• last updated 7 hours ago
Constraints
Constraints: committers
 
Constraints: files
Constraints: dates
- improve API documentation

- return default instead of "" in case a lookup fails or not configured

- use stored procedure sec_session_property__upsert

  1. … 2 more files in changeset.
- standardize url construction to protect against injection attacks

  1. … 5 more files in changeset.
Merging back to HEAD all changes that happened in branch oacs-5-8 between tags: vg-merge-oacs-5-8-from-20141027 and vg-merge-oacs-5-8-from-20150427

  1. … 520 more files in changeset.
- address bugs #3244 and #3245

  1. … 1 more file in changeset.
- handle case, where driver is loaded, but not started. Recent NaviServer uses for this case port == 0

Merging back to HEAD branch oacs-5-8 (using tag vg-merge-oacs-5-8-from-20141027).

  1. … 2547 more files in changeset.
- don't look for configuraton parameter "Hostname", but use "hostname" as used in the sample configfiles

- change spelling of TCL to Tcl

- change requirements to Tcl 8.5

  1. … 64 more files in changeset.
- only variables in a non-top namespace survive session cleanup. The logic of the old code assumed that global variables survive the request-cleanup. now, the cached values is kept in the ::acs::* namespace

- undo previous secure-cookie change since it interacts badly in situations where "RestrictLoginToSSLP" is "1" and https is available: In such cases, e.g. the login page is redirected from a http (insecure) url to an https (secure) page. But when later continuing on the http connection, the user appears to be not logged in, since a well-behaved browser does not send the "secure" login coockie over the insecure connection.

- white space changes: replace tabs by spaces

- replace "global" statement by variables with namespace paths

- move deprecated procs to file with deprecated functions

  1. … 1 more file in changeset.
- setting login-cookie to "secure" when set over secure connection

- just set secure flag for secure connections

- use signed cookie for session_id

- renew the session_id after privilege level change from unidentified to identified user

- fix typo

- brace while expressions

- don't use expr within while expression

- use numeric comparison for truth values

- normalize string expressions

  1. … 9 more files in changeset.
- use per-thread caching for security::driver and ad_server_modules

- new functions security::driver and ad_server_modules to simplify

redundant logic for determining secure drivers

- remove default value from ns_config, otherwise the function determines 443 also for non-configured ssl

- fix uninitialized variable

- try to simplify logic to determine drivers

- dropped nsunix

- use string ops instead of regexp

- modernize tcl

  1. … 9 more files in changeset.
- replace deprecated "ad_get_user_id" by "ad_conn user_id"

  1. … 8 more files in changeset.
- reduce hard-coded config-section names in code

Performance improvements for rp_filter and parameter:

- improve performance of rp_filter (which is run on every

non-resources request) significantly (often a factor of 2)

- improve scalability by reducing number of required mutex locks

(e.g. for secret token handling)

  1. … 8 more files in changeset.