CVS log for libwww/Library/src/HTAABrow.c

Up to [Public] / libwww / Library / src

Request diff between arbitrary revisions

Keyword substitution: kv
Default branch: MAIN

JK: strcasecmp isn't portable.

JK: The generation of a Digest Authentication answer didn't work
if the server sent a QoP with two options. Made auth the only option
we can handle.

JK: Two bug fixes concerning digest authentication and pipelined requests.
See the changelog for a detailed descr.

JK: Aligning with libwwwv3.0.0

JK: when using digest authentication, we were freeing a static allocated
string.

JK: Changed the size of the output buffer of HTUU_encode, as recommended
by Heiner Kallweit.

JK: If a digest password changed, we had a sigsev.

JK: Added two memory leaks submitted by Andy Levine (I slightly modified one).
Using the request-uri instead of the absolute-uri for computing the message
digest, as it was a (my) bad interpretation of the spec.

NEW TRACE MESSAGES - see http://lists.w3.org/Archives/Public/www-lib/1999JanMar/0267.html for details

JK: fixed some bugs. Added support for multi-authentication schemes in
the same server, even if they use the same realm.

unwrapped trace messages

Avoided a loop if in non-interactive mode and had to ask for credentials for authentication

* Modified the authentication module interface so that it's possible to use a
  filter for authentication information. This removed the dependency problems
  we had with the Windows DLLs

Note that the API for HTAA_newModule changed to allow registering the filter
for the authentication information. If you were previously
 using the library's initialization functions (e.g., HTAAInit), the change will
be transparent for you. Otherwise, you'll have to take into account the new
interface:

==============
PUBLIC HTAAModule * HTAA_newModule (const char *        scheme,
                                    HTNetBefore *       before,
                                    HTNetAfter *        after,
                                    HTNetAfter *        update,
                                    HTUTree_gc *        gc)
==============

If you don't have a filter for the authentication information, just use the NULL
parameter. You may look at HTInit.c:HTAAInit() to see how it is done.

-Jose Kahan

Changed the use of strcasecmp which is an OD specific function to strcasecomp which is provided by libwww

Jose Kahan: message digest authentication

JK: Fix to the multiple authentication problem.
I added a new AARetry element to the req structure and some logic to
make it smarter.

Changed the auth module so that nodes are deleted if the user cancels entering username/password. This avoids a problem where the user can be asked for credentials with no realm attached

Fixed problem in the template generation in the access authentication module. This can cause the authentication module to keep asking for credentials.

version 5.1c

libvwww 5.0a

Persistent Cache

updates from test against CL server

Fix in proxy authentication and local file name conversion on Windows

Ajustments because of compiler errors

Henrik: chunked PUT and proxy authentication

Recovery from a weird crash in Library and LineMode volumes

a lot of new things

 Basic AA bug

a first version of PEP

4.1b2

new transport and Content Coding support

Autoconf

new AA

Substituted HTTrace for TTYPrint. -egp
Invented HTView for LineMode. -egp
Windows LineMode has dialogs. -egp

post HT_Mem

merge between main branch and 4.0 branch

4.0C

DLL version ready

Merged Error and Dialog system

Better interface for DLL

fprintf replaced with TTYPrint for windows

TRACE changed to WWWTRACE)

Most of new version

Changes to HTAlert and context swapping

Most of 3.1pre3

most of 3.1pre2

final swap to MIT statements

Official version

Getting Library back on main branch

Library version 3.0beta

Now uses GNU Autoconf

New COPYRIGHT HEADERS and BETTER multi :-)

MULTI-THREADED VERSION

It now compilen using g++

Bug fixed in HTWAIS, Host cache and AA

no more tmpnam(); Introduced HTFormat_delete(); Mem-fix in AA; no more printf()

Fixed AA, Welcome pages, and some minor fixes.

Took daemon-specific stuff away from HTRequest structure.

- moved daemon-access-authorization files to daemon
- fixed directory indexing with trailing slash
- access authorization now works through firewalls
- Users and Anybody now special predifined group names
- multilanguage/encoding handling -- intelligent algorithm still
  missing
- so suffixes now handle also encoding/language
- content-length, last-modified

First version having AA using HTRequest structure.  This seems to work
pretty well with server, but I've been unable to test it with linemode
which doesn't compile currently, so prepare yourself for client
coredumps. :-(  It may also be that AA just simply doesn't let you know
about itself at all -- so it may also appear to be dead instead of
killing the whole client.  Now I'm going home to get some sleep --
staying up 34 hours is starting to get to me.

Added Content-Type wildcard matching to HTAtom.c.
Added Search rule (?? or was it already in the previous version...??).

Added some minor bug fixes and stuff suggested by marca:
	* added a new function HTPromptUsernameAndPassword()
	  so that GUI clients can have just a single authentication
	  dialog box
	* nobody and nogroup are looked up by name (no longer
	  hardcoded values)
	* understands also negative uid/gid values
	* added /../ check also in the AA package
	* AA now takes place only if accessing a local file (otherwise
	  what the daemon does when running as a gateway is funny...)
	* broken fail rule hanling by AA fixed
	* some ""s to NULLs and other minor things

Fixed security hole in HTAABrow.c (now realm names or server-ids or
whatever you want to call them are only machine-wide, and other
servers cannot fool browsers to give their passwords by giving a fake
server-id).

Changed NULLs to (char)0's :-(.

Fixed the mixup with HTAA_Arg <--> HTAssocList.

Added first version of access authorization in.