1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
|
<TITLE>CGIWrap - Change Log</TITLE>
<CENTER><H2>CGIWrap - Change Log</H2></CENTER>
These are some of the changes that have occured in CGIwrap from version
to version.
<HR>
<P><H3>New in version 3.5:</H3><UL>
<LI>Fixed strerror checking in Configure script and util.c for systems
without strerror, can now use strerror, sys_errlist, perror, or just errno.
<LI>Major documentation overhaul, create all HTML based docs
<LI>Added option (defaulting to yes) to correctly set the
PATH_TRANSLATED environment variable.
<LI>Fixed bug with the configure script and the use_system
option. It would cause a preprocessor error if the system call was not
found.
<LI>Cleaned up various things with the Configure script
<LI>Changed file prompting to allow using ~ paths.
</UL><P><H3>New in version 3.4:</H3><UL>
<LI>Fixed typo "&" instead of "&&" in setgroups stuff
<LI>Added cgiwrap.aliases option to rewrite home dirs of users.
<LI>Moved entire cgiwrap source build tree to CVS, will make
tracking changes easier.
<LI>CGIwrap now changes directories to the directory the script is located in before executing the script. Before, it always just changed
to the main CGI directory. This behavior is only different if you
were using scripts in subdirectories.
<LI>Changed style of cgiwrap.allow, cgiwrap.deny files to be the same as
cron's allow/deny files.
</UL><P><H3>New in version 3.3:</H3><UL>
<LI>Added support for attaching a label to syslog log messages.
<LI>Added code to rewrite the PATH_TRANSLATED environment variable.
</UL><P><H3>New in version 3.24:</H3><UL>
<LI>Added support for logging to syslog.
</UL><P><H3>New in version 3.23:</H3><UL>
<LI>Setgroups was being used no matter what you said in configure - fixed
<LI>Problem with undefined variables in Log call for subdirectories - fixed
<LI>Removed declaration of sys_errlist, and errno in util.c, since I don't
think they were necessary. And they were causing problems on some
architectures.
<LI>Added in user contributed host address checking code
<LI>Upgraded to using dist-3.0 PL60 for building the Configure script.
<LI>Separated initgroups() and setgroups() checks into two separate
defines, and improved documentation in configure script for these options.
</UL><P><H3>New in version 3.22:</H3><UL>
<LI>argv[0] is now automatically changed to the name of the script that is
being executed
</UL><P><H3>New in version 3.21:</H3><UL>
<LI>Rlimit defines weren't set properly when rlimit not available - fixed
<LI>The optimizer/debugger flag wasn't being used in the makefile -- fixed
<LI>Defaults for checks (y/n) were not being set - fixed
</UL><P><H3>New in version 3.2:</H3><UL>
<LI>MAJOR code cleanup and simplification. The code should be ALOT
easier to read and understand.
<LI>Fixed the problem in the Makefile on certain architectures with the
$(var) not being escaped properly. This should solve problems with Linux
machines and BSD machines that I know of.
<LI>Changes way PATH_INFO is modified, CGIwrap will now correct SCRIPT_NAME
for ?user=USER&script=SCRIPT type requests as well as /user/script type
requests.
<LI>Subdirectories are now supported for both types of requests
<LI>Debugging output has been condensed and is a little easier to read.
<LI>Documentation has been reworked, it should be a little easier to use.
<LI>Fixed prototypes for all the functions in the cgiwrap source.
<LI>Removed a few unnecessary routines
<LI>Changed "mystrcpy" to be "strdup", and is compiled only if the current
architecture does not have strdup available in it's standard library.
</UL><P><H3>New in version 3.11:</H3><UL>
<LI>Fixed incorrectly indented # directives that were causing problems with
some machines.
</UL><P><H3>New in version 3.1:</H3><UL>
<LI>Added CONF_ALLOWFILE and CONF_DENYFILE options.
<LI>Added logging of REMOTE_USER and a status message to the log file
<LI>Added an unsupported directory for user contributed scripts and add-ons
<LI>Restructured logic for which 'set' method gets used.
<LI>Removed option to not check if gid changed, it was an oversight that
this was left in. There isn't any case I know of that you wouldn't want
to check this.
<LI>Moved id setting routines into util.c
<LI>Added new source file for allow/deny code.
<LI>Removed some error output that didn't make sense (system error
messages that were getting returned when I issued a regular cgiwrap error)
<LI>Added a 'remake' target to the makefile which does a clean, then a
Configure -S, then a make all to rebuild he entire binary. This is useful
if you have multiple config.sh files (eg. you're building for several
setups from the same dir)
</UL><P><H3>New in version 3.0:</H3><UL>
<LI>Set up Configure scripts for CGIwrap
<LI>Renamed many of the config options to make more consistent
<LI>Rearranged directory structure of CGIwrap distribution
<LI>Removed "CONF_SANITIZE" option, it is always on now.
<LI>Removed "CONF_CHECK_UID" option, it is always on now.
<LI>Removed "CONF_FORCE_DEBUG" option, and "CONF_DEBUG_BY_NAME" option,
cgiwrap automatically does debugging output by name now.
<LI>Added info about setting up an access-controlled cgiwrap which allows
users to control access to their scripts.
<LI>Renamed DEBUG to CONF_DEBUG to solve a compile problem with some systems
wanting to add -DDEBUG to CFLAGS.
</UL><P><H3>New in version 2.7:</H3><UL>
<LI>Added HTTPD_USER and CHECK_HTTPD_USER to verify that cgiwrap is being
called by the server. This is for (access to scripts) security, it
doesn't affect system security any.
<LI>Added AFS PAG support
</UL><P><H3>New in version 2.6:</H3><UL>
<LI>Moved rlimit call into new subroutine SetLimits
<LI>Changed exec call to an execv and passed argv to support argument passing
This will only work correctly for scripts called with no other
arguments... Eg, must use "cgiwrap/user/script?" syntax
</UL><P><H3>New in version 2.5:</H3><UL>
<LI>Fixed problem with not correctly falling back from PATH_INFO
<LI>Added SETUID_SETEUID option for setting UID's
<LI>Added checks to make sure effective ugid changed as well as real.
</UL><P><H3>New in version 2.4:</H3><UL>
<LI>Fixed incorrect exec call, added null at end.
</UL><P><H3>New in versoin 2.3:</H3><UL>
<LI>Fixed location of setgroups() call
<LI>Added INSTALL file and fixed PROMO that was old.
</UL><P><H3>New in version 2.2:</H3><UL>
<LI>More debug outpt for environment variables
<LI>Option to check exec bit on script and error msg if not set
</UL><P><H3>New in version 2.1:</H3><UL>
<LI>Fixed ~ bug
<LI>Added PATH_INFO and SCRIPT_NAME rewrite code
<LI>Added SETGROUPS option to config
<LI>Added RLIMIT option to config
</UL><P><H3>New in version 2.0:</H3><UL>
<LI>Added support for PATH_INFO specification of user/script
<LI>Added stderr redirection to stdout
<LI>Added option for doing debugging output by cmd name
<LI>Added option to use exec or system calls
</UL><P><H3>New in version 1.0:</H3><UL>
<LI>Everything! This is the first public distribution.
</UL>
|
