summaryrefslogtreecommitdiffhomepage
path: root/src/http/modules (follow)
AgeCommit message (Collapse)AuthorFilesLines
2012-12-21Image filter: fixed image_filter rotate inheritance.Maxim Dounin1-9/+15
Configurations like location /i/ { image_filter resize 200 200; image_filter rotate 180; location /i/foo/ { image_filter resize 200 200; } } resulted in rotation incorrectly applied in the location /i/foo, without any way to clear it. Fix is to handle conf->angle/conf->acv consistently with other filter variables and do not try to inherit them if there are transformations defined for current location.
2012-12-21Geo: ensure that default entry is always present.Ruslan Ermilov1-4/+2
If 0.0.0.0/32 entry was present and there was no explicit "default", we failed to add an empty string as a default value.
2012-12-21There's no need to normalize address returned by ngx_ptocidr().Ruslan Ermilov1-1/+1
2012-12-20Image filter: configuration inheritance fixes.Maxim Dounin1-10/+18
The image_filter_jpeg_quality, image_filter_sharpen and "image_filter rotate" were inherited incorrectly if a directive with variables was defined, and then redefined to a literal value, i.e. in configurations like image_filter_jpeg_quality $arg_q; location / { image_filter_jpeg_quality 50; } Patch by Ian Babrou, with minor changes.
2012-12-20Brought the link to ngx_http_perl_module documentation up to date.Ruslan Ermilov1-1/+1
2012-12-19Let "add_header" affect 201 responses (ticket #125).Ruslan Ermilov1-0/+1
2012-12-19Slightly optimized code that handles special headers in "add_header".Ruslan Ermilov1-29/+21
2012-12-17Added checks that disallow adding a variable with an empty name.Ruslan Ermilov6-6/+20
Added variable name syntax checks to "geo" and "map" directives.
2012-12-14Geo: fixed the "ranges" without ranges case.Ruslan Ermilov1-15/+18
The following configuration returned an empty value for $geo: geo $geo { ranges; default default; }
2012-12-14Geo: improved ngx_http_geo_block() code readability.Ruslan Ermilov1-3/+2
2012-12-14Gzip: fixed zlib memLevel adjusting.Valentin Bartenev1-0/+4
An incorrect memLevel (lower than 1) might be passed to deflateInit2() if the "gzip_hash" directive is set to a value less than the value of "gzip_window" directive. This resulted in "deflateInit2() failed: -2" alert and an empty reply.
2012-12-13Fixed variable syntax checking in "set", "geo", "limit_conn_zone",Ruslan Ermilov4-4/+11
and "perl_set" directives.
2012-12-13Proxy: better error message about unexpected data.Maxim Dounin1-1/+2
Requested by Igor Sysoev.
2012-12-10The "auth_basic" directive gained support of variables.Ruslan Ermilov1-47/+36
2012-12-06Allow the complex value to be defined as an empty string.Ruslan Ermilov6-10/+10
This makes conversion from strings to complex values possible without the loss of functionality.
2012-12-06Xslt: prevented infinite loop.Ruslan Ermilov1-2/+2
If XSLT transformation failed and error 500 was handled in the same location, an infinite loop occured that exhausted the stack.
2012-12-03Fixed build with embedded perl in certain setups (ticket #48).Ruslan Ermilov1-14/+3
2012-11-29Version bump.Maxim Dounin1-1/+1
2012-11-26Gunzip: added missing ngx_http_clear_etag().Maxim Dounin1-0/+1
2012-11-21Request body: recalculate size of a request body in scgi module.Maxim Dounin1-10/+16
This allows to handle requests with chunked body by scgi module, and also simplifies handling of various request body modifications.
2012-11-21Request body: always use calculated size of a request body in proxy.Maxim Dounin1-16/+11
This allows to handle requests with chunked body, and also simplifies handling of various request body modifications.
2012-11-21Request body: chunked parsing moved to ngx_http_parse.c from proxy.Maxim Dounin1-276/+14
No functional changes.
2012-11-21Dav: fixed segfault on PUT if body was already read (ticket #238).Maxim Dounin1-0/+5
If request body reading happens with different options it's possible that there will be no r->request_body->temp_file available (or even no r->request_body available if body was discarded). Return internal server error in this case instead of committing suicide by dereferencing a null pointer.
2012-11-16Version bump.Ruslan Ermilov1-1/+1
2012-10-29Variables $connection and $connection_requests.Maxim Dounin1-23/+0
Log module counterparts are removed as they aren't used often and there is no need to preserve them for efficiency.
2012-10-18Gunzip: fixed r->gzip_ok check.Maxim Dounin1-1/+1
2012-10-05OCSP stapling: properly check if there is ssl.ctx.Maxim Dounin1-1/+1
This fixes segfault if stapling was enabled in a server without a certificate configured (and hence no ssl.ctx).
2012-10-03Log: $apache_bytes_sent removed.Maxim Dounin1-8/+0
It was renamed to $body_bytes_sent in nginx 0.3.10 and the old name is deprecated since then.
2012-10-03SSL: the "ssl_verify_client" directive parameter "optional_no_ca".Maxim Dounin1-1/+2
This parameter allows to don't require certificate to be signed by a trusted CA, e.g. if CA certificate isn't known in advance, like in WebID protocol. Note that it doesn't add any security unless the certificate is actually checked to be trusted by some external means (e.g. by a backend). Patch by Mike Kazantsev, Eric O'Connor.
2012-10-03Version bump.Maxim Dounin1-1/+1
2012-10-01OCSP stapling: ssl_stapling_verify directive.Maxim Dounin2-2/+12
OCSP response verification is now switched off by default to simplify configuration, and the ssl_stapling_verify allows to switch it on. Note that for stapling OCSP response verification isn't something required as it will be done by a client anyway. But doing verification on a server allows to mitigate some attack vectors, most notably stop an attacker from presenting some specially crafted data to all site clients.
2012-10-01OCSP stapling: loading OCSP responses.Maxim Dounin2-5/+57
This includes the ssl_stapling_responder directive (defaults to OCSP responder set in certificate's AIA extension). OCSP response for a given certificate is requested once we get at least one connection with certificate_status extension in ClientHello, and certificate status won't be sent in the connection in question. This due to limitations in the OpenSSL API (certificate status callback is blocking). Note: SSL_CTX_use_certificate_chain_file() was reimplemented as it doesn't allow to access the certificate loaded via SSL_CTX.
2012-10-01OCSP stapling: ssl_stapling_file support.Maxim Dounin2-0/+27
Very basic version without any OCSP responder query code, assuming valid DER-encoded OCSP response is present in a ssl_stapling_file configured. Such file might be produced with openssl like this: openssl ocsp -issuer root.crt -cert domain.crt -respout domain.staple \ -url http://ocsp.example.com
2012-10-01OCSP stapling: ssl_trusted_certificate directive.Maxim Dounin2-3/+22
The directive allows to specify additional trusted Certificate Authority certificates to be used during certificate verification. In contrast to ssl_client_certificate DNs of these cerificates aren't sent to a client during handshake. Trusted certificates are loaded regardless of the fact whether client certificates verification is enabled as the same certificates will be used for OCSP stapling, during construction of an OCSP request and for verification of an OCSP response. The same applies to a CRL (which is now always loaded).
2012-09-26Version bump.Maxim Dounin1-1/+1
2012-09-11Gunzip: removed nginx.h leftover include.Maxim Dounin1-1/+0
2012-09-10Gunzip filter import.Maxim Dounin1-0/+677
2012-09-10Gzip static: "always" parameter in "gzip_static" directive.Maxim Dounin1-10/+32
With "always" gzip static returns gzipped content in all cases, without checking if client supports it. It is useful if there are no uncompressed files on disk anyway.
2012-09-10Memcached: memcached_gzip_flag directive.Maxim Dounin1-8/+56
This directive allows to test desired flag as returned by memcached and sets Content-Encoding to gzip if one found. This is reimplementation of patch by Tomash Brechko as available on http://openhack.ru/. It should be a bit more correct though (at least I think so). In particular, it doesn't try to detect if we are able to gunzip data, but instead just sets correct Content-Encoding.
2012-09-03Limit req: fix of rbtree node insertion on hash collisions.Valentin Bartenev1-4/+4
The rbtree used in ngx_http_limit_req_module has two level of keys, the top is hash, and the next is the value string itself. However, when inserting a new node, only hash has been set, while the value string has been left empty. The bug was introduced in r4419 (1.1.14). Found by Charles Chen.
2012-08-30Fixed strict aliasing bugs when dealing with IPv4-mapped IPv6 addressesRuslan Ermilov2-2/+20
(closes #201).
2012-08-28Fixed the "include" directive.Ruslan Ermilov1-10/+2
The "include" directive should be able to include multiple files if given a filename mask. Fixed this to work for "include" directives inside the "map" or "types" blocks. The "include" directive inside the "geo" block is still not fixed.
2012-08-27Version bump.Ruslan Ermilov1-1/+1
2012-08-17Mark logically dead code with corresponding comment.Andrey Belov1-0/+1
Found by Coverity.
2012-08-17Mp4: removed restriction to avc1/mp4a formats (ticket #194).Maxim Dounin1-8/+0
2012-08-16Geo: fixed handling of ranges without default set.Maxim Dounin1-4/+4
The bug had appeared in 0.8.43 (r3653). Patch by Weibin Yao.
2012-08-16Map: fixed optimization of variables as values.Maxim Dounin1-8/+2
Previous code incorrectly used ctx->var_values as an array of pointers to ngx_http_variable_value_t, but the array contains structures, not pointers. Additionally, ctx->var_values inspection failed to properly set var on match.
2012-08-08Added three missing checks for NULL after ngx_array_push() calls.Valentin Bartenev3-0/+10
Found by Coverity.
2012-07-31Version bump.Ruslan Ermilov1-1/+1
2012-07-24Fixed compilation with -Wmissing-prototypes.Ruslan Ermilov2-2/+2
generated by cgit (git 2.34.1) at 2025-12-30 08:56:23 +0000