ncsa-httpd/src/FEATURE_REQUESTS

38 lines
1.8 KiB
Plaintext

Port configurable per VirtualHost
kadow@msg.net (Kevin Kadow)
Server Parse CGI output
not feasible because SSI parser using buffered I/O, CGI uses getline()
(server buffered I/O)
But, we did it anyways. See CGI_SSI_HACK in config.h
Allow extra CGI environment variables to be specified via configuration
Kevin Kadow (kadow@msg.net) and Brian Millett (bpm@techapp.com)
Shouldn't be too hard, probably in 1.5.1b4
Ok, maybe in 1.5.2
AuthUserScript - Heiner Schorn (Heiner.Schorn@informatik.umu.se)
Pass a user name to a script, it returns the password to check against
the one the client sent to the server. This is safe from someone
writing a script to gather passwords, because the given password is
never sent to the script. This is unsafe on the server system because
it will return the password of a user. That could be made safer by
making the mechanism employ crypt on the password before hand..
Shouldn't be too hard, but needs some design work. Perhaps 1.5.1b4
Ok, maybe 1.5.2
Have separate UID/GID per CGI script - Marc Evans (marc@destek.net)
With Patch (NF-1.5b7-marc_cgi_uid_hack)
Basically, changes calls from setuid to seteuid, so it changes the
effective user id of the server. This makes any security hole
potentially dangerous, such as the one in 1.3, since the program
that you can force to run can set the euid back to root.
Look at it for 1.5.1b4, probably always have to be a #define for the
more security conscious users of NCSA HTTPd
Push off to 1.5.2
SHTTP
Alpha is done, but we need to test it more
SSL
Again, alpha code is in place, but it needs to be tested more
RADIUS
Ok, I was expecting something slightly different. Doesn't quite fit
the current way of doing things, but shouldn't be too hard to figure
out either. Probably 1.5.2