lighty labs

2019-04-09

18:50 Lighttpd Bug #2945: Security - SIGABRT during GET request handling with url-path-2f-decode enabled

Nice catch. Simple reproducer:...

2019-03-12

19:39 Lighttpd Feature #2847: handling permissions at startup

Fixed in upstream long time ago; nothing to see here.

2019-02-16

10:26 Lighttpd Revision 92321450: [core] poll: fdarray uses fd as index, not fde_ndx

09:52 Lighttpd Revision 1bd1d559: [core] don't call fd event handlers more than once, they might already be gone (fixes segfault)

2019-01-13

20:26 Lighttpd Revision 9b7a32ea: [doc/conf] resolve some mime type conflicts from debian buster, regenerate mime.conf

2018-09-08

21:12 Lighttpd2 Revision bda1a90f: [core] add strict.post_content_length option

Change-Id: Ie9d67eceed7e957b667554925d562018a3217209

2018-09-07

05:21 Lighttpd Support: RE: HTTP referer validation

Some (browser) privacy extensions disable the @Referer@ header completely, not just for foreign domains, so please do...

2018-08-26

16:52 Lighttpd Revision e0260a41: [buffer] fix duplicate assert and comment

this originates from ad3e93ea9 for no apparent reason

16:52 Lighttpd Revision 3be07078: [core] replace folding whitespace with a single space

- previously the leading whitespace from folded lines was kept
- also ignore lines without any data

16:44 Lighttpd Revision df8e4f95: [core,security] process headers after combining folded headers

- this fixes various use-after-free scenarios (reported by Or Peles of
VDOO): when parse_single_header stores point...