lighttpd 1.4.9 - 2006-01-14 19:49

Dear lighties,

I'm proud to announce the availability of lighttpd 1.4.9, a prop-in replacement for lighttpd 1.4.8.

This release fixes several major bugs

  • growing errorlog if fastcgi backend dies
  • endless loop in mod_cgi

and most important:

  • a CRITICAL bug in the handling of case-insensitive filesystems like NTFS and FAT on Windows or the default filesystem on MacOS X. Everyone on those platforms has to upgrade as soon as possible. A security announcement is following this mail.

On the good side:

  • the power-magnet for mod_cml
  • more statistics for mod_fastcgi (load, backend usage, ...)
  • a first mod_evasive
  • better handling of If-Range, duplocate If-Modified-Since and more compliance with webdav clients

Changes

  • added server.core-files option (sandy <sandy@meebo.com>)
  • added docs for mod_status
  • added mod_evasive to limit the number of connections by IP (<w1zzard@techpowerup.com>)
  • added the power-magnet to mod_cml
  • added internal statistics to mod_fastcgi
  • added server.statistics-url to get internal statistics from mod_status
  • added support for conditional range-requests through If-Range
  • added static building via scons
  • fixed 100% cpu loops in mod_cgi ("sandy" <sjen@cs.stanford.edu>)
  • fixed handling for secure-download.timeout (jamis@37signals.com)
  • fixed IE bug in content-charset in the output of mod_dirlisting (sniper@php.net)
  • fixed typos and language in the docs (ryan-2005@ryandesign.com)
  • fixed assertion in mod_cgi on HEAD request is Content-Length (<sandy@meebo.com>)
  • fixed handling if equal but duplicate If-Modified-Since request headers
  • fixed endless loops in mod_fastcgi if backend is dead
  • fixed Depth: 1 handling in PROPFIND requests on empty dirs
  • fixed encoding of UTF8 encoded dirlistings (Jani Taskinen <sniper@iki.fi>)
  • fixed initial bind to a unix-domain socket through server.bind
  • fixed handling of lowercase filesystems
  • fixed duplicate request headers cause by mod_setenv