Mailing List Archive

> But we're still not quite ready w.r.t online info and documentation.
>
> I just created http://www.apache.org/apache/info.html out
> of http://www.apache.org/apache/index.html
>
> We need a new index.html, one which looks good and has pointers
> to /apache/info.html and /apache/docs/

Working on it as you type....

> It's fine to let the general public find some bugs for a change, once
> we've taken our own best shot. However, a lot of the code in 0.5.1 and
> especially 0.6.1 is still not tested on most of our beta sites, particularly
> most of the big ones, and I really don't feel terribly comfortable releasing
> the thing until we've shown enough confidence in it to be using it ourselves.

I can't put 0.6.1 on Cardiff. I don't have enough permissions to do it.
The sys-admin there is just too busy with other things to install 0.6.1
at the moment - it's not lack of confidence - he put the non-forking
patch in on the basis that it can stay in as long as it doesn't break
anything.

I've also given 0.6.1 to a couple of people to use instead of NCSA 1.3.
They haven't come back with any reports of problems.


But we're still not quite ready w.r.t online info and documentation.

I just created http://www.apache.org/apache/info.html out
of http://www.apache.org/apache/index.html

We need a new index.html, one which looks good and has pointers
to /apache/info.html and /apache/docs/


robh

It's fine to let the general public find some bugs for a change, once
we've taken our own best shot. However, a lot of the code in 0.5.1 and
especially 0.6.1 is still not tested on most of our beta sites, particularly
most of the big ones, and I really don't feel terribly comfortable releasing
the thing until we've shown enough confidence in it to be using it ourselves.
(Even if the changes since whenever are mostly bugfixes, those can still
cause trouble --- witness B57).

So my proposal is that we get 0.6.1 up on our major sites, or at least a
few *more* of them, wait a while to see if problems emerge, and release it
to the public if they don't. It's not that I'm expecting any --- but why
take the chance?

rst

>You've all gone quiet.

Well, I haven't received any mail for a day or so. I think some machine must
have eaten it whilst our network was broken.

Current bugs that I can think of (in no particular order):
* handling of bad URLs:
does not fault requests like /../xxx
does not fault requests for filenames (not paths) containing '/' or '\0'

* handling of 'different' URLs which break relative links:
does not fault or redirect /file.html/
does redirect a request for "" - should either fault or not redirect
silently ignores null path segments; should fault or redirect; e.g.
/dir//file.html

* server-side include bugs:
security leak when a protected doc includes another protected doc in a
different realm
sets (and logs?) the REMOTE_USER when including or execing a non-protected
doc from a protected one.

* miscellaneous
strange error messages; 'no multi in directory' instead of 'file not found'?

These are mostly minor. I'm sure there are plenty of others.

David.