nginx-0.3.8-RELEASE import
*) Security: nginx now checks URI got from a backend in
"X-Accel-Redirect" header line or in SSI file for the "/../" paths
and zeroes.
*) Change: nginx now does not treat the empty user name in the
"Authorization" header line as valid one.
*) Feature: the "ssl_session_timeout" directives of the
ngx_http_ssl_module and ngx_imap_ssl_module.
*) Feature: the "auth_http_header" directive of the
ngx_imap_auth_http_module.
*) Feature: the "add_header" directive.
*) Feature: the ngx_http_realip_module.
*) Feature: the new variables to use in the "log_format" directive:
$bytes_sent, $apache_bytes_sent, $status, $time_gmt, $uri,
$request_time, $request_length, $upstream_status,
$upstream_response_time, $gzip_ratio, $uid_got, $uid_set,
$connection, $pipe, and $msec. The parameters in the "%name" form
will be canceled soon.
*) Change: now the false variable values in the "if" directive are the
empty string "" and string starting with "0".
*) Bugfix: while using proxied or FastCGI-server nginx may leave
connections and temporary files with client requests in open state.
*) Bugfix: the worker processes did not flush the buffered logs on
graceful exit.
*) Bugfix: if the request URI was changes by the "rewrite" directive
and the request was proxied in location given by regular expression,
then the incorrect request was transferred to backend; the bug had
appeared in 0.2.6.
*) Bugfix: the "expires" directive did not remove the previous
"Expires" header.
*) Bugfix: nginx may stop to accept requests if the "rtsig" method and
several worker processes were used.
*) Bugfix: the "\"" and "\'" escape symbols were incorrectly handled in
SSI commands.
*) Bugfix: if the response was ended just after the SSI command and
gzipping was used, then the response did not transferred complete or
did not transferred at all.
diff --git a/docs/xml/change_log_conf.xml b/docs/xml/change_log_conf.xml
index 4abb779..f97ef04 100644
--- a/docs/xml/change_log_conf.xml
+++ b/docs/xml/change_log_conf.xml
@@ -15,6 +15,7 @@
<bugfix>éÓÐÒÁ×ÌÅÎÉÅ</bugfix>
<feature>äÏÂÁ×ÌÅÎÉÅ</feature>
<change>éÚÍÅÎÅÎÉÅ</change>
+ <security>âÅÚÏÐÁÓÎÏÓÔØ</security>
<workaround>éÚÍÅÎÅÎÉÅ</workaround>
</changes>
@@ -25,6 +26,7 @@
<bugfix>Bugfix</bugfix>
<feature>Feature</feature>
<change>Change</change>
+ <security>Security</security>
<workaround>Workaround</workaround>
<month> Jan </month>
diff --git a/docs/xml/nginx/changes.xml b/docs/xml/nginx/changes.xml
index 3b1aa10..dfac2a0 100644
--- a/docs/xml/nginx/changes.xml
+++ b/docs/xml/nginx/changes.xml
@@ -9,6 +9,181 @@
<title lang="en">nginx changelog</title>
+<changes ver="0.3.8" date="09.11.2005">
+
+<change type="security">
+<para lang="ru">
+nginx ÔÅÐÅÒØ ÐÒÏ×ÅÒÑÔ URI, ÐÏÌÕÞÅÎÎÙÅ ÏÔ ÂÜËÅÎÄÁ × ÓÔÒÏËÅ "X-Accel-Redirect"
+× ÚÁÇÏÌÏ×ËÅ ÏÔ×ÅÔÁ, ÉÌÉ × SSI ÆÁÊÌÅ ÎÁ ÎÁÌÉÞÉÅ ÐÕÔÅÊ "/../" É ÎÕÌÅÊ.
+</para>
+<para lang="en">
+nginx now checks URI got from a backend in "X-Accel-Redirect" header line
+or in SSI file for the "/../" paths and zeroes.
+</para>
+</change>
+
+<change type="change">
+<para lang="ru">
+nginx ÔÅÐÅÒØ ÎÅ ×ÏÓÐÒÉÎÉÍÁÅÔ ÐÕÓÔÏÅ ÉÍÑ ËÁË ÐÒÁ×ÉÌØÎÏÅ
+× ÓÔÒÏËÅ "Authorization" × ÚÁÇÏÌÏ×ËÅ ÚÁÐÒÏÓÁ.
+</para>
+<para lang="en">
+nginx now does not treat the empty user name in the "Authorization" header
+line as valid one.
+</para>
+</change>
+
+<change type="feature">
+<para lang="ru">
+ÄÉÒÅËÔÉ×Á ssl_session_timeout ÍÏÄÕÌÅÊ
+ngx_http_ssl_module É ngx_imap_ssl_module.
+</para>
+<para lang="en">
+the "ssl_session_timeout" directives
+of the ngx_http_ssl_module and ngx_imap_ssl_module.
+</para>
+</change>
+
+<change type="feature">
+<para lang="ru">
+ÄÉÒÅËÔÉ×Á auth_http_header ÍÏÄÕÌÑ ngx_imap_auth_http_module.
+</para>
+<para lang="en">
+the "auth_http_header" directive of the ngx_imap_auth_http_module.
+</para>
+</change>
+
+<change type="feature">
+<para lang="ru">
+ÄÉÒÅËÔÉ×Á add_header.
+</para>
+<para lang="en">
+the "add_header" directive.
+</para>
+</change>
+
+<change type="feature">
+<para lang="ru">
+ÍÏÄÕÌØ ngx_http_realip_module.
+</para>
+<para lang="en">
+the ngx_http_realip_module.
+directives.
+</para>
+</change>
+
+<change type="feature">
+<para lang="ru">
+ÎÏ×ÙÅ ÐÅÒÅÍÅÎÎÙÅ ÄÌÑ ÉÓÐÏÌØÚÏ×ÁÎÉÑ × ÄÉÒÅËÔÉ×Å log_format:
+$bytes_sent, $apache_bytes_sent, $status, $time_gmt,
+$uri, $request_time, $request_length,
+$upstream_status, $upstream_response_time,
+$gzip_ratio,
+$uid_got, $uid_set,
+$connection, $pipe É $msec.
+ðÁÒÁÍÅÔÒÙ × ×ÉÄÅ "%name" ÓËÏÒÏ ÂÕÄÕÔ ÕÐÒÁÚÄÎÅÎÙ.
+</para>
+<para lang="en">
+the new variables to use in the "log_format" directive:
+$bytes_sent, $apache_bytes_sent, $status, $time_gmt,
+$uri, $request_time, $request_length,
+$upstream_status, $upstream_response_time,
+$gzip_ratio,
+$uid_got, $uid_set,
+$connection, $pipe, and $msec.
+The parameters in the "%name" form will be canceled soon.
+</para>
+</change>
+
+<change type="change">
+<para lang="ru">
+× ÄÉÒÅËÔÉ×Å "if" ÌÏÖÎÙÍÉ ÚÎÁÞÅÎÉÑÍÉ ÐÅÒÅÍÅÎÎÙÈ ÔÅÐÅÒØ Ñ×ÌÑÀÔÓÑ
+ÐÕÓÔÁÑ ÓÔÒÏËÁ "" É ÓÔÒÏËÉ, ÎÁÞÉÎÁÀÝÉÅÓÑ ÎÁ "0".
+</para>
+<para lang="en">
+now the false variable values in the "if" directive are the empty string ""
+and string starting with "0".
+</para>
+</change>
+
+<change type="bugfix">
+<para lang="ru">
+ÐÒÉ ÒÁÂÏÔÁÅÔ Ó ÐÒÏËÓÉÒÏ×ÁÎÎÙÍÉ ÉÌÉ FastCGI-ÓÅÒ×ÅÒÁÍÉ nginx ÍÏÇ ÏÓÔÁ×ÌÑÔØ
+ÏÔËÒÙÔÙÍÉ ÓÏÅÄÉÎÅÎÉÑ É ×ÒÅÍÅÎÎÙÅ ÆÁÊÌÙ Ó ÚÁÐÒÏÓÁÍÉ ËÌÉÅÎÔÏ×.
+</para>
+<para lang="en">
+while using proxied or FastCGI-server nginx may leave connections
+and temporary files with client requests in open state.
+</para>
+</change>
+
+<change type="bugfix">
+<para lang="ru">
+ÒÁÂÏÞÉÅ ÐÒÏÃÅÓÓÙ ÎÅ ÓÂÒÁÓÙ×ÁÌ ÂÕÆÅÒÉÚÉÒÏ×ÁÎÎÙÅ ÌÏÇÉ ÐÒÉ ÐÌÁ×ÎÏÍ ×ÙÈÏÄÅ.
+</para>
+<para lang="en">
+the worker processes did not flush the buffered logs on graceful exit.
+</para>
+</change>
+
+<change type="bugfix">
+<para lang="ru">
+ÅÓÌÉ URI ÚÁÐÒÏÓÁ ÉÚÍÅÎÑÌÏÓØ Ó ÐÏÍÏÝØÀ rewrite, Á ÚÁÔÅÍ ÚÁÐÒÏÓ ÐÒÏËÓÉÒÏ×ÁÌÓÑ
+× location, ÚÁÄÁÎÎÏÍ ÒÅÇÕÌÑÒÎÙÍ ×ÙÒÁÖÅÎÉÅÍ, ÔÏ ÂÜËÅÎÄÕ ÐÅÒÅÄÁ×ÁÌÓÑ
+ÎÅ×ÅÒÎÙÊ ÚÁÐÒÏÓ;
+ÏÛÉÂËÁ ÐÏÑ×ÉÌÁÓØ × 0.2.6.
+</para>
+<para lang="en">
+if the request URI was changes by the "rewrite" directive and the request
+was proxied in location given by regular expression, then the incorrect
+request was transferred to backend;
+bug appeared in 0.2.6.
+</para>
+</change>
+
+<change type="bugfix">
+<para lang="ru">
+ÄÉÒÅËÔÉ×Á expires ÎÅ ÕÄÁÌÑÌÁ ÕÖÅ ÕÓÔÁÎÏ×ÌÅÎÎÕÀ ÓÔÒÏËÕ ÚÁÇÏÌÏ×ËÁ "Expires".
+</para>
+<para lang="en">
+the "expires" directive did not remove the previous "Expires" header.
+</para>
+</change>
+
+<change type="bugfix">
+<para lang="ru">
+ÐÒÉ ÉÓÐÏÌØÚÏ×ÁÎÉÉ ÍÅÔÏÄÁ rtsig É ÎÅÓËÏÌØËÉÈ ÒÁÂÏÞÉÈ ÐÒÏÃÅÓÓÁÈ nginx
+ÍÏÇ ÐÅÒÅÓÔÁÔØ ÐÒÉÎÉÍÁÔØ ÚÁÐÒÏÓÙ.
+</para>
+<para lang="en">
+nginx may stop to accept requests if the "rtsig" method and several worker
+processes were used.
+</para>
+</change>
+
+<change type="bugfix">
+<para lang="ru">
+× SSI ËÏÍÁÎÄÁÈ ÎÅ×ÅÒÎÏ ÏÂÒÁÂÁÔÙ×ÁÌÉÓØ ÓÔÒÏËÉ "\"" É "\'".
+</para>
+<para lang="en">
+the "\"" and "\'" escape symbols were incorrectly handled in SSI commands.
+</para>
+</change>
+
+<change type="bugfix">
+<para lang="ru">
+ÅÓÌÉ ÏÔ×ÅÔ ÚÁËÁÎÞÉ×ÁÌÓÑ ÓÒÁÚÕ ÖÅ ÐÏÓÌÅ SSI ËÏÍÁÎÄÙ, ÔÏ ÐÒÉ ÉÓÐÏÌØÚÏ×ÁÎÉÉ
+ÓÖÁÔÉÑ ÏÔ×ÅÔ ÐÅÒÅÄÁ×ÁÌÓÑ ÎÅ ÄÏ ËÏÎÃÁ ÉÌÉ ÎÅ ÐÅÒÅÄÁ×ÁÌÓÑ ×ÏÏÂÝÅ.
+</para>
+<para lang="en">
+if the response was ended just after the SSI command and gzipping was used,
+then the response did not transferred complete or did not transferred at all.
+</para>
+</change>
+
+</changes>
+
+
<changes ver="0.3.7" date="27.10.2005">
<change type="feature">
