Appweb Change Log

Brief Appweb change log of the the major features and changes for each release.

Note to security researchers:

Please do not mine this list and create security advisories. Please see the Appweb Issue Database for the official product issue list and for comprehensive CVE dispositions.

Changes in 4.3.4

Fixes

• Fix incorrect http session max exceeded limit message [issue 191]
• Fix static compilation error in espHandler. [issue 192]

Changes in 4.3.3

Minor Features

• Add ESP template directive @! to access C variables [issue NN]

Fixes

• Fix ESP MVC apps serving static/*.esp [issue 164]
• ESP generate with SDB fails [issue 165]
• Fix resolving appweb.conf relative to the appweb.conf file [issue 166]
• Fix client HTTP Host header. Should not include :443. [issue 167]
• Fix esp generate table | migration [issue 168]
• Improve esp generated appweb.conf [issue 169]
• Fix EspApp to reuse suitable existing routes if possible [issue 170]
• Fix ESP setting {controller} parameter for singleton resource routes [issue 171]
• Generate dummy data favicon for error pages and ESP icon(0, 0) [issue 172]
• Fix missing EspControl documentation and add ESP API stability classifications [issue 173]
• Update to jQuery 1.9 for ESP [issue 174]
• Use HTML5 data-esp prefix for ESP data attributes [issue 175]
• Add SO_REUSEADDR for VxWorks [issue 176]
• Fix the ESP text password attributes [issue 177]

Changes in 4.3.2

Minor Features

• Add self-signed cert and enable SSL by default [issue 150]
• Improve generated makefiles using top level CFLAGS, LDFLAGS [issue 151]
• Improve and extend samples [issue 152]
• Improve portability of compiled ESP modules. Change MD5 encoding to be based on route relative paths. [issue 153]
• Change _default_ to APPWEB for UserAccount and GroupAccount directives. The old _default_ is still implemented. [issue 161]

Fixes

• Fix esp --platform vxworks compile [issue 154]
• Fix CPU setting in "configure --platform os-arch:CPU" [issue 155]
• Fix compiling ESP pages with DOS end-of-line terminators (CR/LF) [issue 156]
• Fix "EspUpdate off" to permit one-time loading of ESP modules [issue 157]
• Fix location of error.log and default to the current directory. [issue 158]
• Rename AuthStore pam => system, internal => file. Pam|internal deprecated but still implemented. [issue 159]
• Fix compiling C++ samples on windows by removing TSZ define [issue 160]
• Fix "esp can't find platform" [issue 162]
• Cookie fixes: Fix httpSetCookie to only allow one header per cookie. httpCreateSession to always re-create a session. httpDestroySession to erase the client cookie (API change). [issue 163]

Changes in 4.3.1

Minor Features

• Add MPR palloc/pfree APIs to allocate and free permanent memory [issue 139]
• Update API stability classifications [issue 140]
• Update JQuery to 1.9.1 [issue 141]
• Update SQLite to 3.7.15.1 [issue 142]
• Improve conditional makefiles to support SSL and PHP [issue 143]
• Add make deploy [issue 144]
• Lots of documentation updates [issue 145]
• Add static makefiles [issue 146]

Fixes

• Only change user/group for UserAccount/GroupAccount if root/administrator [issue 147]
• Define default stack size for VxWorks [issue 148]
• Fix make/bit install for non-root installations [issue 125]
• Add "public" to cookies over SSL for firefox [issue 149]
• Fix C++ compilation [issue 127]

Changes in 4.3.0

Minor Features

• Fixed listening on Windows 64 with IPv6 and IPv4 on a single socket. [issue 98]
• Change tunable defines to be override via configure. These are now all named: BIT_*. [issue 99]
• Update to PHP5.4 [issue 100]
• Add support for the Mocana NanoSSL stack: [issue 102]
• Add prototype support for the EST SSL stack: [issue 101]
• Add main.bit settings "logging". This is enabled by default for debug and release builds. If disabled, calls to mprLog() will be optimized out. Calls to mprError will always be enabled. Similarly, added main.bit settings "tracing". This is enabled by default for only for debug builds. If disabled, calls to assert() and mprTrace() will be optimized out. [issue 107]
• Added esp --genlink, to generate a static link file for loading esp applications. Added "bit genapp" sample target to generate slink.c based on esp applications under src/server/web. [issue 114]
• Added Ejscript as an integrated component instead of requiring a separate download. Use "configure --with ejscript" to enable. [issue 117]
• Added support for HSTS (HTTP Strict Transport Security). [issue 120]
• Enhance makefiles to support targets: install, uninstall [issue 121]
• Support building on windows without cygwin [issue 122]
• Add full text search (FTS3) in SQLite [issue 128]
• Optimize memory allocation for large form requests [issue 131]
• Optimize memory garbage collection when appweb is idle [issue 132]

Fixes

• The mpr.h header has been split into a cross platform operating system layer called bitos.h. The mpr.h header includes this, so there should be no API impact. [issue 103]
• Remove compiler switch -mtune when not required [issue 104]
• Fix generated makefiles determining the system CPU architecture [issue 105]
• Main.bit settings are grouped into collections: http, esp, mpr. Use configure --set NAME.FIELD=value where NAME is the collection name. [issue 108]
• Update licenses. Remove licenses for SSL stacks that are not included in the product. [issue 109]
• Fix test if IPv6 is supported on a system [issue 110]
• Fix creating browser cookies for localhost [issue 112]
• Fix esp --flat, to compile esp applications into a single library [issue 113]
• Building with ROM fs support. Added configure --rom, and the sample target "bit rom" [issue 115]
• Using static linking with esp applications. [issue 116]
• Esp command without a database (mdb or sdb) [issue 119]
• Appweb now installed under /usr/local rather than 1/2 under /usr. [issue 124]
• ESP now uses the file handler to serve static content. [issue 126]
• Form request with Content-Length of zero. [issue 129]
• Improve CGI response header parsing [issue 130]
• Fix esp run [issue 133]
• Change esp @@variables and <%= expressions to be HTML escaped [issue 134]
• Fix worker thread calculations. Fix mprAvailableThreads(). [issue 135]
• Fix ErrorDocument processing when the error document itself is missing [issue 136]
• Issue readable event when connection notifier registered [issue 138]

API Changes

• The installation prefix names have been refactored to work with Bit.

Changes in 4.2.0

Minor Features

• Add LimitParseTimeout directive to abort requests that start without concluding the HTTP headers. This optimizes the denial of service protections offered by Appweb. This was not a security flaw, as other limit and timeout directives would have protected the server regardless. [issue 73]
• Add LimitRequestsPerClient directive to limit the number of requests that can be issued by a single client IP address. This optimizes the denial of service protections offered by Appweb. This was not a security flaw, as other limit and timeout directives would have protected the server regardless. [issue 74]
• Add Home directive to permit routes to store their own root directory for configuration files [issue 75]
• Listen to both IPv4 and IPv6 in response to a single "Listen port" directive [issue 76]
• Enhance performance and worker thread utilization by optimizing lock contention and GC yielding [issue 55]

Fixes

• Ensure the handler start() callback is always invoked before any incoming() data. [issue 77]
• CGI unit test scripts to use ejs instead of /bin/sh so they can run on windows. [issue 78]
• Timeout message for inactive keep-alive connections [issue 79]
• Make server/src/cache and test/cache directories for unit tests [issue 80]
• Bit run" invokes appweb in src/server instead of ./test [issue 81]
• ErrorDocument preserves original failing HTTP status code for internal redirects. [issue 82]
• Bind to ports with exclusive use on Windows (SO_EXCLUSIVEADDRUSE). [issue 83]
• Create /var/spool/appweb/cache for ESP and EJS compiled modules. [issue 84]
• Building with VS 2012 and Windows SDK 8 [issue 86]
• Appman is slow to start appweb. [issue 87]
• mprWriteSocketVector was returning incorrect status transmitting bad output [issue 88]
• Linux epoll waiting now detects hang-up on writable sockets. [issue 89]
• Improve WebSockets error handling. [issue 91]
• Improve connector end-of-output handling [issue 92]
• External redirects that use a different scheme and the Redirect directive [issue 93]
• Graceful shutdowns should wait for open requests to complete before stopping or restarting. [issue 94]
• Added client IP to session lookup to strengthen session hijack preventions. [issue 95]

API Changes

• The Listen directive will now listen on both IPv4 and IPv6 by default if no network interface is supplied. Previously it only listened on IPv4. If a network interface is supplied, only that interface will be listened on.

Changes in 4.1.1

Fixes

• Esp command was crashing on initialization [issue 85]
• Esp generation of apps on windows [issue 90]

Changes in 4.1.0

Major Features

• Enhanced role-based authentication management for granular access control [issue 19]
• Web based form authentication and custom authentication support [issue 20]
• Require ability "token" directive to specify required route abilities for access [issue 19]
• Session state management and automatic cookie management. Optimizes authentication via session storage of credentials [issue 21]
• Prototype WebSockets support [issue 22]

Minor Features

• Added static build support (configure --static) [issue 23]
• Added ESP migrations [issue 24]
• Upgraded ESP - Smart tables, HTML5 generation
• Added HttpOnly cookie management in httpSetCookie() [issue 25]
• Added lazy SSL loading. SSL library only loaded when SSL requests arrive [issue 26]
• Add mprCreateEventOutside for calling back into Appweb from foreign threads [issue 27]
• Add SSL unit tests
• Add ListenSecure directive for SSL outside virtual hosts [issue 28]
• Add support for Windows 8 [issue 29]
• Add support for Visual Studio 2012 [issue 30]
• Add error output to syslog [issue 31]
• Add httpFinalizeOutput to signify completed output when still processing request [issue 32]
• Added Action handler for simple URI to C function bindings [issue 33]
• Remove *def files on windows. Use PUBLIC export decoration [issue 34]

Fixes

• Fix documentation version number [issue 35]
• Xcode debug builds to include BIT_DEBUG [issue 36]
• CGI NPH fixes to not augment CGI headers [issue 37]
• ESP MDB database JSON format error [issue 38]
• PUT method response to include Etag and Location [issue 39]
• Consuming body of failed requests to preserve keep-alive [issue 40]
• Http command --show displaying headers when no body in response [issue 41]
• Fix SSL inheritance in appweb.conf for virtual hosts [issue 42]
• If-Match header handling for case sensitivity [issue 43]
• Option request handling [issue 44]
• Directory listings path names to be relative paths [issue 45]
• Xcode project to use unique output directory [issue 46]
• Update MatrixSSL support to the latest version [issue 47]
• Remove zlib not required [issue 48]
• Rename T() to UT() to avoid winnt.h clash [issue 49]
• Locating OpenSSL libraries on 64-bit systems [issue 50]
• IPv6 unit tests [issue 51]
• Renamed modules to begin with "lib" so static libraries can work on Linux [issue 52]
• Mips CPU detection and number to asci conversion on big-endian mips [issue 53] [issue 54]
• Optimize memory usage under severe load [issue 55]
• Premature timer expiry when time-warping [issue 56]

API Changes

• Refactor scase to scaseless
• Changed name of ESP module entry point. Renamed "controller" to "module". Existing controllers will need to be modified.
• The HttpConn.finalized field is moved to HttpTx.
• The httpCreateHandler and httpCreateFilter APIs remove the flags arg.
• HTTP_STAGE_ALL define and HTTP_STAGE_* flags removed.
• The httpHandleOPtionsTrace API has a mew "methods" parameter for the supported methods for the handler. This should be set to a comma separated list of methods in uppercase.
• All public methods are decorated with PUBLIC to export from windows DLLs. This is instead of using dumpbin.
• Many time routines have their timeout type renamed to MprTicks from MprTime. As part of a fix for time-zone warping, timeouts are now specified in MprTick values. Ticks are measured in milliseconds from some arbitrary system-dependant starting point. Ticks never go backwards and are monotonically increasing.
• The old MprGetTicks is renamed MprGetHiResTime.
• The LimitStageBuffer directive is renamed LimitBuffer. The old name is supported.
• The httpWriteBlock API now takes a flags argument. It can be set to control whether the call blocks, buffers or non-blocks.
• The WebSockets prototype adds some WebSockets specific APIs.
• auth/httpPassword program renamed to authpass for clarity
• AuthMethod renamed to AuthStore for clarity (old directive preserved for compatibility)
• AuthName renamed to AuthRealm for clarity (old directive preserved for compatibility)
• The Group directive has been renamed GroupAccount and User renamed to UserAccount. This is to be more descriptive as the role-based access control uses the User directive to define user abilities for access control.

Changes in 4.0.0

Major Features

• New Embedded Server Pages (ESP) web framework
• Request routing with multi-stage, regular expression routes
• Integrated response caching
• Multi-language support
• Support Ejscript 2.0 web framework
• Extended unit tests
• Improved documentation and samples

API Changes

• Appweb 4 is a major release and most APIs have been modified based on the updated MPR.

Changes in 3.4.1

Fixes

• Add missing MA_MAX_REQUESTS and MA_MAX_PROCESSES for various tune settings [issue 37].
• Add support to permit changing a request timeout by updating HttpConn.expires [issue 38].

Changes in 3.4.0

Minor Features

• Added LimitProcesses to limit the number of CGI processes
• Added LimitRequests to limit the number of simultaneous requests

Key Fixes

• Ejscript return in try blocks
• Idle threads consuming CPU after long delay
• Prune workers not terminating idle threads
• Sign-extension assertion in ctype on windows
• MprCond not waiting waking up prematurely
• CPU load via spinning thread with no work to do
• PruneWorkers to prune all idle threads and ignore pruneHighWater
• Add LimitProcesses to limit the number of CGI processes
• Accelerate reaping of CGI zombie processes

Changes in 3.3.3

Key Fixes

• Fixes for building for VxWorks on linux
• Fix httpPassword parsing
• Add SSL_OP_NO_TICKET and SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION to force renegotiation of sessions.
• Enable no free threads message to continually be emitted

Changes in 3.3.2

Key Fixes

• CGI content-length headers
• parsing XML documents with zero length attributes
• Initialize blank areas of ejs byte code
• ejs Array.sort order
• ejs doc for Date.year
• warnings in Xcode about OpenSSL
• multiply defined target rules when building with latest GNU make
• Remove -G 0 compilation switch for Mips
• MVC apps with caselessmatch for URI extensions
• setCookie()
• PHP with basic/digest authentication requests
• Session memory leaks
• Improve X509 certificate verification with SSL
• Ejscript property scope searching
• Ejscript setCookie
• Optimize output of large static files
• Samples not compiling
• Windows 64-bit file stat
• Add huge file support (> 2GB)

Changes in 3.3.1

Key Fixes

• Fix HEAD requests
• Fix responses larger than 2GB

Changes in 3.3.0

Minor Features

• Added Chroot directive
• Support filtering shebang lines in PHP scripts
• Add missing extensions for PHP/CGI requests to allow requests for PHP files without .php extension
• Support graceful exit
• Add prototype module unloading for PHP via UnloadModule directive
• Add request timing to log file at level 5
• Add ASN1 certificate parsing for SSL
• Add on-demand initialization for PHP
• Prototype inactive PHP module unloading

Key Fixes

• Fix CGI output parsing when gateways omit headers
• Bad timezone on HTTP headers in certain locales
• Potential bad free of connection input buffer
• Formatted printing of floating point numbers
• Fixed --chroot switch
• Ensure handlers match() routine is always invoked if required
• FreeBSD linking fixes
• CGI for long running requests and requests with large post data
• Bad reference for req->pathInfo
• ActionProgram directive for CGI
• REDIRECT_STATIC compat env var for PHP
• Inheriting AuthName, Require and CustomLog directives
• Building with configure --disable-all
• Ejscript: Windows 7 support and VS 10.0
• Add missing msvcrt version 10 DLL
• Update Ejscript documentation
• Premature exit with large forward time changes
• CGI with file upload
• Return status of 401 instead of 404 when missing file and authentication
• Rewriting the request URI. Now updates filename, alias, location, extension etc.
• Configure for vxworks on Linux
• Fix redirections using SSL
• Fix running CGI/PHP startup for form and upload requests
• Ejscript: Array.slice with negative indices
• Ejscript: Date/Time calculations for pre 1970 dates
• Ejscript: Cygwin Math.pow Infinity results
• Ejscript: Allow JSON encoded arrays in Http form data
• Ejscript: memory fragmentation
• Ejscript: exception stack handling
• Ejscript: parsing XML characters > 127
• Ejscript: GC issue with new Function()
• Ejscript: XSS issue with embedded script in URLs
• Ejscript: Compiler spin with }; construct
• Ejscript: escape(quote)

Changes in 3.2.2

Minor Features

• Solaris and FreeBSD ports
• Http request and response body tracing. New configuration directives LogTrace and LogTraceFilter.

Key Fixes

• Freeing memory on exiting. (Fix to mprFree(mpr))
• Ejscript update to 1.0.2
• Documentation updates
• Debian package improvements

API Changes

• None

Changes in 3.2.1

Key Fixes

• Missing linkup script for packaging
• Timed out requests
• Building with va_list on some systems
• Parsing IPv6 addresses in the config file
• Ejscript loading modules fix for ARM
• Large requests when using the fileHandler

API Changes

• None

Changes in 3.2.0

Minor Features

• Updated Ejscript with enhanced Math, Date and Number classes
• Improved Ejscript library API documentation
• Improved configure diagnostics with the --verbose switch
• Many small fixes

Fixes

• Optimize make install/package when using svn
• SimpleModule sample
• Loading modules with a "." in the name
• Single threaded page reload when using remote command execution
• Improve configure diagnostics
• Ejs: TextStream::read() with unterminated last line
• Ejs: Http requests with credentials
• Ejs: JSON parsing and encoding
• Ejs: Math, Number and Date methods
• Ejs: Documentation
• Ejs: ByteArray.copyIn
• Ejs: Parsing XML literals

API Changes

• New MPR mprDtoa C API
• Enhanced Ejscript Number, Date and Math APIs
• API documentation corrections

Changes in 3.1.2

Fixes

• Windows project files
• Setting /Program Files in windows installation
• Ejscript TextStream and XML updates

API Changes

• None

Changes in 3.1.1

Fixes

• Handling bad HTTP request lines
• TLS/SSL renegotiation. Updated binary packages for OpenSsl and MatrixSsl
• Building in release mode on Windows

API Changes

• None

Changes in 3.1.0

Minor Features

• Improve configure trace output
• Fold text line lengths in README and LICENSE
• Update WIN and WINCE projects

Fixes

• Configure when /bin/cc is missing on Windows
• Default buildConfig.h for windows
• Remove absolute path names in buildConfig.h for Windows
• Add quotes to some commands in bld
• Mac OS X uninstall (pidof)
• Removal of aborted upload temp files
• Removing call to getSocketInfo. Was hanging if no DNS
• ROM - no file system support
• Windows case sensitive digest auth test
• Windows TextStream in Ejs
• Ejs WebWorkers

API Changes

• None

Changes in 3.0.2

Major Features

• Support Web Worker API in Ejscript

Minor Features

• Ejscript Web Worker API support
• Add versioned Ejscript module support
• Updated utest (unit test driver) with Web Worker support

Fixes

• Ejscript super invocations
• Ejscript subclassing native classes
• Ejscript strict mode errors

API Changes

• Modified MPR mprServiceEvents
• Renamed MPR mprAwaken* to mprWakeDispatcher

Changes in 3.0.1

Major Features

• Support Cygwin (Requires Cygwin 1.7 Beta)
• Updated Ejscript to 1.0.0

Minor Features

• Optimized SSL reading from slow clients
• Enhanced http command and MprHttp API to support chunking and file upload
• Moved incoming chunk filter code into the chunk filter. Changed to appweb.conf to use AddFilter.
• Modify makefiles to support Embedthis continuous integration build farm
• Updated Ejscript to support fully relative URLs. Required when running behind a reverse proxy
• Updated Ejscript for enhanced MVC and SQLite database support
• Added prototype unit test program "utest"
• Support Visual Studio 2012"
• Enhanced Ejscript module search path controls
• Optimize memory footprint
• Partial support for PHP 5.3.0

Fixes

• Missing PHP module on some builds
• Configure buildConfig.h generation for certain paths
• Chunk parsing for incoming data when chunks were split across TCP packets
• Pipeline queue byte count accounting
• Ejscript text() input control
• Reduce worker thread priorities
• Ejscript file size properties
• SimpleEgi sample
• Optimize file upload memory usage
• Wince and Windows
• Configure --disable-all
• Ejscript fixes for: TextStream reading text lines, SSL protocol support for the Http class, nested try/catch inside functions, use of iterations inside finally blocks, file upload, fileUploadSize Http.secure property, GC issue for collecting frames, JSON encoding, SQL quoting, Error.stack, Hybrid type slot binding, regular expression doc and File.size for open files

API Changes

• Modified MprHttp APIs
• Ejscript Http, Socket and Record classes

Changes in 3.0.0

Major Features vs Appweb 2

• New faster request processing pipeline 2x faster on many operations
• Enhanced Ejscript web framework for server-side JavaScript
• Integrated SQLite with database ORM layer
• Integrated Model / View / Controller web framework
• Smaller and more modular
• More flexible build configuration
• Manager process to monitor Appweb and restart if required
• Updates for PHP, OpenSSL and MatrixSSL
• Enhanced and faster CGI using pipes for I/O transfer
• XML parser for SOAP and RESTful web services
• Windows CE support
• FreeBSD support
• MAC OSX support
• Windows 7 and Vista support
• OpenWrt platform support
• IPv6 network support
• Project files for MAC OS Xcode and Microsoft Visual Studio
• Enhanced http command supporting SSL, chunking, ranged requests and file upload

Changes in 2.4.4

Fixes

• Add session resumption work-around for OpenSSL module. Not required if using OpenSSL >= 1.0.0
• Linux compilation switches
• Thread race in CGI/CMD
• Sign extension assert in ctype routines on windows
• Add CGI environment variable: REDIRECT_STATUS

Changes in 2.4.3

Fixes

• Increase default limits for LimitRequestBody and php.ini limits
• Timeouts for requests that do no I/O
• Setting of the upload directory
• Setting IPv6 initialization
• Formatting log file messages
• Support Windows SDK 6.0+
• Support Visual Studio 9.0
• Support PHP 5.2.8
• Support MatrixSSL 1.8.6
• Support OpenSSL 0.9.8j

Changes in 2.4.2

Fixes

• Fix for finding unused port in findFreePort()
• Fix exception on initialization when a value is not supplied with directives in the config file
• Improve config file diagnostics when parsing
• Fix exception when using digest authentication but building --disable-auth
• Fixes for virtual host configuration when matching addresses. Remove requirement to have a port in the NameVirtualHost and ServerName directives

Changes in 2.4.1

Fixes

• Fix for CGI on MAC OS X. Would not complete requests
• Fix for digest authentication on IE 7 / vista
• Fix for Ejscript @@variables when used inside []
• Fix for Ejscript hexadecimal comparisons. Was comparing with null incorrectly
• Replace fork with vfork for uclinux and to enhance CGI performance
• Fix compiling when using ROMFS

Changes in 2.4.0

This is essentially a re-branding of the development version version 2.3.4. Here are the major changes compared to version 2.2.X.

Major

• Support conditional directives in Appweb configuration files using <IF>.
• Enhance cross-compilation support by extending control flags and control over compiler options.
• Plenty of Nessus scan testing and longevity testing.

Minor

• Enhanced MAC OS X support. Builds and runs from svn tree. No installation, source only.
• Cross development configuration simplified. Simplified tools.config configuration.
• Improved tool searching algorithms in configure.
• Update to use latest doxygen for documentation generation.
• Fix C++ compiler warnings for a cleaner build.
• Documentation updates for configuration and building.
• Add IPv6 support for MACOSX and simplify IP4+6 implementations.
• Support simultaneous IPv4 and IPv6 connections.
• Initial BSD port. No installation, source only.
• Extensive valgrind, nessus and longevity testing
• VxWorks 6.X support.
• Add support for Visual Studio 9.0 and Visual Studio Express.
• SuSE linux support. Packaged releases provided, make install/uninstall operational.
• Update uclibc support.
• Remove requirement to have doxygen during the installation.
• Increase default input buffer allocation to 1K to include most request headers without having to reallocate memory.
• Improved documentation on building from source.

Fixes

• Cross-compilation fixes for make install and make package.
• Fix for ranged GETs when fetching a large chunk of data. Was sending incorrect data.
• Fix Keep-Alive header timeout. Was in milliseconds, changed to be in seconds.
• Fix for for large chunked requests hanging in some clients.
• Fix for requests with large (incoming) headers. 
• Fix various compiler warnings.
• Fix for responses with large headers exceeding the default buffer allocations.
• Fix valgrind tests.
• Change HTTP 1.0 requests to not use keep alive unless explicitly asked for via Connection headers.
• Fix case where under heavy load CGI process can get lost and the request can hang. Due to a reentrant signal handler.
• Fix Windows CGI processing was inoperable in 2.3.0.
• Fix directory listings.
• Fix Windows DLL search paths for locating DLLs.
• Fix setting CPU -m switch for GCC.
• Fixes for VxWorks cross compilation.
• Fix building the gacompat module.
• Fix request timeouts due to output data stalling when the socket becomes saturated.
• Fix memory leak when deleting handlers that manage their own variable store.
• Stop using mt.exe for embedding manifests into the application. VS mt.exe is bugged.
• Various build system fixes.
• Use chcon on shared libraries only if Security Enhanced Linux is enabled.
• Fix ssl redirect.
• Fixes for IPv6.
• Fixes for library list when building statically.
• Fix creation of C:/Program file on windows. Due to missing quotes on CustomLog file spec.
• Fixes for compiling with VS 2005. Added manifests and embedded manifests for executables and DLLs. Windows build is now compiled with VS 2005.
• Fix for memory leak with CGI programs
• Optimize stack size for requests with very large output headers.
• Improved valgrind test suite conformance
• Fix to permit recursion in Embedded Javascript and ESP
• Reduce number of TIME_WAIT sockets

Changes in 2.3.4

Fixes

• Cross-compilation fixes for make install and make package.

Changes in 2.3.3

Fixes

• Fix for for large chunked requests hanging in some clients.
• Some cross-compilation build and make fixes.

Changes in 2.3.2

Fixes

• Fix for ranged GETs when fetching a large chunk of data. Was sending incorrect data.
• Fixed SSL requests hanging when using large posted data.
• Fix Keep-Alive header timeout. Was in milliseconds, changed to be in seconds.

Changes in 2.3.1

Major

• Support conditional directives in Appweb configuration files using <IF>.
• Enhance cross-compilation support by extending control flags and control over compiler options.
• Plenty of Nessus scan testing and longevity testing.

Minor

• VxWorks 6.X support.
• Add support for Visual Studio 9.0 and Visual Studio Express.
• SuSE linux support. Packaged releases provided, make install/uninstall operational.
• Update uclibc support.
• Remove requirement to have doxygen during the installation.
• Increase default input buffer allocation to 1K to include most request headers without having to reallocate memory.
• Improved documentation on building from source.

Fixes

• Fix for requests with large (incoming) headers. 
• Fix various compiler warnings.
• Fix for responses with large headers exceeding the default buffer allocations.
• Fix valgrind tests.
• Change HTTP 1.0 requests to not use keep alive unless explicitly asked for via Connection headers.
• Fix case where under heavy load CGI process can get lost and the request can hang. Due to a reentrant signal handler.
• Fix Windows CGI processing was inoperable in 2.3.0.
• Fix directory listings.
• Fix Windows DLL search paths for locating DLLs.

Changes in 2.3.0

Minor

• Enhanced MAC OS X support. Builds and runs from svn tree. No installation, source only.
• Cross development configuration simplified. Simplified tools.config configuration.
• Improved tool searching algorithms in configure.
• Update to use latest doxygen for documentation generation.
• Fix C++ compiler warnings for a cleaner build.
• Documentation updates for configuration and building.
• Add IPv6 support for MACOSX and simplify IP4+6 implementations.
• Support simultaneous IPv4 and IPv6 connections.
• Initial BSD port. No installation, source only.
• Extensive valgrind, nessus and longevity testing

Fixes

• Fix setting CPU -m switch for GCC.
• Fixes for VxWorks cross compilation.
• Fix building the gacompat module.
• Fix request timeouts due to output data stalling when the socket becomes saturated.
• Fix memory leak when deleting handlers that manage their own variable store.
• Stop using mt.exe for embedding manifests into the application. VS mt.exe is bugged.
• Various build system fixes.
• Use chcon on shared libraries only if Security Enhanced Linux is enabled.
• Fix ssl redirect.
• Fixes for IPv6.
• Fixes for library list when building statically.
• Fix creation of C:/Program file on windows. Due to missing quotes on CustomLog file spec.
• Fixes for compiling with VS 2005. Added manifests and embedded manifests for executables and DLLs. Windows build is now compiled with VS 2005.
• Fix for memory leak with CGI programs
• Fix for stack overflow with very large output headers.
• Improved valgrind test suite conformance
• Fix to permit recursion in Embedded Javascript and ESP
• Reduce number of TIME_WAIT sockets

Changes in 2.2.2

Minor

• Added directive to enable / disable the TRACE method. Use TraceMethod on|off in the appweb.conf configuration file. The trace method is now disabled by default.
• The use of winTools.zip is now officially deprecated. Please use the cygwin tools from www.cygwin.com to build from source on windows instead.

Fixes

• Removed double quotes on module search path in trace log.
• Change to only call setFileName if the handler is not virtual. Change cgiHandler to use new flag MPR_HANDLER_NEED_FILENAME so setFileName is still called for cgiHandler.

Changes in 2.2.1

Fixes

• Fixed memory leaks in EJS.
• Fix configure to handle windows absolute and relative paths more intelligently.
• Close connection when uploaded content exceeds LimitRequestBody. This avoids a long wait if the upload is very large.
• Update search path in configure for Inno Setup 5 when doing windows builds.
• Improve path name resolution for packages when using Cygwin on windows.
• Updated memory leak tests.
• Replace and improve directory listing graphics .
• Improve robustness of 64-bit versions. Fix 64-bit conversions .
• Fix 64-bit basic and digest authentication.
• Fixed upload issue where medium to large files of a certain length would fail to upload.

Changes in 2.2.0

Major

• Completely reworked build configuration
• Upgrade support for latest PHP, MatrixSSL and OpenSSL packages.
• Added Debian (including Ubuntu) packages.
• Modularized packages. Now supplying binary, documentation, development and source packages separately.
• Changed file system locations to conform with the Linux File System Hierarchy (FSH) standard.
• Allow PHP to run single threaded.

Minor

• Optimized builds, now about 2x faster on some systems
• Updated build configuration tools. config.h, config.make, config.sh now renamed buildConfig
• Changed configure to always do a configure --reset.
• Improve bld tool library searching
• LoadModulePath now takes filenames with spaces. Must use quotes.
• Improve VS 2005 building support
• Speed up build times
• Change appweb to continue on invalid configuration file directives rather than aborting.
• Remove old PHP4 handler. Now only supporting PHP.
• Improve 64-bit Linux support
• Added windows tar installation capability
• Removed legacy configure options:
  • --without-xdb, --without-php4, --enable/disable-stdcpp
• The configure command now accepts absolute paths for --with-*-libpath and --with-*-dir switches
• The configure command now emits more information about the type of build and O/S and CPU versions
• Added support for negative ranged requests where the user requests N bytes from the end of a file.
• Improved code comments.

Fixes

• Fix when listening on a port number to listen on all IP addresses. Previously only listened on IP addresses that existed when Appweb was started. This fix enables the use of DHCP addresses once Appweb has started.
• Fix directory list wild card matching with trailing wild cards
• Make putHandler more robust when encountering invalid ranges. It will now ignore invalid ranges and proceed to accept uploaded files.
• Change listen backlog queue length to use the system defined maximum via SOMAXCONN
• Fix using ESP files as directory indexes
• Remove fdm=marker from all source files to fix vim warning.
• Fixed CGI incorrectly setting CGI program arguments. Removed argument setting.
• Updated copyright messages.
• Fixed pipelined ranged requests
• Fix single-threaded operation under windows.
• Fix for when select file handle becomes bad.

Changes in 2.1.1

Major

• None

Minor

• Add ESP "rename" command to rename files. Useful in upload forms.
• Add sample put and upload location blocks to appweb.conf
• Improve comments in appweb.conf
• Simplify configure defaults files and appweb.conf
• Change default build to not require PHP, MatrixSSL or OpenSSL
• Changed path references in directory listings to be relative paths for better Apache compatibility.

Fixes

• Fix directory listing sorting and file sizes.
• Prevent directory listings from caching in user's browsers.
• Fix ESP with large scripts.
• Fix GoAhead compatibility function redefining form and ASP functions.
• Fix loss of query string when matching the "/" URL.
• Fix VxWorks handling of path names when using an FTP based file system.
• Fix DocumentIndex handling if set to ESP pages
• Fix re-matching of handlers if a handler changes the request URI
• Remove uploaded temp files at the end of the request
• Improve calculation of random bytes for VxWorks
• Remove VxWorks SEM_INVERSION_SAFE flag to preserve defined priorities
• Fix Nan and Infinity calculations for VxWorks
• Fix compilation errors if ranges is not defined.
• Cleanup PHP shutdown
• Fix PUT handler processing when the file exists and also some ranged upload behavior.
• Fixed mprGetDirName API to handle file names with trailing "/"
• Added MPR_REQUEST_PRIORITY to run requests at normal priority. Select and pool management tasks run at elevated priority.
• Removed redundant assert in mpr/timer.cpp
• Reworked directory listing pages to be more Apache compatible with relative file paths.
• Fixed ranged downloads. Was downloading one character short.
• Fixed partial ranged downloads without a starting range.
• Fixed Location blocks in appweb.conf to append a trailing "/" to only match directories.
• Added Cache-Control: no-cache header to directory listing output.

Changes in 2.1.0

Major

• Added directory listing module: libdirModule
• Added put module for PUT and DELETE HTTP method support: libputModule
• Added HTTP/1.1 chunking support. Use the HttpChunking [on|off| directive to enable or disable. Also can use a custom HTTP header for client requests: X-Appweb-Chunk-Transfer header. Set value to "on" or "off" to control chunking on a per-request basis.
• Added HTTP/1.1 ranged transfer support for output and input requests.
• Added ErrorDocument directive for mapping HTTP errors to specific web pages. E.g.: "ErrorDocument 404 myErrorPage.html"
• Added IPv6 (prototype) support for Linux

Minor

• Optimized TCP/IP I/O and buffer sizes

Fixes

• Fix for simpleEsp sample when running HTTP client
• Fix for client fetch when running multithreaded but with no pool threads configured
• Fix for REMOTE_USER being set when authorization is used

Changes in 2.0.5

Fixes

• Enhanced GoAhead Compatibility API
• Fix for page redirection in when using the GoAhead Compatibility API
• Fix for websGetVar API
• Upgrade to support Inno Setup 5 for packaging Windows releases
• Support PHP 5.1.1
• Don't ask for password if doing a "make package" as root on Unix/Linux
• Determine correct "strip" program when doing cross-compilation
• Fix EJS diagnostic trace. Was truncating one character on trace lines.
• Improved longevity test suite and build farm testing
• Fix for handling time wrapping on long running servers
• Support SELinux
• Support for current versions of rpmbuild (Fedora Core 4)

Changes in 2.0.4

Fixes

• Fix for MatrixSsl handler where data was being read twice
• Fix header in config.h
• Add new switches to configure: --enable-ejs, --enable-samples, --enable-test, --with-PACKAGE-cflags, --with-PACKAGE-iflags, --with-PACKAGE-ldflags
• Fix several compilers warnings for ARM
• Fix crash when reading a users.db authorization file
• Fix MPR Var deep copy
• Fix MPR Select / Task interaction

Changes in 2.0.3

Fixes

• Fix httpPassword overwriting existing password entries
• Fixed bad build output formatting.
• Improved error messages in Appweb
• Fix windows SSL crash due when missing a TypesConfig directive and using SSL
• Fix wrong license agreement display when installing.

Changes in 2.0.2

Fixes

• Fix for form.php to post back to itself
• Various code cleanup
• Compiler fixes for when logging is disabled

Changes in 2.0.1

Fixes

• Fix for VxWorks truncating large files
• Fix PHP flushing

Changes in 2.0.0

Version 2.0.0 is the next stable release after the 1.2 series. The description below lists the major changes relative to the 1.2 release.

Major

• Embedded Server Pages greatly enhanced. New parser, new Embedded JavaScript. Now supporting:
• • Session state access via the session[] array
  • Global application data via the application[] array
  • Uploaded files accessible via files[] array
  • Configurable auto-session creation
  • Other variable arrays include: cookies[], server[], request[], headers[], form[], global[], local[]
• Embedded Server Pages broken out as a separate source code module.
• Embedded JavaScript rewritten and greatly enhanced. Now supports:
• • Object type and the new reserved word
  • Array type
  • Boolean type
  • Floating point
  • 64 bit integer support
  • Automatic casting between types
  • Functions
  • for / in statement to iterate through arrays or objects
  • Extended standard procedure library: print, println, printVars, trace
• Merged appweb and winAppweb. Windows application intelligently runs as a command line program, windows program or system service depending on the command line switches. Easier invocation by supporting configuration via command line. Can now just run "appweb".
• File upload module completed and now supported. File upload usable from ESP, EJS and CGI.
• PHP 5.0 support
• Save configuration routines to save the run-time configuration back to a standard Appweb configuration file.
• Completely new installation and packaging routines. Supports a flexible make install set of targets including: install, install-dev, install-release, install-samples, install-doc, install-src, install-all. Make install also supports a ROOT_DIR environment setting to re-base the installation directories. This feature includes a safe uninstall. See INSTALL.TXT in the source directory for full details.
• Ability to create new native distribution packages from a source build tree.
• VxWorks port.
• Extended cross compilation system to support cross-O/S development.
• Rewrite the CGI subsystem to be more uniform across all operating systems.
• Lots of improvements to the configuration and build system
• Windows switches to use configure and the makefile system. Supports a subset of CYGWIN called winTools for building.
• Added file upload handler

Changes in 1.3.6

Fixes

• Several compile time fixes when using configure with some options. Fix for building EJS without floating point.
• Fix for not launching the documentation on Windows when the installation is complete
• Fixed date calculations for IF_MODIFIED requests being off for 1 day.
• Fixed formatting of README.TXT files to be DOS format (CR/LF)
• Fixed request.cpp compilation when not using SSL
• Fix building with C-API without ESP
• Fix crash in request.cpp when requests timeout
• Fix compiling request.cpp without SSL

Changes in 1.3.5

Minor Features

• Add request variable REQUEST_TRANSPORT that is set to "http" or "https" depending on whether SSL is used or not.
• Simplify the regeneration of the documentation.
• EJS: Add support for automatic casting to strings when types require casting.

Fixes

• Fix MatrixSsl bug where some data can be lost and a request can hang.
• Fix uClinux integration. Support uClinux 3.2.0
• Fix for browser not refreshing content correctly. Change to copyHandler.
• Fix for single threaded compilation.
• Fix for compiling samples when using --disable-static
• Fix for running configure on linux. Changes to bin/bld.
• Fix for uClinux building. Changes to bin/bld to use BIT_CFLAGS instead of BIT_LDFLAGS.
• Fix for building on Linux. Was not testing for existence of cygpath correctly.
• Fixed bugs in EJS for comparisons with non-boolean operands.
• Fix EJS issue with unary minus calculations.

Changes in 1.3.4-5

Major Features

• Completely new installation and packaging routines. Supports a flexible make install set of targets including: install, install-dev, install-release, install-samples, install-doc, install-src, install-all. Make install also supports a ROOT_DIR environment setting to re-base the installation directories. This feature includes a safe uninstall. See INSTALL.TXT in the source directory for full details.
• Ability to create new native distribution packages from a source build tree.
• Create a C API for the httpClient. Use --enable-c-api-client

Minor Features

• Expose the GoAhead WebServer compatibility API via the Compat module
• Create a C API for the httpClient. Use --enable-c-api-client
• Removed SessionAutoCreate from the makefiles. The default for this is now off. Users must include useSession(); in their ESP pages or explicitly turn this directive back on. This was removed to boost performance for pages that do not require session handling.
• Added a new LimitScriptSize directive to specify the maximum ESP script size. This replaces the previously overloaded use of LimitResponseBody.
• Partitioned documentation to prepare for future derivative products. Stay tuned.
• Fix source tree so it can be built from a read-only tree.
• Update to latest PHP 5.0.3 release for the PHP module
• Support spaces in file names and install in "/Program Files/Embedthis Appweb" on Windows by default.
• Updated WinTools to use latest Cygwin tools.
• Added file upload limit. Directive is LimitUploadSize.
• Convert windows make package to use cygwin zip utilities and not winzip.

Fixes

• Fix including of ESP include files to look for the included file in the same directory as the base ESP page.
• Fix for "make uninstall" to not to change permissions of any standard directories
• Fix segfault on large ESP pages. This occurred when the page exceeded the maximum configured via the LimitResponseBody directive. Use LimitScriptSize in future to specify or modify the default maximum size (128K) of a script.
• Added clearer error messages when the maximum script size is exceeded.
• Fixed missing API documentation.
• Fix permissions on the bin directory for installed appweb (make install).
• Fix errors in make install for missing users.dist, groups.dist and libsslModule.so
• Fix obscure hang in httpClient if server dies.
• Add cpio, id and awk to WinTools. Also added curl for those using the test framework via an Appweb subversion checkout.
• Fix assert in ESP when assigning to non-existent object arrays
• Warn in ESP if assigning to sessions and sessions are not enabled. Uses now must either put useSession() in their web page or turn on SessionAutoCreate in their configuration file.
• Fix for a multithreaded race in EJS/ESP under heavy load. Our longevity test harness caught this one.
• Fixed multithreaded deadlock in CGI under heavy load.
• Fix printVars displaying the wrong value for an array length
• Fixed crash in testClient when server is not running. Only impacted test framework.
• Fixed search path for locating the ServerRoot.
• Fixed file upload handler for parsing boundaries.
• Fixed PHP handler processing of empty forms.
• Made MaRequest::readPostData more robust.

Changes in 1.3.3

The 1.3.1 and 1.3.2 releases were internal releases only and were not publicly made available.

Major Features

• VxWorks port.
• Extended cross compilation system to support cross-O/S development.
• Rewrite the CGI subsystem to be more uniform across all operating systems.

Minor Features

• The PHP handler now supports the PHP flush function.
• Added function to create ESP array variables in ESP C functions.
• Add file upload.esp sample file.
• Fix and extend samples for the new ESP and EJS.
• Add support for the If-Match and If-UnMatch HTTP headers.
• Disable timeouts if running Appweb in debug mode (-D). This disables the Keep-Alive, Session and general request Timeout.
• Allow Alias directives to alias files. Previously only directories could be aliased.
• Rewrite of CGI / CMD to be simpler. Necessitated by VXWORKS port.
• Speedup makedep on Windows for first time builds.
• Add ESP convenience API espCreateArrayVar.
• Add mprSetThreads API to extend the C API.

Fixes

• The following fixes are applied from 1.2.4
  • Fix in validating URLs with consecutive "/" characters
  • Fix for upload handler with ":" characters in the upload URL
  • Add new directive ListenIF that allows listening on an interface
  • Fix bug for long ESP/EJS tokens
• Change session cookies to only persist while the user's browser is open.
• Fix to allow functions to have the opening brace on the same line as the function keyword.
• Get all samples building. Supply makefiles for the Appweb build system and stand-alone makefiles.
• Improve error messages for several error conditions to make diagnosis easier.
• Add msvcrt.dll to the distribution to prevent DLL versioning issues.
• Fix various memory leaks
• Fix for EJS to not iterate over the length property for arrays in a for... in statement
• Fix for EJS to allow "var" in a for (var .. statement
• Fix for EJS syntax error when defining a for (.. in statement inside a function
• Fix for EJS "var o = new Array;"
• Fix for EJS testing variables against -1
• Fix for crashing issue CGI when a CGI request times out.
• Update configure to fix syntax error for --with-c-api. Support --with-c_api as an alias.
• Fix for "make uninstall" to not remove any standard directories.
• Fixed matrixssl handler hanging when serving large files.
• Fixed sessions being continually re-created when browsers respond with multiple cookies.
• Fix several compiler errors when compiling single-threaded.
• Fix compiler errors when excluding various modules.

Changes in 1.3

This is a major feature release and is part of the development branch. Users wanting stability should continue to use the stable 1.2.X series. This 1.3 release does have some compatibility changes.

Major Features

• Embedded Server Pages greatly enhanced. New parser, new Embedded JavaScript. Now supporting:
• • Session state access via the session[] array
  • Global application data via the application[] array
  • Uploaded files accessible via files[] array
  • Configurable auto-session creation
  • Other variable arrays include: cookies[], server[], request[], headers[], form[], global[], local[]
• Embedded Server Pages broken out as a separate source code module.
• Embedded JavaScript rewritten and greatly enhanced. Now supports:
• • Object type and the new reserved word
  • Array type
  • Boolean type
  • Floating point
  • 64 bit integer support
  • Automatic casting between types
  • Functions
  • for / in statement to iterate through arrays or objects
  • Extended standard procedure library: print, println, printVars, trace
• Easier invocation by supporting configuration via command line. Can now just run "appweb".
• Merged appweb and winAppweb. Windows application intelligently runs as a command line program, windows program or system service depending on the command line switches.
• PHP 5.0 support
• Save configuration routines to save the run-time configuration back to a standard Appweb configuration file.

Minor Features

• Simplify the build system by removing the need for template files.
• Aliases are now per host instead of being per server.
• Allow Aliases to come before or after directory blocks that describe the alias destination.
• Build system improvements for building external packages
• Improved 64-bit and Solaris support.

Fixes

• Fix bug where URLs that matched aliases were incorrectly defining an their CGI EXTRA_PATH calculation. Added a new configuration directive ExtraPath that can be used in Location blocks to specify that a handler should perform extra path calculations. NOTE: this is normally not required.
• Fix some build issues with various configuration options.
• Fix the inheriting of directory authorization information.

Compatibility Changes

• The MaServer::configure command has reduced its parameter count from 2 to 1.
• maGetVar and maSetVar now require an object array argument to specify the variable array to access.
• The C++ EspProc method of creating ESP procedures is now deprecated. It will be supported until version 3.X when it will be removed from the product. Users should call espDefineCFunction instead.
• The EJS module has been removed it is now integrated into the ESP module.
• The previous session APIs have been integrated into MaRequest::setVar and MaRequest::getVar

Features in 1.2.3

This is a minor bug fix release.

Fixes

• Fix compatibility issue in libcompatModule with GoAhead WebServer. Was not creating environment variables for posted data. Will only do this if the data is URL encoded.
• Fixed Windows not matching case of URL extensions correctly.

Features in 1.2.2

This is a minor bug fix release.

Fixes

• Fix for ESP includes. On windows, was including files with text processing which resulted in bad content lengths. Now reading RAW.
• Added MatrixSSL handler
• Re-added some missing documentation pages
• Changed default MPR number of threads to 10. Can be overridden in the appweb.conf file.
• Fixed several authorization issues relating to ordering of directives in the configuration file.
• Fixed encoding of "/" in query vars.
• Fixed Windows not matching case of URL extensions correctly.

Changes in 1.2.1

This is a minor bug fix release.

Fixes

• Fix for large SSL requests. Some large requests would not be processed and would be prematurely terminated. There are no known security implications.

New Features in 1.2

This 1.2 release rolls all the changes in the 1.1.X development stream into a new stable release. The description below is a summary of the key changes.

Major Features

• Integrated module for PHP4 and PHP
• Enhanced Embedded Server Pages supporting post-back
• Session handling and cookie management
• Extended documentation with a wealth of new material
• Small C library support via uClibc
• uClinux support.
• Completely revised build system and configuration to better support cross-compilation and modular selection of features.

Minor Features

• Enhanced C-API
• httpClient supports single threaded operation.
• New compact libminiStdc++ library to replace libstdc++ reduces memory footprint.
• Experimental ports for Solaris and MAC
• Upgraded PHP and OpenSSL versions

Fixes

• All fixes mentioned in the 1.1 stream below
• Fixed a Denial of Service issue where accesses to /esp could consume 100% of the CPU.

Compatibility Changes

• None
  

New Features in 1.1.3

Major Features

• Include PHP support
• Enhanced uClibc support -- no patch required.
• Enhanced uClinux support.

Minor Features

• httpClient supports single threaded operation.
• Add new compact libminiStdc++ library to replace libstdc++. This reduces default memory footprint with glibc considerably.
• Merge Subversion initialization command setupTree into the configure command.
• Add to the top level Makefile and configure program the ability to autoconfigure.
• Improve comments in configure, configuration template files and in the default configuration files. The make.rules file is now common across all operating systems.
• Eliminate the need for LD_LIBRARY_PATH unless debugging in the tree. The "make run" target and many other internal build commands automatically set the library path where required.
• Version the appweb library.
• Include packaging file lists in the source release.

Fixes

• Fix location of the libraries needed by PHP when creating a distribution package
• Fix for URLs that have trailing "." or " " in Windows. Fix prevents returning the page as pure text. This bug affected windows systems only for handlers that are matching by extension. This typically means ESP and PHP pages configured to match URLs by extension. If using URL prefix matching, the bug does not appear.
• Fix the 'h' formatting option for the CustomLog directive. This outputs the remote host name in the access log
• Fix session timeouts. Session timeouts did not renew when subsequent session activity occurred. Timeouts will now cause a session to be deleted when there is no activity on the session for the timeout period.
• Security fix for Windows allowing access to secured URLs by mixing case.
• Fix for HEAD, and TRACE not being handled correctly by some handlers.
• Security fix for user message disclosing too much information when denying access. (Ziv)
• Fix for VirtualHosts (including SSL virtual hosts) incorrectly parsing authorization configuration directives. (Ziv)
• Fix when using ROM fs on Windows. Was still accessing file system routines. (Black&White)

Changes in 1.1.2

Major Features

• Enhanced cross-compiling support. Configure program supports --build, --host and the setting of CFLAGS, IFLAGS, LDFLAGS, CC, LD, AR, RANLIB, CC_FOR_BUILD, LD_FOR_BUILD.
• More documentation via README.TXT and FILES.TXT files in many directories.
• Small libc, uclibc support
• Uclinux support

Minor Features

• Merged per O/S configuration files into a single file.

Fixes

• Corrected the Windows Start Menu shortcut
• Rebuild OpenSSL with msvcrt.dll rather than msvcr71.dll
• Fix some errors in the README.HTML and converted to README.TXT
• Modify the source distribution appweb.conf to not load libcompat
• Fixed handling of URLs with upper case extensions (e.g. file.HTML)

Changes in 1.1.1

Major Features

• Enhanced Embedded Server Pages (ESP) allowing post-back to same page
• Integrated Session handling including C and Javascript APIs.
• Include a more feature-rich PHP module and upgrade PHP version.
• Enhanced C-API
• Authorization APIs for modifying user and group auth details at run-time
• Added a fully static appweb program
• First pass Solaris port
• Experimental fFile upload (Nick again)

Minor Features

• "make install" for installing directly from source
• Support full static linking with Appweb libraries and building static versions.
• Add LoadModulePath directive to make it easier to maintain module paths
• Removed Matrix SSL handler. This is now being handled directly by PeerSec. See (http://www.matrixssl.org)
• Speed up building on Windows with Cygwin
• Enhanced GoAhead WebServer API compatibility
• Extended build system, configure command and bld script.
• Upgrade OpenSSL versions

Fixes

• Fix for ESP pages with 8-bit characters in scripts.
• Fix duplicate environment variables in simpleEgi sample.
• Fix some build circular dependencies.
• Fix incomplete requests not handling keep alive correctly.
• Don't close keep-alive connections for requests returning 304 (not modified) ]
• Fix mprStrCmpAnyCase routine.
• Fix Content-Length handling when the length is zero.
• Fix MaRequest:getCrackedCookie.
• Fix when using ROMed web pages
• Fix some visual studio project files that referenced libraries of the wrong build type.

Compatibility Changes

• None

Changes in 1.1

Major Features

• PHP module for fast embedded execution of PHP applications and scripts
• First pass source code MACOSX port
• Greatly enhanced build system supporting granular selection of build features.

Minor Features

• Support full static linking with Appweb libraries and building static versions.
• Add LoadModulePath directive to make it easier to maintain module paths
• Removed Matrix SSL handler. This is now being handled directly by PeerSec. See (http://www.matrixssl.org)
• Speed up building on Windows with Cygwin

Fixes

• Fix for ESP pages with 8-bit characters in scripts.
• Fix duplicate environment variables in simpleEgi sample.
• Fix some build circular dependencies.
• Fix incomplete requests not handling keep alive correctly.
• Don't close keep-alive connections for requests returning 304 (not modified) ]
• Fix mprStrCmpAnyCase routine.
• Fix Content-Length handling when the length is zero.

Compatibility Changes

Changes in 1.0.4

Fixes

• Fix for URLs that have trailing "." or " " in Windows. Fix prevents returning the page as pure text. This bug affected windows systems only for handlers that are matching by extension. This typically means ESP and PHP pages configured to match URLs by extension. If using URL prefix matching, the bug does not appear.
• Fix the 'h' formatting option for the CustomLog directive. This outputs the remote host name in the access log.
• Security fix for Windows allowing access to secured URLs by mixing case.
• Fix for HEAD, and TRACE not being handled correctly by some handlers.
• Security fix for user message disclosing too much information when denying access. (Ziv)
• Fix for VirtualHosts (including SSL virtual hosts) incorrectly parsing authorization configuration directives. (Ziv)

Changes in 1.0.3

Fixes

• Fix for digest handing on Windows.
• Fix for formatting of secure cookies.
• Enhance keep-alive for request errors.
• Remove the MatrixSSL handler (now supplied directly in the MatrixSSL distribution -- see http://www.matrixssl.org).

Changes in 1.0.2

Fixes

• Fixes for Windows PHP handling. Define the SCRIPT_FILENAME environment variable. NOTE: users must change the cgi_pathinfo setting in their /WINDOWS/PHP.INI file to be set to "1". This instructs PHP to operate according to the standards.
• Fix for launching Firefox / Firebird by double-clicking on the Windows tray icon.
• Fix for bad DocumentIndex directive if occurring after the ScriptAlias directive for CGI files.
• Several fixes for memory leaks when compiling Multithreaded.

Changes in 1.0.1

Documentation

• Few small fixes.

Fixes

• Test if a URL maps to a Windows device file. Fixes a crash condition on Windows NT, 9X and 2000.
• Fixed setting of Content-Length when the length of the content is not known. Changes to rq->setHeaderFlags
• Fix handling of poorly formed OPTIONS requests.

Changes in 1.0

Major Features

• Extensive push to test Appweb to its limits with extreme load and long "soak" testing.

Minor Features

• Support the Action directive to make it easier to configure CGI programs that cannot use "#!/path" in the first line of the script.
• Fix and simplify configuration for CGI Perl, Python and PHP. New Action and AddType directives to the rescue.
• Test suite extended for CGI programs and for long POST data requests.

Performance

• Boost performance for Windows socket handling
• Boost performance for HTTP requests with long POST data.

Documentation

• Few small fixes.

Fixes

• Fix a CGI multi-threaded bug where returning CGI data would interfere with subsequent Keep-Alive request data
• Fix MPR_FEATURE_MALLOC_HOOK when using the fast memory allocator
• Some fixes for Matrix SSL
• Disable log file rotation -- Security risk in current default configuration. (Can be re-enabled in source code)
• Fix a race condition with the socket handling code on Windows

New features in 0.9.1

Major Features

• Full support for Matrix SSL (small footprint embedded SSL)
• Cookie support
• Add setHeader API to allow handlers to define and override HTTP headers

Minor Features

• Add support for TRACE and OPTIONS HTTP methods
• Tighten handler checking to only respond to supported HTTP methods
• Allow ESP pages to post back forms to themselves. Test on REQUEST_METHOD == "POST" to determine if the page is being displayed for the first time or whether the form is being submitted. One ESP page can be used to display and process the data.
• Improved debug trace for httpClient and the appweb servers.
• Improved unit test for CGI and

Documentation

• Lots of small fixes.

Architecture

• Enhanced post data handling. The postData handler method is now called after the run method. It will be called as required to push post data to the handler.
• Post data pull mode support. Handlers can request to pull the post data rather than having it pushed to them. The Request::setPullPost will enable pull mode. The Request::readPostData API can be called in the handler to pull the post data as required.

Fixes

• Fix error with poorly form HTTP headers in some cases.
• Fix attempting to start appweb.exe when installing only the source code on Windows.
• Fix setResponseCode API to remove assert on non-200 response codes.
• Lots of minor fixes.
• Append to the access log on restarts.

Compatibility Changes

• The postData method and usage in the Appweb handler interface has bee reworked.

New features in 0.9.0

General

• SSL is now supported "out of the box".
• GoAhead WebServer compatibility module (compatModule) now supported.
• C Language API and samples complete.
• Automatically launch browser after install to display documentation.
• Run as a windows service and automatically install as a service on Windows

Performance

• Shrink code on all platforms (Now from 120K to 300K).
• Compile without using exceptions -- further code size reduction.
• Performance gains. Throughput exceeds 3,500 requests per second (P4 2.4 GHZ running both client and server on Linux)

Documentation

• Documentation arrives
• Extensive overviews, guides, how-to documents, samples, references and APIs
• Samples are now divided into C and C++ samples with lots of extra samples including event loop integration samples.
• The installation now offers to install the documentation as a separate component.
• Documented C Language API.
• Documented C++ Language API.
• Lots more code comments.

Architecture

• New SSL Provider interface.
• Enhanced module loading interface.

Fixes

• Fix Appweb not starting on system reboot on Linux.
• Fix build errors when compiling with various FEATURE combinations specified via bld.h and configure.
• Fixed issues with Visual Studio.NET upgrading Visual Studio 6 project files.
• Fix building source when installed stand-alone without the binary install.
• Fixed bug handling empty password and group authorization files.
• Fix windows link errors 4217, 4049
• Fix windows bug where aliases without drive specs were not handled correctly.
• Fix bug escaping URLs.
• Fix bug with windows event processing under heavy load where an event could get lost.
• Lots of minor fixes.

Compatibility Changes

• The module loading API has changed to allow modules to parse the configuration file.
• sslHandler has been renamed sslModule.
• The SSL provider interfaces has been rewritten.

Changes in Embedthis Appweb 0.8.1

Dynamic Content

• Embedded Server Pages
• Embedded JavaScript
• Embedded Gateway Interface (in-memory CGI)
• CGI/1.1

Security

• Secure Sockets Layer (SSL)
• Basic and Digest Authentication
• Directory and URL location based authorization
• Sandbox limits
• Access and access violation logging

Modularity

• Dynamic loading of modules
• Extensible URL handlers
• Extensible / replaceable authorization, SSL and script

Easy to Use

• Apache-style configuration file
• Debugging and trace logging
• Packaged installations for Linux and Windows
• Run as a service / daemon

Other Features

• HTTP server and client access program
• Named and IP based virtual hosts
• Listen on multiple ports
• Compile web pages and files into C code for execution from ROM

Standards

• HTTP/1.1
• CGI/1.1
• Apache configuration file compatibility

Performance

• Multithreaded with high performance thread pool
• Request throughput (> 4,500 requests per second)
• Scales on multi-cpu systems
• Small memory footprint even under heavy load (from 1MB)

Developer Features

• HTTP server and client libraries
• Shared and static libraries supplied
• C and C++ APIs
• Operate single-threaded or multithreaded (Compile or run-time selectable)
• Easy, intuitive programming model
• Integrate with common event mechanism: Windows Messages, Unix select, dedicated thread
• Coding minimized as most features can be specified via the configuration file
• Cookbook of samples (cut and paste to get going)
• SMP safe
• Extensive debug trace logging