2015-03-11 0.9.35 * Geert Jan de Groot reported a possible segfault if CONTENT_TYPE is not specified. This bug was introduced in 0.9.33 2015-02-15 0.9.34 * Fixes for Lua 5.3 compatibility * Move sys/fnctl.h to fnctl.h * Victor Cook sent in a patch to rfc2388.c - "In rfc2388.c rfc2388_handler() during processing of the header information, if a buffer read falls on the point where the next character is crlf it results in the header reading to be terminated early. When the error occurs the results are unpredictable and depend on what is then incorrectly interpreted. The chance of a failure depends on the length and complexity of the header data, but can become very significant." 2014-06-07 0.9.33 * Fix various security vulnerabilities - most serious is a Heap Overflow Vulnerability in sliding_buffer.c Reported by Stephen Röttger * Allow PUT and DELETE method (But prefix is still POST/GET) * On POST/PUT, Content-Type is not x-www-urlencoded, then the body of the message is stored verbatim in POST_body= 2013-20-09 0.9.32 * Regression causing Lua always to be linked, never used 2013-15-09 0.9.31 * Modernize configure.ac * more Lua 5.2 fixes 2013-27-06 0.9.30 * The Mayhem Team of CMU found an undisclosed segfault when the first command-line argument is '' or "" (null-quoted string). Chow Loong Jin supplied a patch. * Natanael Copa supplied a patch to rename the deprecated string.gfind in haserl_lualib.lua. Lua 5.2 is now supported. 2011-05-09 0.9.29 * Jan Rome reported an off-by one error in handling array input (formvar[]) * Chow Loong Jin reported multiple header files with no copyright information This is part of the process to get haserl into Ubuntu. * Chow Loong Jin noticed haserl_lua.inc is no longer necessary in the tarball (sf id 3298883) * Oliver Metz noted that haserl aborted on SIGPIPE from a custom upload handler. Haserl now ignores the signal. (Example: uploading to a 'tar xvf' handler) text data bss dec hex filename 19637 836 176 20649 50a9 src/haserl 2011-03-25 0.9.28 * Lua script did not have variables in the correct tables (Mixure for FORM. and POST_, GET_ They should now be in the correct table format * Natanael Copa provided patches to compile lua2c if necessary * Chow Loong Jin proposes using printf '%s' instead of echo -n; no reason not to. text data bss dec hex filename 28598 948 176 29722 741a src/haserl 2010-10-17 0.9.27 * Daniel Griscom reported clarification on RFC 2616 compliance Ralph Siemsen provided the actual man-page update * Natanael Copa fixed the Makefile.am for gnu make 3.82+ * Cleanup temp files on error (Anonymous) SF bug tracker id 2991410 * Pavel Chromy reported a vulnerability where the name of a the tempfile on a file upload could be modified by the client * man page updates text data bss dec hex filename 19343 828 172 20343 4f77 src/haserl 2009-07-30 0.9.26 * Peter Korsgaard found a buffer overflow error in handling array variables from the client. * Changed buffer_init function to haserl_buffer_init to work around a nasty problem when using luasocket. http://lua-users.org/lists/lua-l/2008-08/msg00446.html text data bss dec hex filename 18873 820 172 19865 4d99 src/haserl 2008-12-16 0.9.25 * Somehow version control failed, and the -d debug short option reverted to -D again. fixed. * haserl.c - "command-line" handling was broken on OSX and BSD fixed. (Mark Blythe) * haserl.c - fix bug where CONTENT_LENGTH=0 would hang haserl (bug tracker bug #1959379) text data bss dec hex filename 18949 820 172 19941 4de5 haserl 2008-04-14 0.9.24 * haserl.c - myputenv caused a segfault when a variable without an = (assignment) was passed. (Scott) * doc/haserl.1 - Misc typos fixed (Scott) * scott's bash-extensions are included if configured with --enable-bash-extensions * running haserl with no args now tells you if lua or the bash extensions are enabled. * configure.ac - FORM_ now hardcoded * tests/* - beginnings of unit tests (make check) * haserl.c - varibles now stored as FORM_ + GET_, POST_, COOKIE_ (scott) - WIP - need to clean up the putenv so that only one copy is saved in the host, and the child gets all the duplicates text data bss dec hex filename 18519 824 172 19515 4c3b src/haserl 2008-03-22 0.9.23 * haserl.c - short option for debug id -d (was incorrectly -D) * haserl.c - remove use of legacy "index" clib function. * haserl.c - myputenv makes a newline delimited "array" out of variables that end in []. (php-style for multi-selects) Lua variables will have same behavior - they are not treated as true arrays yet. (WIP - need to handle the env variables as abstracts until subshell startup for this to work) text data bss dec hex filename 18237 820 128 19185 4af1 src/haserl 2008-01-28 0.9.22 * h_bash.c - close the input side of the pipe, so that if the child dies early the parent doesn't deadlock (patch by Diego Santa Cruz) * rfc2388.c, sliding_buffer.c, haserl.c - read CONTENT_LENGTH, and stop reading input when CONTENT_LENGTH reached (fixes odd problems where the client may not close the connection properly at the end of a request [guess which clients are MiStaken?]) (patch by Diego Santa Cruz) * Allow "-" to be used in a field identifier (e.g. FORM["-foo"]) text data bss dec hex filename 17813 812 128 18753 4941 src/haserl 2007-11-22 0.9.21 * haserl.c - fixed a stupid test for strlen that caused CGI post requests to take exponentially longer amounts of time based on the size of the upload * h_bash.c - removed open_bash function; found that a CGI post of > ~150K will cause bash to fail on the subshell. This appears to be a limitation of execv, not haserl. AFAICT * h_script.c - Fixed stupid error where the leading html was dropped if a comment tag was used. * Update TODO list text data bss dec hex filename 17425 808 128 18361 47b9 src/haserl 2007-09-22 0.9.20 * h_script.c - Added Comment tag (<%#) * various - Removed syslog calls text data bss dec hex filename 17425 808 128 18361 47b9 src/haserl 2007-09-16 0.9.19 * haserl.c - If CONTENT_LENGTH not set, don't try to read POST data (caused haserl to hang on --accept-all) * configure.ac - Don't require dl on BSD/OSX (N Copa) * h_script.c - Don't switch <% %> in include files. Check only on the original script (Hinko Kocevar) * Workaround for cross-compiling haserl_lualib.inc (reported by Andreas Schultz) * haserl.* - add extern definitions to shell function pointers so uClinux (gcc 3.2.3) can compile haserl (glhs329 at gmail) text data bss dec hex filename 17584 784 128 18496 4840 src/haserl 2007-07-23 0.9.18 * h_script.c, lua2c.c - Fixed two typos that prevented compilation. * configure.ac patch to compile with pkg-config, if found (ubuntu calls it lua51, not lua) - submitted by Natanael Copa 2007-07-22 0.9.17 * h_bash.c - rc3 commented out the signal call, so an would cause the script to hang. * h_bash.c - don't wait for the echo statement to signal end of script. Do a waitpid instead. This means fd 5 is now not used. * *lua.* - precompiled lua support, with reorganization of all lua source code (Robin Haberkorn) * configure.ac / makefile.am - Ability to turn off shell/lua/luac (Robin Haberkorn) * lua2c.c - simple luac + bin2c replacement. * h_script.c / h_error.c - Use <% as the prefered tag element use foo.1.var = foo[1].var, not foo["1"].var 2006-09-12 0.9.11 * a bash shell cannot be opened until AFTER all the environment variables are placed in the environ. Now have a "pre_open..." set of functions to handle the difference between lua and shell 2006-09-09 0.9.10_rc2 * Special linking options so that lua "require" will work when linking c libraries * remove stuff is now possible. 2005-11-21 0.9.4 version * haserldb.c - sort, rsort, merge and split functions * haserl.c - fix off-by-one error on include files (included files were incorrectly truncated) * silently rejects argv beyond argv[2] http://192.168.0.1/test.cgi?--upload-limit%3d2059&foo%3dbar should not not reset the upload limit. This duplicates 0.8.0 behaviour, broke in 0.9.3 * haserl.c --silent option (don't print errors advertizing we are haserl) * haserldb.c - realloc might not allocate enough space for the new token in getCommandString - fixed 2005-11-04 0.9.3 version * haserl.c - command-line parsing now uses optarg - "haserl foo.txt" now works; new command-line options supported. * haserl.c new command-line options (upload-limit, verbatim, etc) * haserl.c - found some memory-overwrite errors in loadscript (man valgrind) * haserl.c - token parsing routine (BuildTokenList) refactored. * HASERL_* vars are now populated from above command-line options. * haserl.c - --accept-all functionalitiy added * haserl.c - command now causes non-zero return code * haserl.c - function added * haserl.1 - man page updated 2005-10-29 0.9.2 version * extras dirs contains a example login system - login.cgi, index.cgi, loginlib.sh, haserldb-howto.txt * haserldb.c - RAM-db is now live throughout a run, so the RAM-db is now extra storage through run of system * Some language keyword changes to make the language a little more orthogonal - repl->sub, clear->empty 2005-10-25 0.9.1 version (not released) * common.c - Improved parsing - now handles empty strings and arbitrary comment delimiters correctly. This improved haserldb's command parsing considerably. * haserldb.c - New functions: ifstack ifempty if 2005-10-23 0.9.0 version * added haserldb (common.* lists.* sha256.* haserldb.*) * An example of using haserldb is in the extras directory: (haserldb-howto.txt, loginlib.sh, login.cgi) 2005-03-22 0.8.0 version * configure.ac - Remove check for malloc, as it fails building with uclibc * No other changes, upgraded the version number to a "stable" release because no real problems have been reported with this code. 2004-12-14 0.7.3 version * configure.ac / configure - include signal.h define in config.h to compile properly with gcc 2.95.3 * extras/* - tutorial removed; buttons and a few examples moved here * doc/haserl.1 - a real manual page 2004-11-10 0.7.2 version * haserl.c - misc fixes from Eric Titl to compile with gcc 2.95.3 and glibc 2.0.7 (include SIGNAL_H for sigchild; move variable declaration to top of function in ReadMimeEncodedInput) 2004-11-02 0.7.1 version No change from 0.7.0 - version # incremented because of a sourceforge upload fault. 0.7.0 version * haserl.c - The interpreter now starts a single subshell, and all commands are run from that shell. State is now preserved between code blocks. (Thanks to Arne Bernin for suggestions on getting this working.) * haserl.c - a "u" must be on the command line (#!/usr/bin/haserl -u) to allow file uploads. (Security feature - prevent malicious clients from uploading abitrary data to /tmp) * haserl.c - attempt to set uid/gid to the owner/group of the script. * tutorial/*.in - fix the tutorial to reflect changes above 2004-10-25 0.6.0 version * haserl.c - HASERL_VAR_PREFIX (config.h) prefixed to all user supplied strings. This is to prevent the client from easily polluting global namespace, such as "foo?SCRIPT_NAME=/blah.txt" 2004-10-06 0.5.1 version * haserl.c -