @section v2_02_dev Changes with libapreq2-2.02-dev (released Nov 15, 2003)


 - Perl API [joes]
   Fix bogus pool/cookie initializers in Apache::Cookie::set_attr(),
   which caused Apache::Cookie::new to segfault.  Bug
   first reported to modperl list by Wolfgang Kubens.


 @section v2_01_dev Changes with libapreq2-2.01-dev (released Nov 10, 2003)


 - build system [joes]
   Skip Apache::Test tests in env/ when Apache::Test is unavailable.
   This allows the C API to be build and installed without requiring
   Apache::Test (it is still a requirement for compiling the perl glue).

 - C API mod_apreq.c [joes]
   Parser errors were creeping into the return value of apreq_filter,
   which breaks the "transparent tee" paradigm.  This caused bogus
   "400 Bad Request" responses (first reported by Vladimir Dudo)
   to occur when libapreq2 was used by an output filter during a GET
   request (handled by apache2's default handler).  The test suite
   has been updated accordingly.

 - C API [joes]
   Incorporate libapreq_cgi into libapreq2 as the default environment,
   and add apreq_env_t and initializer apreq_env_module() to manage the
   environment at runtime (determining the environment at load-time
   was problematic on non-ELF systems).


 @section v2_0_0 Changes with libapreq2-2.00-dev (Oct 25, 2003)


 - C API: libapreq_cgi.c [randyk, joes]
   CGI environment defined by env/libapreq_cgi.c is functional
   (with tests added to env/t).  This library may soon be incorporated
   directly into libapreq2 as a default enviroment.

 - C API: mod_apreq.c [joes]
   Added ctx->saw_eos to ensure we don't read from upstream filters
   after receiving an eos bucket.  Otherwise it was possible for
   two eos buckets to appear when a prefetch read is involved, which
   breaks other modules like mod_proxy.  This bug was uncovered by
   Philippe Chiasson.  mod_apreq's apreq_env_majic_number bumped to
   reflect the added fixes.

 - configure: --enable-perl-glue [joes]
   The --enable-perl-glue option integrates the perl glue into the
   normal Unix build cycle.  It is disabled by default, but is silently
   reenabled if the user configures the source tree via Makefile.PL.

 - C API [joes]
   Added apreq_header_attribute() and fixed mfd parser to allow
   "charset" attribute to appear in the Content-Type header.  Sven
   Geisler points out that Opera 7.20 does generate such headers.

 - C API [joes]
   Added versioning API following http://apr.apache.org/versioning.html
   apreq_env renamed apreq_env_name, and apreq_env_magic_number added
   to provide versioning for environments (modules).  The header files
   are now installed to "include/apreq2", and the library is renamed
   "libapreq2". Also added an apreq2-config script based on apu-config.

 - configure: static mod_apreq.c [Bojan Smojver, joes]
   Add --with-apache2-src configure option, along with --with-apr-config
   and --with-apu-config, and provide support for compiling mod_apreq
   into httpd as a static apache module.

 - C API: mod_apreq.c [joes]
   Support for internal redirects added to the mod_apreq filter.
   This ensures any POST data prefetched in the main request
   gets passed along to the subrequest handler(s).

 - C bugfix: apreq_decode [Graham Clark]
   If the source and destination strings are represented by the same
   pointer - e.g. if called as apreq_unescape(s) - string s is modified
   incorrectly in general.  Patch includes new unit test.

 - Perl API [joes]
   Added $req->parse, $req->status, & "preparse" logic
   to $req->param & $req->upload.

 - C API [joes]
   Added "preparse" logic to apreq_params & apreq_uploads
   to bring behavior in line with libapreq-1.x.

 - C API [joes]
   Dropped param->charset.
   Make apreq_brigade_concat public, so mod_apreq can use it
   for its ctx->spool brigade.

 - Documentation [joes]
   Updated Cookie_pod to reflect API changes over v1.X.

 - Documentation [joes]
   Added doxygen links to Apache::Request and Apache::Cookie
   perl docs.

 - C API [joes]
   Added apreq_copy_brigade(bb) to apreq.h.

 - C API [joes]
   The new filter-based design required a complete
   departure from libapreq-1.X codebase. libapreq-2
   is based solely on APR, and to be fully functional,
   requires a supporting environment similar to Apache-2.
   A person wishing to port libapreq-2 to a new environment
   needs to provide definitions for the declarations in apreq_env.h.

 - Perl API [joes]
   Aggregates are always collected into an APR::Table-based package.
   New table packages: Apache::Cookie::Table, Apache::Request::Table,
   and Apache::Upload::Table.

 - Perl API [joes]
   Apache::Cookie->fetch now requires an "environment" argument ($r).
   Its return value is blessed into the Apache::Cookie::Jar class.

 - Perl API [joes]
   Two new request lookup functions:
   -# $req->args - param lookup using only the query string
   -# $req->body - param lookup using only the POST data


 **/
	/** @page apreq_changes CHANGES
	@brief List of major changes.


	@section v2_04_dev Changes with libapreq2-2.04-dev (released August 30, 2004)


	- Perl API [joes]
	Add TAINT checks, marking all parsed data as tainted.

	- C API [joes]
	Add body_status attribute to apreq_request_t, to allow the both
	environment and the parser to report any errors encountered.

	- C API [randyk, joes]
	Cookie parser was locking up on non-alphanumeric chars in cookie names.
	Also RFC Cookie attributes are always checked for quotes during bake(2),
	and the quotes are now stripped from incoming RFC cookies during parsing
	(but they are never stripped from the actual cookie value).

	- Perl API [joes]
	Apache::Cookie::Jar->new accepts a VALUE_CLASS argument, which effectively
	blesses all the jar's cookies into that class, which simplifies subclassing
	Apache::Cookie. Accordingly Apache::Cookie->freeze($value) no longer accepts
	a freeze()-able object in $value.

	- C API [Markus Wichitill, randyk, joes]
	Drop APR_DELONCLOSE from apreq_file_mktemp implementation and install
	apreq_file_cleanup. When passed to apr_file_open on Win32, APR_DELONCLOSE
	sets the FILE_SHARED_DELETE flag, which is, unfortunately, a property that
	is preserved across NTFS "hard" links. This breaks apps that link()
	the temp file to a permanent location, and subsequently expect to open it
	without FILE_SHARED_DELETE before the original tempfile is closed+deleted.
	In fact, even Apache::Upload does this, so it is a common enough event that
	the apreq_file_cleanup workaround is necessary.

	- C API [Ken Burcham, joes]
	Fix bug in url parser that occurs when a %XX-encoded sequence
	is split across multiple buckets. Added apreq_decode_decodev
	to make this problem less inconvenient.

	- Perl API [joes]
	Exception objects inherit from the object which raised it,
	which allows $@ to invoke its methods with impunity (exceptions
	are disabled for objects which derive from an exception class).

	- Perl API [joes]
	Implement HOOK_DATA and UPLOAD_HOOK.

	- Perl API [joes]
	Add safe XS wrappers for $table->add, $table->set, $table->STORE,
	and $table_class->new.

	- Perl API [joes]
	Add exceptions to $upload->link, $upload->tempname, $upload->slurp,
	and $cookie->set_attr. Return value of $upload->slurp is now the
	upload length. Also document new $upload->io.

	- C API [joes]
	Restrict all apr_status_t codes to APR_SUCCESS, APR_INCOMPLETE,
	APR_EGENERAL, APR_EINIT, APR_ENOTIMPL, since any others will
	generate confusing error messages from apr_strerror.

	- Perl API [joes]
	Added $upload->io with a TIEHANDLE API layered over APR::Brigade. $upload->fh
	remains implemented as an APR::PerlIO object, which is seekable but less efficient
	and currently suffers some portability issues associated with largefile support
	in perl and apr.

	- Perl API [joes]
	Added apreq_xs_croak for throwing APR::Error exceptions and included
	error-checking on $req->param, $req->args, $req->body, $req->upload,
	and $jar->get.

	- Perl API [joes]
	Added $jar->status, $req->args_status and $req->body_status to report
	parsing errors. Also add $upload->tempname per user request.

	- C API [joes]
	Dropped status attribute of apreq_value_t. Added status field to
	apreq_jar_t and added args_status field to apreq_request_t. Parsers
	also must return their public status code when a NULL brigade is passed.
	apreq_hook_disable_uploads() is also added.
	.
	This is an ABI change affecting all versions of libapreq2 prior to 2.0.12.

	- Perl API [joes]
	$upload->info returns a proper APR::Table object now. Also implemented
	$upload->size, $upload->fh, and $upload->type.

	- C API [Jean-François Meesse]
	mfd parser fails to parse CRLF-terminated files when the terminating
	boundary string is at the start of a new bucket. This is reportedly
	a common event for PDF files uploaded with Netscape 7.

	- Perl API [joes]
	Add back-compat support for Apache::Cookie->fetch() via
	Apache->request.

	- C API [joes]
	Add MaxBody, MaxBrigade, and TempDir per-dir directives to mod_apreq
	filter.

	- C API [joes]
	Replace free/tempnam dependency in apreq_file_mktemp() with
	apr_temp_dir_get(). Add additional gcc warning flags when
	--enable-maintainer-mode is set.

	- C API [joes, Scott Hutton]
	Replace apreq_brigade_copy with more effective APREQ_BRIGADE_COPY
	macro. Also introduce APREQ_BRIGADE_SETASIDE to deal with buckets
	that need to be set aside for use in future function calls. mod_ssl
	generates transient buckets which tickled this bug.

	- Perl API [joes]
	Separate Apache::Upload module from Apache::Request for
	better organization.


	@section v2_03_dev Changes with libapreq2-2.03-dev (released June 12, 2004)


	- C API [joes]
	"Objectify" cookie/jar API: s/apreq_(make\|serialize)_cookie/apreq_cookie_$1/
	and reordering args so the cookie/jar object is always the first argument.
	Macros added to provide source-compatibility with the old names.

	- Perl API [joes]
	Added $upload->slurp($data), which reads the contents of the file
	upload "$upload" into the scalar "$data".

	- C API [joes, randyk]
	apreq_run_(hook\|parser) are macros, so they are capitalized now.
	Fixed apreq_params_as_string() and added apreq_params_as_array().
	Reworked definitions of APREQ_DECLARE_HOOK, APREQ_DECLARE_PARSER
	and apreq_(parser\|hook)_t, hopefully to be more Win32 friendly.
	Also updated the documentation.

	- C API [joes]
	Compensate for a missing CRLF in empty file upload block, which
	actually complies with RFC 2046 Section 5.1.1. Konqueror (version unknown)
	and Mozilla 0.9.7 are known to emit such blocks.

	- Perl API [joes]
	$req->upload() in list context failed to filter out non-uploads.
	Also $req->upload("nonexistent-key-name") segfaults.

	- Perl test suite
	t/TEST.PL must run parent class' pre_configure to get the
	configuration right

	- C API [joes]
	apreq_brigade_concat() wasn't supplying the final EOS bucket
	to large brigades (>256K), which somtimes caused the prefetch
	loop in mod_apreq.c's apreq_filter() to hang.

	- Documentation [joes]
	CHANGES file reformatted, removing dates & other clutter
	as Stas suggests.

	- C API [joes]
	Rewrote cgi_read() in apreq_env.c and reworked mod_apreq.c
	to enforce apreq_env_max_body() settings.

	- C API [joes]
	Fixed bug in url_parser code- missing context brigade was
	needed to track key-value pairs which span multiple buckets.

	- C API [joes]
	API modifications: removed struct apreq_cfg_t, adding
	new apreq_env hooks max_body, max_brigade_len, and temp_dir.
	Folded apreq_parsers.h into apreq_params.h and modified the arguments
	to apreq_run_parser() and apreq_run_hook(). Renamed
	apreq_parser_t's content_type as enctype and apreq_copy_brigade()
	as apreq_brigade_copy().
	These changes make libapreq2.so.2.0.5 incompatible with earlier
	versions.

	- Perl API [stas]
	Include ppport.h from blead-perl to support older perls.
	Add a proper support for ithreads.

	- C API [Swen Schillig, joes]
	Fixed bug in calculation of Netscape cookie expiration dates.
	apr_time_t is measured in microseconds, not seconds, which
	threw off the arithmetic; apr_time_from_sec was needed for
	the conversion.

	- C API [Max Kellermann]
	Fix segfault caused by invalid %-escape sequence in query string.


	@section v2_02_dev Changes with libapreq2-2.02-dev (released Nov 15, 2003)


	- Perl API [joes]
	Fix bogus pool/cookie initializers in Apache::Cookie::set_attr(),
	which caused Apache::Cookie::new to segfault. Bug
	first reported to modperl list by Wolfgang Kubens.


	@section v2_01_dev Changes with libapreq2-2.01-dev (released Nov 10, 2003)


	- build system [joes]
	Skip Apache::Test tests in env/ when Apache::Test is unavailable.
	This allows the C API to be build and installed without requiring
	Apache::Test (it is still a requirement for compiling the perl glue).

	- C API mod_apreq.c [joes]
	Parser errors were creeping into the return value of apreq_filter,
	which breaks the "transparent tee" paradigm. This caused bogus
	"400 Bad Request" responses (first reported by Vladimir Dudo)
	to occur when libapreq2 was used by an output filter during a GET
	request (handled by apache2's default handler). The test suite
	has been updated accordingly.

	- C API [joes]
	Incorporate libapreq_cgi into libapreq2 as the default environment,
	and add apreq_env_t and initializer apreq_env_module() to manage the
	environment at runtime (determining the environment at load-time
	was problematic on non-ELF systems).


	@section v2_0_0 Changes with libapreq2-2.00-dev (Oct 25, 2003)


	- C API: libapreq_cgi.c [randyk, joes]
	CGI environment defined by env/libapreq_cgi.c is functional
	(with tests added to env/t). This library may soon be incorporated
	directly into libapreq2 as a default enviroment.

	- C API: mod_apreq.c [joes]
	Added ctx->saw_eos to ensure we don't read from upstream filters
	after receiving an eos bucket. Otherwise it was possible for
	two eos buckets to appear when a prefetch read is involved, which
	breaks other modules like mod_proxy. This bug was uncovered by
	Philippe Chiasson. mod_apreq's apreq_env_majic_number bumped to
	reflect the added fixes.

	- configure: --enable-perl-glue [joes]
	The --enable-perl-glue option integrates the perl glue into the
	normal Unix build cycle. It is disabled by default, but is silently
	reenabled if the user configures the source tree via Makefile.PL.

	- C API [joes]
	Added apreq_header_attribute() and fixed mfd parser to allow
	"charset" attribute to appear in the Content-Type header. Sven
	Geisler points out that Opera 7.20 does generate such headers.

	- C API [joes]
	Added versioning API following http://apr.apache.org/versioning.html
	apreq_env renamed apreq_env_name, and apreq_env_magic_number added
	to provide versioning for environments (modules). The header files
	are now installed to "include/apreq2", and the library is renamed
	"libapreq2". Also added an apreq2-config script based on apu-config.

	- configure: static mod_apreq.c [Bojan Smojver, joes]
	Add --with-apache2-src configure option, along with --with-apr-config
	and --with-apu-config, and provide support for compiling mod_apreq
	into httpd as a static apache module.

	- C API: mod_apreq.c [joes]
	Support for internal redirects added to the mod_apreq filter.
	This ensures any POST data prefetched in the main request
	gets passed along to the subrequest handler(s).

	- C bugfix: apreq_decode [Graham Clark]
	If the source and destination strings are represented by the same
	pointer - e.g. if called as apreq_unescape(s) - string s is modified
	incorrectly in general. Patch includes new unit test.

	- Perl API [joes]
	Added $req->parse, $req->status, & "preparse" logic
	to $req->param & $req->upload.

	- C API [joes]
	Added "preparse" logic to apreq_params & apreq_uploads
	to bring behavior in line with libapreq-1.x.

	- C API [joes]
	Dropped param->charset.
	Make apreq_brigade_concat public, so mod_apreq can use it
	for its ctx->spool brigade.

	- Documentation [joes]
	Updated Cookie_pod to reflect API changes over v1.X.

	- Documentation [joes]
	Added doxygen links to Apache::Request and Apache::Cookie
	perl docs.

	- C API [joes]
	Added apreq_copy_brigade(bb) to apreq.h.

	- C API [joes]
	The new filter-based design required a complete
	departure from libapreq-1.X codebase. libapreq-2
	is based solely on APR, and to be fully functional,
	requires a supporting environment similar to Apache-2.
	A person wishing to port libapreq-2 to a new environment
	needs to provide definitions for the declarations in apreq_env.h.

	- Perl API [joes]
	Aggregates are always collected into an APR::Table-based package.
	New table packages: Apache::Cookie::Table, Apache::Request::Table,
	and Apache::Upload::Table.

	- Perl API [joes]
	Apache::Cookie->fetch now requires an "environment" argument ($r).
	Its return value is blessed into the Apache::Cookie::Jar class.

	- Perl API [joes]
	Two new request lookup functions:
	-# $req->args - param lookup using only the query string
	-# $req->body - param lookup using only the POST data


	**/