mongrel 1.1.2-java → 1.1.3-java

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
data.tar.gz.sig CHANGED
@@ -1 +1 @@
1
- �� �P��J�������#n� ��N_���mv`�7���@�6p��2$(�w��j�\_��c��qvPG��|���c96|�OY�����}6v��I=9����6Oh��(��a��޷
1
+ ���n�@�@݇ϖU0� Hf&ΪRY�.5jr[�r���$=o��M �ֹ�(�J�'P���Q0��d>��"L��N���0}�`OѬ')cE>T;wx��O[G��)ـ����iU'r뱠}Fk�׵���k͍0��=IO�Ӎ�Q����:"�ܾ�'�����#D�I-�D���V����v;/}��V��ȧZ>�`Ԟ��r�1D�v�'aY8����*d�g�m�i�O�_�g�
data/CHANGELOG CHANGED
@@ -1,4 +1,6 @@
1
1
 
2
+ v1.1.3. Fix security flaw of DirHandler; reported on mailing list.
3
+
2
4
  v1.1.2. Fix worker termination bug; fix JRuby 1.0.3 load order issue; fix require issue on systems without Rubygems.
3
5
 
4
6
  v1.1.1. Fix mongrel_rails restart bug; fix bug with Rack status codes.
@@ -384,7 +384,7 @@ void Init_http11()
384
384
  DEF_GLOBAL(server_protocol, "SERVER_PROTOCOL");
385
385
  DEF_GLOBAL(server_protocol_value, "HTTP/1.1");
386
386
  DEF_GLOBAL(http_host, "HTTP_HOST");
387
- DEF_GLOBAL(mongrel_version, "Mongrel 1.1.2"); /* XXX Why is this defined here? */
387
+ DEF_GLOBAL(mongrel_version, "Mongrel 1.1.3"); /* XXX Why is this defined here? */
388
388
  DEF_GLOBAL(server_software, "SERVER_SOFTWARE");
389
389
  DEF_GLOBAL(port_80, "80");
390
390
 
@@ -215,7 +215,7 @@ public class Http11 extends RubyObject {
215
215
 
216
216
  req.setInstanceVariable("@http_body", RubyString.newString(runtime, new ByteList(hp.parser.buffer, at, length)));
217
217
  req.aset(runtime.newString("SERVER_PROTOCOL"),runtime.newString("HTTP/1.1"));
218
- req.aset(runtime.newString("SERVER_SOFTWARE"),runtime.newString("Mongrel 1.1.2"));
218
+ req.aset(runtime.newString("SERVER_SOFTWARE"),runtime.newString("Mongrel 1.1.3"));
219
219
  }
220
220
  };
221
221
 
Binary file
@@ -65,7 +65,7 @@ module Mongrel
65
65
  REQUEST_URI='REQUEST_URI'.freeze
66
66
  REQUEST_PATH='REQUEST_PATH'.freeze
67
67
 
68
- MONGREL_VERSION="1.1.2".freeze
68
+ MONGREL_VERSION="1.1.3".freeze
69
69
 
70
70
  MONGREL_TMP_BASE="mongrel".freeze
71
71
 
@@ -132,8 +132,12 @@ module Mongrel
132
132
  # Add the drive letter or root path
133
133
  req_path = File.join(@path, req_path) if @path
134
134
  req_path = File.expand_path req_path
135
-
136
- if File.exist? req_path
135
+
136
+ # do not remove the check for @path at the beginning, it's what prevents
137
+ # the serving of arbitrary files (and good programmer Rule #1 Says: If
138
+ # you don't understand something, it's not because I'm stupid, it's
139
+ # because you are).
140
+ if req_path.index(@path) == 0 and File.exist? req_path
137
141
  # It exists and it's in the right location
138
142
  if File.directory? req_path
139
143
  # The request is for a directory
@@ -153,7 +157,7 @@ module Mongrel
153
157
  return req_path
154
158
  end
155
159
  else
156
- # does not exist or isn't in the right spot
160
+ # does not exist or isn't in the right spot or isn't valid because not start with @path
157
161
  return nil
158
162
  end
159
163
  end
@@ -1,23 +1,23 @@
1
1
 
2
- # Gem::Specification for Mongrel-1.1.2
2
+ # Gem::Specification for Mongrel-1.1.3
3
3
  # Originally generated by Echoe
4
4
 
5
5
  Gem::Specification.new do |s|
6
6
  s.name = %q{mongrel}
7
- s.version = "1.1.2"
7
+ s.version = "1.1.3"
8
8
  s.platform = %q{java}
9
9
 
10
10
  s.specification_version = 2 if s.respond_to? :specification_version=
11
11
 
12
12
  s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
13
13
  s.authors = ["Zed A. Shaw"]
14
- s.date = %q{2007-12-22}
14
+ s.date = %q{2008-01-02}
15
15
  s.default_executable = %q{mongrel_rails}
16
16
  s.description = %q{A small fast HTTP library and server that runs Rails, Camping, Nitro and Iowa apps.}
17
17
  s.email = %q{}
18
18
  s.executables = ["mongrel_rails"]
19
19
  s.has_rdoc = true
20
- s.homepage = %q{}
20
+ s.homepage = %q{http://mongrel.rubyforge.org}
21
21
  s.require_paths = ["lib", "ext"]
22
22
  s.required_ruby_version = Gem::Requirement.new(">= 1.8.4")
23
23
  s.rubyforge_project = %q{mongrel}
@@ -40,20 +40,22 @@ end
40
40
  # p.summary = "A small fast HTTP library and server that runs Rails, Camping, Nitro and Iowa apps."
41
41
  # p.author ="Zed A. Shaw"
42
42
  # p.clean_pattern = ['ext/http11/*.{bundle,so,o,obj,pdb,lib,def,exp}', 'lib/*.{bundle,so,o,obj,pdb,lib,def,exp}', 'ext/http11/Makefile', 'pkg', 'lib/*.bundle', '*.gem', 'site/output', '.config', 'lib/http11.jar', 'ext/http11_java/classes', 'coverage']
43
+ # p.url = "http://mongrel.rubyforge.org"
43
44
  # p.rdoc_pattern = ['README', 'LICENSE', 'CHANGELOG', 'COPYING', 'lib/**/*.rb', 'doc/**/*.rdoc']
44
45
  # p.ignore_pattern = /^(pkg|site|projects|doc|log)|CVS|\.log/
45
- # p.ruby_version = '>= 1.8.4'
46
+ # p.ruby_version = '>=1.8.4'
46
47
  # p.dependencies = ['gem_plugin >=0.2.3']
47
48
  # p.extension_pattern = nil
48
49
  #
50
+ # when 'eweaver'
51
+ # when 'luislavena'
52
+ # end
53
+ #
49
54
  # p.need_tar_gz = false
50
55
  # p.need_tgz = true
51
56
  #
52
- # case RUBY_PLATFORM
53
- # when /mswin/
54
- # when /java/
55
- # else
56
- # p.extension_pattern = ["ext/**/extconf.rb"]
57
+ # if RUBY_PLATFORM !~ /mswin|java/
58
+ # p.extension_pattern = ["ext/**/extconf.rb"]
57
59
  # end
58
60
  #
59
61
  # p.eval = proc do
@@ -64,7 +66,7 @@ end
64
66
  # add_dependency('cgi_multipart_eof_fix', '>= 2.4')
65
67
  # when /java/
66
68
  # self.files += ['lib/http11.jar']
67
- # self.platform = 'jruby'
69
+ # self.platform = 'jruby' # XXX Is this right?
68
70
  # else
69
71
  # add_dependency('daemons', '>= 1.0.3')
70
72
  # add_dependency('fastthread', '>= 1.0.1')
metadata CHANGED
@@ -1,7 +1,7 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: mongrel
3
3
  version: !ruby/object:Gem::Version
4
- version: 1.1.2
4
+ version: 1.1.3
5
5
  platform: java
6
6
  authors:
7
7
  - Zed A. Shaw
@@ -52,7 +52,7 @@ cert_chain:
52
52
  ALN3mi/9z0Mf1YroliUgF0v5Yw==
53
53
  -----END CERTIFICATE-----
54
54
 
55
- date: 2007-12-22 00:00:00 -05:00
55
+ date: 2008-01-02 00:00:00 -05:00
56
56
  default_executable:
57
57
  dependencies:
58
58
  - !ruby/object:Gem::Dependency
@@ -144,7 +144,7 @@ files:
144
144
  - tools/trickletest.rb
145
145
  - lib/http11.jar
146
146
  has_rdoc: true
147
- homepage: ""
147
+ homepage: http://mongrel.rubyforge.org
148
148
  post_install_message:
149
149
  rdoc_options: []
150
150
 
metadata.gz.sig CHANGED
@@ -1,4 +1 @@
1
- O�<�c����,5x"�~d��ӌ����l����� �'�G D��u=f����(k��*}���V Ϫ�
2
- ��� �*u�[w�4CfS�V����].a��!c,���e���&�[�C�79
3
- ���Z���h�BJw,X�(�P������
4
- 1��-�r����`l����%K�#�B��|��'G�q��X��
1
+ S Q[~ofG~L��(v�e �=�=G����������n�1��=b2��G��ZT�߱��ѥ�d������ŴP�LȊ4o��0vB(Ö$�Z�)�a2t'�]��A�r�K��'���P�z)�Vm��=X������e^��qq�*�$FJ����jKMJt8D N� &��Kas�l��1 ��N���i�u�.�K`T��H��h�5�@�4�x^�01�w�K�-�����2$�L�/(9��Q��.��