| iMatix home page | Xitami home page | << | < | > | >>

Xitami Version 2.5b4

Release History

Release Notes for Xitami 2.5

These are the release notes for the latest major version of Xitami, since the last release of the previous major release. Summary release notes for every release since 1.0a come afterwards.

• Further support for HTTP/1.1, including partial GETs. We now consider Xitami to be a HTTP/1.1 server, although a number of optional HTTP/1.1 features are not yet implemented. The critical features implemented are: keep-alive handling, document publishing, resume (partial GET), and HTTP/1.1 virtual hosts.
• SSI handling is now done internally. To use SSI pages you no longer need to install Perl and the perlssi filter. The Xitami installation still includes perlssi, but it is not activated in the .cfg file [Fiilters] section. The new [SSI] section controls the internal SSI agent. The most important config items in this section are: Enable/disable the #exec command, a potential security hole. The SSI_INSECURE environment variable is no longer used.

  enabled=1/0

  Enable or disable SSI, enabled by default

  timeout=30

  Timeout for CGI programs called from the SSI agent

  exec=0

  To re-enable use of the perlssi filter, remove references to xixssi in xitami.cfg, and add the [Filter] definition for perlssi.
• Xitami's logging capabilties have been given a complete overhaul. The new logging agent lets you manage log file rotation/cycling in many different ways, and lets you create log files in many formats.

  The built-in log file formats are:

  • CLF - Common-log format, as used by the NCSA httpd server.
  • CLFX - Extended CLF, as used by Apache and Xitami.
  • MS - Microsoft format as used by IIS.
  • LML - iMatix Logfile Markup Language, an XML format.
  • XLML - iMatix Extended LML, a richer XML format.

  LML and XLML are intended to simplify log-file post-processing via an XML-capable tool like GSLgen. You can also define custom log file formats using any combination of text, delimiters, and logging data fields.

  The logging agent performs reverse-DNS translations on the fly, note that you must define the RDNS configuration before this will work.

  You can cycle log files hourly, daily, weekly, or monthly. You can cycle the log files when the server starts-up, when they exceed some size in kilobytes, or when they exceed some size in lines.

  You can specify the exact day and/or time a log file must be cycled.

  When cycling a log file, you can rename the old file, delete the old file, move the old file to some directory, append the old data to some file, or run an arbitrary command against the old log file.

  You can decide how to name old log files using a mask built from the current day, time, and other information or text.

  Each virtual host can have independent settings for its HTTP and FTP log files.

• A new 'supervisor agent' cleans-out old log files, temporary files, etc. This agent can be activated on servers that must run for long periods without manual intervention or monitoring. By default it is disabled - set the [Server] supervisor option to 1 to enable it.
• Xitami can now act as a dynamic-DNS registration client, so that if you register with a service like Xitami.Net, Xitami does the necessary work to register your IP address. Xitami works with several DDNS services, and it's quite easy to add other ones once you know the protocol used. This is an example of the [Ddns] section, set-up to use the Xitami.net service (we've blanked-out the password key):

  [Ddns]
      Domain = "black.xitami.net"
      Enabled = "1"
      Password = "TZO-xxxx-xxxx-xxxx-xxxx"
      Service = "tzo.com"
      Username = "admin@xitami.com"
  

• The LRWP protocol handler has been upgraded to LRWP/2.0, which is a more secure and faster version of the LRWP protocol. Xitami still handles LRWP/1.0 applications.
• ISAPI support is now available, for Windows systems, as an LRWP plug- in. You can download this from xitami.com.
• Java Servlet support is available, for all systems, as a LRWP plug-in. You can download this from xitami.com.
• Various other improvements to the HTTP service:
  • You can issue customised HTTP headers depending on file types.
  • Aliases can now refer to a full filename, which provides an easy way to define a default file for a certain URL.
  • CGI programs can now be started under specific user ids and user groups. This can be defined on a virtual-host basis.
  • If the URL parameter is 'sort=xxx', uses this value instead of the current server:dirsort option.
• Various other improvements to the FTP service:
  • Xitami supports the FTP user@hostname syntax for virtual hosts. This lets you construct FTP logins to access virtual hosts, and some FTP clients support this directly.
  • Uploads can no longer exceed hard quota.
• Xitami now uses GSLgen in several important places. GSL is iMatix's Open Source template-based code-generation language. The GSLgen engine is built-in to Xitami, and GSLgen is also provided as a seperate command-line tool with Xitami. GSL templates are called 'scripts' and are normally placed in the gsl subdirectory. You can modify these, but we recommend you copy them and change the copies. Each virtual host can use its own set of scripts.
  • Each script starts with a small explanation, which you will need when you want to change them or make your own. Especially useful is the list of data fields that you can insert into the template.
  • HTTP directory listings are no longer hard-coded, but are now based on a script called httpdir.gsl. The script creates a page with three columns, each resortable. This uses the new '?sort=xxx' feature.
  • FTP messages, such as that shown when the user logs-in, are based on a template, rather than the previous set of static text files. This lets you show messages like 'there are X users logged-in to this server'.
  • You will also find GSLgen useful for analysing and processing log files in LML or XLML formats.
  • Xitami lets you process XML files directly into HTML, using GSL scripts. This is a powerful way of showing data that comes from other sources.
• The Xitami config file, xitami.cfg, now contains full documentation for all options. The config file is actually generated using GSLgen, from an XML definition file. The same XML definition file generates various pieces of source code, and the HTML documentation for the config file options. This is an example of a useful GSL application.
• A new package, the Xitami SDK, contains a number of tools and components that were previously either not supplied or were dispersed in other packages:
  • The iMatix Studio form compilers fdlgen and fmlgen. These tools are used to create the HTML forms used in the Xitami WBA. FDL is a form definition language based on htmlpp, and FML is an embedded form-markup language based on HTML comment tags. Fdlgen converts an FDL file into FML, and fmlgen converts an FML file into C language defintions that can be compiled. A web program displays such forms using the form i/o system (formio.c), also provided. FDL and FML are described in the fdldoc.txt and fmldoc.txt files. Using these tools you can create your own derivates of the Xitami WBA, and you can add the form functions to LRWP applications written in C. The Xitami SDK includes the FDL file used by the Xitami WBA.
  • The WSX resource compiler, wsxrc. This is a Perl script that compiles image files and other resources into C include files, so that they can be compiled into an executable. The Xitami WBA uses this technique to compile icons and images into the Xitami server executable, making the WBA faster and more robust (not depending on external files). Wsxrc can easily be adapted to generating other languages. One possible future for this tool is to produce XML, which can then be fed to a GSL script. The Xitami SDK includes the Xitami WBA resource file (xiadmin.rc) and all image files used in the WBA (GIF files).
  • The Xitami configuration definition and script, xiconfig.xml and xiconfig.gsl. These are the single source for all Xitami config option definitions.
  • The Xitami model definitions and script, ximodel.xml and ximodel.gsl. These generate the various Xitami models (xitami, xilite, xipro,...) from a single script. You can define your own models, including the agents you want. You will need to compile and link the generated program. We use a GSL script here to avoid copying code.
  • Xitami 2.5 introduces the notion of throttle pipes, a technique for limiting the bandwidth consumed by a web or FTP site. A throttle pipe has a specific upload and download bandwidth, and is shared by a set of web sites, and FTP sites. If throttle pipes are used (by default they are disabled), then all HTTP accesses for a virtual host share one throttle pipe. FTP accesses use a default throttle pipe, but individual logins can use other throttle pipes. So, if you have a 64kbps line, you can define all web and ftp downloads to share one 32kbps pipe, while a privileged FTP login might have access to a 64kbps pipe. Xitami comes with a standard set of pipe definitions, but you can add more if you want to.

  Summary Release Notes for All Versions

  • Xitami 2.5b4 released 2000/04/20 with these changes:
    • Browser-based admin was broken - fixed.
  • Xitami 2.5b3 released 2000/04/01 with these changes:
    • Upgraded GSL engine to GSL/2.0.
    • Corrected errors in dynamic DNS agent.
    • Closed denial-of-service hole whereby a request 'GET' caused an assertion failure.
    • Closed denial-of-service hole whereby requests for filenames or directory names containing DOS device names caused the operating system to fail (affecting Windows 95/98).
    • Handles situations where file size is unknown gracefully (for OpenVMS).
    • Corrected bug in CGI handler which caused stdin to be empty.
  • Xitami 2.5b2 released 99/11/26 with these changes:
    • Xitami can now do server-side GSL scripting (processing .gsl files).
    • FTP mkdir command failed on UNC drives (\\system\drive).
    • Fixed error in logfile 'append' method.
    • Added manual log cycling functions to WBA.
    • Some files were missing from Windows install kits.
    • HEAD method did not work with SSI pages - fixed.
  • Xitami 2.5b1 released 99/11/14 with these changes:
    • Closed some denial-of-service weaknesses in LRWP/2.0 agent.
    • Various fixes in logging agent.
  • Xitami 2.5b0 released 99/11/01 with these changes:
    • Added xixxml agent for server-side XML processing using GSL.
    • Sealed Windows '//' security issue.
    • Safepaths option was not being applied to CGIs and directory listings - fixed.
    • WSX agents can now map all URLs for a website using '/' alias.
    • Partial downloads were not working - fixed.
    • Logging agent sometimes failed to cycle log files - fixed.
  • Xitami 2.5a1 released 99/09/19 with these changes:
    • Sometimes aborted when launched at startup under Windows - Fixed.
    • Sometimes aborted when restarted from the WBA - fixed.
    • Added support for HTTP and FTP throttle pipes, with standard set of throttle pipes.
    • Image maps were broken (xiimap agent) - fixed.
    • Full release notes for 2.5a were added to documentation.
    • WBA accepts URL http://servername/admin/ - previously this returned a 404 error.
    • Dynamic DDNS definition file name can be configured in DDNS config section (was previously hard-coded as 'ddnsdef.xml').
    • WBA did not allow modification of log cycle fields - fixed.
    • SSI agent aborted when asked to show a non-existing SSI file - fixed.
    • Fixed memory leak in FTP file transfer service (thanks to Jimi Joergensen for finding this).
    • Log files were not cycling at correct time - fixed.
    • FTP service aborted when accessing directories on CD-ROMs.
  • Xitami 2.5a0 released 99/08/07 with these changes:
    • New xixssi agent does fast internal SSI parsing (PerlSSI is dead, long live SSI!)
    • New xixlog logging agent allows fully-customisable logging including XML.
    • New xisuper supervisor agent cleans-out old log, temp, and debug files.
    • New xiimap image-map agent handles .map files.
    • New xiddns agent handles dynamic domain-name (DDNS) registration.
    • New xilrwp agent supports LRWP/2.0.
    • New LRWP plug-in supports ISAPI (Windows only, beta).
    • New LRWP plug-in supports Java servlet support (beta).
    • Added support for HTTP/1.1 functions including resume (Range: header).
    • CGIs can now run under specified user ids.
    • Aliases can now refer to full filename.
    • Allows custom HTTP headers, using server:header-dir option.
    • Allows FTP virtual hosts using 'user@hostname' syntax.
    • If VH authorisation file is missing, starts with a warning message.
    • HTTP directory listings can be customised using GSL scripts.
    • Uploads can no longer exceed hard quota.
    • Keep-Alive always disabled for CGIs that produce their own HTTP header.
    • Xitami.cfg file now contains full documentation for options.
    • HTTP error texts can be generated using GSL scripts.
    • FTP welcome texts can be generated using GSL scripts.
    • HTTP directory listing sort order can be overridden by passing a URL argument: '?sort=xxx' where xxx is the desired sort order.
  • Xitami 2.4d7 released 2000/04/01 with these changes:
    • Closed denial-of-service hole whereby a request 'GET' caused an assertion failure.
    • Closed denial-of-service hole whereby requests for filenames or directory names containing DOS device names caused the operating system to fail (affecting Windows 95/98).
  • Xitami 2.4d6 released 99/11/26 with these changes:
    • Fixed error in logfile 'append' method.
    • FTP mkdir command failed on UNC drives (\\system\drive).
    • LRWP/2.0 handler was broken - fixed
    • HEAD method did not work with SSI pages - fixed.
  • Xitami 2.4d5 released 99/11/14 with these changes:
    • Closed some denial-of-service weaknesses in LRWP/2.0 agent.
    • Various fixes in logging agent.
    • Unix build script had errors - fixed.
  • Xitami 2.4d4 released 99/11/01 with these changes:
    • Sealed Windows '//' security issue.
    • Upgraded LRWP agent to LRWP/2.0 protocol.
    • Safepaths option was not being applied to CGIs and directory listings - fixed.
    • Logging agent sometimes failed to cycle log files - fixed.
  • Xitami 2.4d3 released 99/09/19 with these changes:
    • Sometimes aborted when launched at startup under Windows - fixed.
    • Sometimes aborted when restarted from the WBA - fixed.
    • Sometimes aborted when accessing CD-ROMs through FTP - fixed.
    • Log files were not cycling at correct time - fixed.
    • FTP service had some memory leaks - fixed.
    • URLs starting with // bypassed authentication checks - fixed.
  • Xitami 2.4d2 released 99/08/07 with these changes:
    • Redirections were returning the wrong MIME type - fixed.
    • Windows GUI correctly updates server IP address if it change.
    • 1024-byte limitation on form query variables was removed.
  • Xitami 2.4d1 released 99/06/23 with these changes:
    • Better handling for sockets under Windows when keep-alive is off.
    • Corrected PATH_TRANSLATED for PHP and other filters.
    • Issued two Content-Length: headers for CGIs that generated this - fixed.
    • WBA wrongly showed links 'Errors Wsx Filters' for some pages, and crashed when these were selected - fixed.
    • WBA sometimes showed errors in lists of users - fixed.
    • Xitami sometimes returned '403' when looking for files on networked drives - fixed.
    • Removed server:translate option - redirected URLs now always use the hostname.
    • New option, cgi:passargs, controls whether CGIs receive command-line arguments or not.
    • FTP rmdir command failed after doing a 'dir' of the directory.
  • Xitami 2.4d0 released 99/05/15 with these changes:
    • HTTP listings failed when filenames contained '%' character.
    • FTP quota manager was causing problems - fixed.
    • FTP server secured against dictionary-based password attacks.
    • FTP server stopped responding if two PASV commands were issued to same control connection.
    • FTP server now handles APPEnd command correctly.
    • FTP timeouts were being set 100 times too high.
    • Windows timer handler gave occasional aborts - fixed.
    • Xitami crashed if posted variable was greater than 255 characters.
    • Access log lines were limited to 255 characters - increased to 4k.
    • Access log file showed a file size '-1' for 404 errors - fixed.
    • Access log time format was wrong in some time zones.
  • Xitami 2.4c3 released 99/03/14 with these changes:
    • FTP server failed when APPEnd command was used - fixed.
  • Xitami 2.4c2 released 99/01/23 with these changes:
    • FTP server now suppports multihoming virtual hosts.
    • Logging stopped after server restart - fixed.
    • CGI PATH_TRANSLATED symbol now holds full path and was corrected to fix a problem introduced in 2.4c0.
    • CGI SERVER_NAME symbol no longer contains port number for instances of Xitami running above port 80.
    • New symbol, SERVER_URL holds full URL to server.
    • HTTP file upload was not working for files > 30k - fixed.
    • Added new CGI variable, SERVER_VERSION.
    • HTTP server sometimes closed socket before entire page was transmitted to browser - fixed.
    • Corrected bug in handling of CGI Location: header.
  • Xitami 2.4c1 released 99/01/02 with these changes:
    • Better handling for high ASCII (e.g. Chinese) characters.
    • CGI variables PATH_TRANSLATED and CGI_ROOT now hold full path, which corrects some problems with the SSI #include and #exec commands.
  • Xitami 2.4c0 released 98/12/23 with these changes:
    • FTP server sometimes gave 'unauthorised' message on rmdir - fixed.
    • FTP server now lets you allocate disk space quotas per user.
    • Web server now accepts URL names containing '+'.
    • New FTP access mode, 'U' allows only uploading of new files.
    • FTP 'P' access mode now allows directory browsing.
    • Web-based administration interface improved. Much nicer.
    • Corrected long-standing problem with aliases under OS/2.
    • No longer generates Last-Modified header for CGIs, WSXs, & filters.
    • Corrected display of IP address in Xitami Windows control panel.
    • Corrected bug under Linux which caused TCP/IP functions to go into debugging mode when keep-alive connections were enabled.
    • PATH_INFO was not being provided to WSX agents - fixed.
    • Added Crash Recovery system to Windows GUI and NT service versions: Xitami will now recover from a memory violation error.
    • Added server:recover option for silent crash recovery.
  • Xitami 2.4b2 released 98/12/06 with these changes:
    • Server sometimes crashed during log file cycling - fixed.
    • DOCUMENT_ROOT CGI variable now holds full path; this fixes a problem with the 'SSI #include virtual=' command.
    • Corrected a fault in the handling of the HTTP MOVE command.
    • Xitami distribution filenames changed to new format.
    • Server:advertize option turns off server name in directory listings.
    • WBA Help function now works correctly.
    • Improved WBA icons.
    • FTP manager now lets you set quotas per user.
  • Xitami 2.4b1 released 98/11/28 with these changes:
    • SSI #include command was broken in Perlssi - fixed.
    • It was possible to freeze the server by asking for 'com1' or 'lpt1' (and variants) as a URL - fixed.
    • Rare memory overwrite problem in SMT kernel was fixed.
    • Changed default ftp:ipaddress for passive connections to '*'.
    • HTTP PUT method returned 404 for new files - corrected.
    • Removed cgi:exit-ok configuration option.
    • Improved handling for 'webmask=@filename' option.
    • Access logs now allow filenames containing spaces (these are replaced by the MIME encoding '%20').
    • Added new fields (filename, config table) to WSX_REQUEST messages.
    • Log file cycling corrected to work per virtual host.
    • Server:log-dir option now defaults to 'logs'.
    • Authentication was still looking for URL names with '_', e.g. [cgi_bin]. This was changed to search for the real URL value, e.g. [cgi-bin].
    • Server created empty files when asked for filtered file that did not exist - fixed.
    • WBA Restart function still occasionally crashed the server - fixed.
  • Xitami 2.4b released 98/11/08 with these changes:
    • Improved support for PHP 3.0, corrected PHP_SELF variable.
    • Added support for HTTP MOVE and COPY methods. All update methods are now controlled by the same 'http-update' URL authorisation option.
    • WBA Restart function crashed the server - fixed.
    • WBA Help function killed the WBA agent - fixed.
    • Log files were wrongly named (e.g. "./d:\logs\access.log") when fully-specified log file names were used - fixed.
    • Server now uses setuid functions to access port 80 under Unix (thanks to Grant McDorman <grant@isgtec.com>).
    • Server now uses setuid functions to switch to a safe user and group under Unix (thanks to Georg Ottinger <g.ottinger@magnet.at>).
    • Changed console:refresh default to 0 to get rid of IE4 warning messages.
    • Added Xitami version number to WBA screens.
    • Maximum size of HTTP request in log files increased from 255 to 1024 chars.
    • Added win32:service-name and service-text options to allow multiple Xitami services to run on the same system.
    • Extended FTP access logging to include logins, failed logins, and logouts.
    • FTP server did not show aliases if user's root directory was empty - fixed.
    • Filters now run as specified by the cgi:workdir option.
    • CGIs and filters appeared twice in logfiles - fixed.
    • Under Windows, accessing URLs 'aux', 'con', 'prn' or 'nul' caused server to freeze-up - fixed.
    • 401 errors were being logged to the error log - these are now ignored.
    • Xitami was logging 'WSAECONNRESET' messages in the error log file; these were removed since they do not actually indicate errors.
    • DNS-based virtual hosts did not work correctly on HTTP ports other than 80 - fixed.
    • cgi:timeout can be set to zero to indicate 'no limit'.
  • Xitami 2.4a1 released 98/10/03 with these changes:
    • Added support for HTTP PUT and DELETE methods.
    • Configuration file handling was changed to allow "-" in key names, for instance in virtual host names. Old config files containing "_" in key names must be changed to use '-'.
    • Added ftp:login-text option to WBA FTP setup.
    • Last-Modified: response date was miscalculated by a month. This also showed-up in FTP directory listings.
    • Corrected a fault in the log file cycling code which created old log files in main directory, even if log files were stored in separate directory.
    • FTP server crashed if REST command was sent with no arguments.
    • Added 'local' option for HTTP and FTP access and error logs which allows you to suppress logging for local connections.
    • PerlSSI filter was improved to strip-off HTTP headers from CGI output.
    • Corrected a bug in the logging code which sometimes wrote a file size of '-1' bytes, under Windows.
    • Windows version now updates the system tray icon to indicate connections.
    • Added cgi:enabled option to enable/disable CGI completely.
    • Added cgi:wildcard option to control whether /cgi-bin is allowed anywhere in URL, or only at start (by default, not allowed).
    • Added server:log-dir option to allow central control of logfile directory.
    • Security:admin option now works correctly for virtual hosts.
    • Windows 95 tray message now shows server statistics.
    • Xitami used to accept URIs like "/cgi-bintestcgi"; these are now rejected.
    • 'BBA' renamed to 'WBA' (web-based admin) in documentation.
    • Corrected a bug in the config file handling which caused problems when one tried to protect a resource containing ':', e.g. [e:\private].
    • Corrected a bug in the FTP transfer statistics which were counting arbitrary transfer sizes for simple FTP commands.
    • Added WSX_REQBIN, WSX_BIN and WSX_MBIN messages for passing binary data to and from WSX plugins.
    • WBA given a facelift; added graphical toolbar and changed the look and feel a little.
    • Added security:safepaths option to disable unsafe filename checking.
    • Added all=* option in authorisation files.
    • Fixed a bus error in the LRWP agent under SGI.
    • Increased the maximum length of a CGI cookie string from 237 to about 4K.
    • FTP server no longer replaces international characters by octal escape sequences in directory listings.
    • CGI:workdir default changed from 'cgi-bin' to '-' (so that CGIs run in the script directory).
    • Corrected a bug which caused logging to cease after WBA restart.
    • Corrected a DoS bug which crashed the server when a very long user name or password was entered in for a URL authorisation.
    • Corrected a DoS bug which crashed the server when an URL was entered with an extra trailing slash.
    • Corrected a bug which crashed the server when a .map file contained incorrect values.
    • Added Java interface library for LRWP (thanks to Eugen Woronenko <EWoronen@osram.com>).
    • Added Visual Basic CGI 'stdcgi' module (thanks to Wei-dun Teng <tiberius@ms13.accmail.com.tw>).
  • Xitami 2.3d1 released 98/07/26 with these changes:
    • Corrected a fault in the FTP server which caused it to refuse new connections after a WBA Restart, under Windows NT.
    • Added regression testing tool, 'xitest' to addons section.
  • Xitami 2.3d released 98/07/25 with these changes:
    • Corrected a fault in the HTTP server which left dangling sockets; after intensive use the server could refuse new connections.
    • Corrected a fault in the CGI handler which had problems with CGI scripts located in directories that contained '.' in the name.
    • Corrected a fault in the HTTP security system which was producing 403 (Not Authorised) errors on some directories.
    • Improved the HTTP directory listing to show GMT times correctly.
    • Corrected a fault in the LRWP agent which sometimes aborted when peer processes de-registered.
    • Improved the handling of the Windows version with respect to the Windows 95/NT 'Suspend' mode.
    • Improved the handling of very long URLs in the HTTP server; these were causing assertion failures.
    • Corrected the 'iMatix Web Site' button in the Windows version which wrongly used the current portbase setting when linking to imatix.com.
    • Added Desktop icon installation procedure for OS/2 (thanks to Scott Drake).
  • Xitami 2.3c3 released 98/07/13 with these changes:
    • FTP listing always omitted the last entry.
    • Default pages and SSIs did not always show correctly.
    • FTP and HTTP listings now hide 'hidden' files.
    • HTTP 302 return code works better with Opera browser.
    • Fixed some problems with use of CGIs as default pages.
  • Xitami 2.3c2 released 98/07/06 with these changes:
    • DNS-based virtual hosts were broken.
    • Log file did not contain correct value for User-Agent field.
  • Xitami 2.3c1 released 98/07/05 with these changes:
    • Server aborted on certain URLs (CGIs without extensions).
    • Some problems in OS/2 and Windows build scripts were fixed.
  • Xitami 2.3c released 98/07/04 with these changes:
    • Closed security hole under Windows 95/NT which let people access a URL containing long filenames by using the abbreviated short name.
    • Closed a security hole which allowed 'webmask' and 'realm' to be used as user names in certain cases.
    • The server:autostart option is now FALSE by default. If you want this you have to explicitly enable it.
    • At startup, Xitami indicates on which addresses it will accept connections (in WBA messages box or console window).
    • Under Windows, did not always handle CGI .bat files correctly.
    • Handling of CGI program arguments now conforms to CGI standards: URL argument string is split on '+', unless it contains '=', in which case it is passed only as the QUERY_STRING variable.
    • Added ability to specify HTTP and FTP directory list sort order in server:dirsort and ftp:dirsort.
    • Added support for FTP sign-off message (ftp:signoff option).
    • CGI SERVER_NAME variable is now the HTTP Host: field if available.
    • SSI "#include file=" command did not work correctly - fixed.
    • Corrected a memory leak introduced in 2.3b2.
    • Corrected handling of empty error header/footer blocks.
    • WSX interface corrected to handle small binary uploads.
    • FTP service can now be enabled/disabled through the WBA.
    • WBA virtual host wizard defines a password for "/admin" in all cases.
    • New format for [Filter] definitions: ".xxx=filter". Old format is still supported.
    • [WSX] definitions can now be based on file extensions, using ".xxx=agent" format.
    • HTTP directory listing format revised for long filenames.
    • Multilanguage Accept header now applies to CGI programs, filters, and to default pages.
    • Redirected URLs (302) now use server:hostname in preference to the Host: field, if server:hostname defined.
    • Directory listings could fail on directories that were shared as volumes with Services for Macintosh (which creates funny filenames).
    • Cycled log files are now given names based on the date, not time.
    • Server aborted on CGI scripts starting with '#!' without a following program name.
    • Corrected log file timezone indicator to always be [-+]nnnn.
    • CGIs failed if server:temp-dir did not exist - fixed.
  • Xitami 2.3b2 released 98/06/02 with these changes:
    • Corrected a problem with the NT service version which caused it to issue system log messages with no reason.
    • Corrected a security hole in the authentication system which made it possible to get into protected files by using '\' in the URL (under Windows only).
    • Automatically looks for a .htm file if it can't find a .html (and vice-versa).
  • Xitami 2.3b1 released 98/05/24 with these changes:
    • Windows install created broken shortcut for Xitami icon if Xitami was installed elsewhere than in the default directory.
    • WBA transfer statistics were sometimes incorrect - fixed.
    • POST method now allowed for filters - small but important change.
    • Virtual host lookup now uses Host: field before IP address (previously tested the other way around).
    • Added ftp:password-case option.
    • FTP server aborted if ftp root was set to '/'.
    • FTP server root got corrupted after a restart operation.
    • Form POSTs passed through the environment did not work.
    • Filenames ending in % could cause aborts.
    • Limit on size of customised error texts increased to 32k total.
    • FTP server correctly issues a 221 Closing Connection after QUIT.
  • Xitami 2.3b released 98/05/09 with these changes:
    • Priority option was being ignored; Xitami always ran under HIGH priority (under Windows 95 and NT).
    • Multipart/form uploads failed for binary files smaller than 8K.
    • SSI include files can now contain SSI commands themselves.
    • SSI #execute cgi command can pass URL arguments (?xxx).
    • 16-bit version was not scanning HTTP requests correctly: fixed.
    • Referrer field in access log file was empty.
    • WBA crashed when the 'Errors' option was selected from the main config screen - fixed.
    • Accept-Language support improved.
    • Restart function did not always reload configuration: fixed.
  • Xitami 2.3a1 released 98/04/25 with these changes:
    • Redirection of URLs based on aliases did not work correctly.
    • CGI_STDIN/STDOUT variables were being wrongly formatted.
    • CGI content type was being forced, wrongly, to text/html.
    • Added support for Accept-Language header for multiple languages.
    • FTP server also handles APPE command.
    • Xitami aborted when WBA Restart command was used.
    • Xitami aborted when FTP user list held more than a page of users.
  • Xitami 2.3a released 98/04/18 with these changes:
    • FTP connections now work asynchronously; previously clients behind a firewall could cause the FTP server to block.
    • Referencing a file like 'nul.gif' caused the server to abort under Windows (fixed).
    • WSX and filters now take precedence over CGI URLs.
    • Handles DOS-style aliases better (allows '\' in alias values).
    • Windows 3.x 16-bit version now works correctly.
    • Support for Win32s under Windows 3.x now documented correctly.
    • Configuration values can contain environment symbols like this: $(NAME).
    • Allows CGI programs to be placed in any HTML directory (you must set server:cgi-url=/, server:cgi-bin=webpages, and cgi:mixed-url=1).
    • Files with no extension can now have a MIME type (.=text/plain).
    • server:temp-dir directory is used for temporary files (e.g. CGI pipes).
    • server:debug-dir directory is used for debug log files.
    • "Support 16-bit CGI programs?" option in WBA CGI page did not work.
    • Server crashed on restart if Serverlog:enabled=0 was set - fixed.
    • PerlSSI filter improved to allow execution of CGI scripts.
    • Access log now contains full Referer field, including arguments.
    • Mime:default option defines MIME type for undefined file types.
    • Code uses snprintf/vsnprintf to protect against buffer overruns.
    • WBA FTP users screen did not delete users correctly; now does so when you clear the user name.
    • It is now possible to define for each user whether or not they have access to the root FTP aliases (aliases=0/1 option).
    • CGI output reparsing improved (was losing lines starting with <HTML>).
    • FTP cdup command moved to root directory; now works correctly.
    • FTP ftplogin.txt file can be placed in user login directories.
    • FTP server can now resume broken downloads.
    • FTP server also handles REIN, and STRU commands.
    • Log file cycling did not work correctly if set from WBA - fixed.
    • CGI programs can now generate multiple Set-Cookie: header lines.
    • Added support for long webmasks (up to 64k): use @filename.
  • Xitami 2.2d3 released 98/03/03 with these changes:
    • The security hole in 2.2d was still open in a different place. Finally closed it!
  • Xitami 2.2d2 released 98/03/02 with these changes:
    • Corrected a bug in the FTP security code which was causing memory overwrites and consequent problems in the WBA.
    • Corrected a denial-of-service loophole which caused the server to crash when given a very long URL.
    • FTP 'mode' command was not working - fixed.
  • Xitami 2.2d1 released 98/03/01 with these changes:
    • Closed security hole in 2.2d that allowed access to protected resources.
  • Xitami 2.2d released 98/02/28 with these changes:
    • Certain POST requests (between 500-8000) bytes did not work.
    • Virtual host wizard was broken: it did not let you define a DNS-based virtual host.
    • Empty passwords are now accepted in the WBA and by the server.
    • WBA did not show authentication realms.
    • WBA treats FTP directory '/' as empty (i.e. in FTP root itself).
    • FTP server responses (550, 553) improved.
    • FTP server access rights per directory were not always used.
    • FTP directory access restrictions on [] now work.
    • FTP server was allowing all users to access aliases - fixed.
  • Xitami 2.2c released 98/02/09 with these changes:
    • Fixes an abort in the WBA (when you use the console properties button.)
    • Corrected UNIX and OS/2 build scripts.
    • Password protection sometimes switched-off completely, until Xitami was restarted. This has been fixed.
    • FTP uploads did not work any longer - fixed.
  • Xitami 2.2b (beta 2) released 98/01/18 with these changes:
    • Cgi:msdos-style option now controls whether CGIs and filters get filenames with Unix-style or MS-DOS style slashes. Default is 0.
    • Server:refresh can now be set to 0 to disable autorefresh.
    • Server:priority option added (can run up to 2-3 times faster under Windows).
    • Xitami crashed if you enabled full logging (server:debug=1) and there was an access error on a log file.
    • Security:admin option was not implemented in console version.
    • Server:cache-defaults option added to control whether defaults pages are cached or not. When this is 0, the browser will always fully reload a defaults page.
    • WBA now uses JavaScript for (New! Improved!) user interface.
    • Under Windows, PATH_TRANSLATED now uses \ instead of /.
  • Xitami 2.2a (beta 1) released 98/01/13 with these changes:
    • WSX protocol improved to allow dynamic aliases, non-HTML mime types, CGI environment variables,... Thanks to Robin Dunn for providing these ideas and the LRWP WSX agent.
    • LRWP (long-running web process) protocol support added.
    • PerlSSI was not still not really working - fixed again. Thanks to R. K. Lele for providing a solid test page.
    • Filters are now applied to the default pages; you can use SSI in the default page for a directory.
    • WSX protocol now allows dynamic aliases (WSX_INSTALL and WSX_CANCEL messages).
    • Small POSTs to WSX agents are now passed in memory; large POSTS in temporary files. Similar principle for returned HTTP data.
    • Authentication can now work with user-defined realms (previously the realm was always the requested URI, which was not excellent).
    • Server:debug option now also logs incoming requests.
    • Virtual host wizard closes a security loophole in which virtual hosts could access the WBA pages without password control.
    • Filters did not work under OS/2 - fixed.
    • Server:limit default changed to 0 for all platforms; ftp:limit default is now 25.
    • FTP service did not indicate transfer file type correctly - fixed.
    • FTP access rights strengthened - this code was completely rewritten.
    • FTP delete and rename functions always replied 'Okay' even if there were protection errors.
    • FTP directory listing function was broken - fixed.
    • FTP user and authentication files now uses full path names: this changes the meaning of an entry like [/pub], which is now a full path name (it used to be relative to the ftp root directory).
    • Various buffer-overrun flaws in FTP service fixed.
    • Xitami sometimes crashed when restarted from WBA - fixed.
    • Server restart no longer closes/reopens HTTP port - this was too delicate to get working right.
    • WBA can be disabled by setting security:admin to 0.
    • UNC names (//server/filename) no longer worked - fixed.
  • Xitami 2.1c released 97/12/25 with these changes:
    • ftp:login-text option added for configurable login messages.
    • Online management of custom error messages rewritten.
    • Online management of FTP passwords was broken - fixed.
    • File upload function was broken in 2.1a and b - fixed.
    • 'Powered by Xitami' images now shown on welcome page.
    • PerlSSI was not working - fixed.
    • CGI:debug was not being applied to filters - fixed.
    • Server portbase was not being applied to FTP access - fixed.
  • Xitami 2.1b released 97/12/19 with these changes:
    • FTP 'cd' command failed if user did not have GET authority; now works within all subdirectories of user's root directory.
    • Server:autostart option is now TRUE by default (Win95 only).
    • FTP service sometimes crashed, due to a memory overwrite.
    • Webmask=local did not work at all; fixed.
    • Windows source kit (console version) now provided.
  • Xitami 2.1a released 97/12/15 with these changes:
    • OS/2 CGI handling rewritten.
    • FTP service 'LIST' command now works in all cases.
    • FTP service now shows subdirectories in compact listing.
    • Server died if FTP was disabled and web-based console tried to display details of current connections - fixed.
    • Added 'Powered by Xitami' graphic to distribution (by Jptxs).
    • Added server:autostart config option (Windows 95 only).
    • Added server:limit option to restrict number of connections.
    • Added ftp:email-check config option.
    • Added ftp:webmask config option.
    • Changed cgi:dirlist option to default to 0.
    • Added [Filter] section and PerlSSI filter.
    • Added configurable welcome text for FTP server.
    • Added support for PHP as filter program (tested version 2).
    • Added timezone indication to log files.
    • Host name in redirected URLs now taken from Host: header if possible; this makes image maps work better with modern browsers.
    • Error 401 now returns HTML page correctly: previously this returned an empty page.
    • All error texts are predefined in the errors/ subdirectory.
    • Under Windows, taskbar menu works correctly in secure mode.
    • Web-based admin crashed on certain Unix systems.
    • Web-based admin crashed when using More... key on the user list file.
    • FTP aliases now supported.
    • ftp:http-alias option includes HTTP aliases in FTP aliases.
    • FTP user configuration file syntax changed slightly, and access rights can now be defined on a directory basis. LI>Works with CGI programs that do not produce a header.
    • CGI output sometimes failed on NT; this was fixed in 1.3 and broken again in 2.0. Fixed again!
    • cgi:exit-ok option now set to 0 by default.
    • Fixed a bug which crashed Xitami when you used Restart.
    • Better documentation of WSX protocol.
  • Xitami 2.0e released 97/10/11 with these changes:
    • Customised error messages now work correctly.
    • User-defined CGI directories was broken: fixed.
    • POSTed data was sometimes not being passed to admin screens.
    • Admin screens aborted in some configurations: fixed.
  • Xitami 2.0d released 97/10/07 with these changes:
    • Various corrections to the FTP service.
    • Various corrections to the UNIX kits.
  • Xitami 2.0c released 97/10/04 with these changes:
    • Windows control panel 'Setup' button did not work if a port other than 80 was used.
  • Xitami 2.0b released 97/09/30 with these changes:
    • Form POST data no longer passed as QUERY_STRING by default.
    • Form POST data no longer limited in size.
    • Supports RFC1867 form-based file uploads.
    • Added ability to run server on one specific IP address.
  • Xitami 2.0a released 97/09/15 for limited beta testing, with these changes:
    • Added FTP server.
    • Changed config handling so that you can change options on either the control panel or the config file (previously ignored webpages, cgi-bin, and portbase options in config file of primary host.
    • Authorisation now works on any URL, including '/'.
    • Webmasks extended to allow multiple combinations.
    • Aliases did not work with virtual hosts - fixed.
    • Added full logging of URL translation if server:debug set; this is useful when debugging complex virtual hosts.
    • New security:password-case option controls whether passwords are case-sensitive. (User names are always compared in lowercase.)
    • Security:dynamic option no longer applicable - removed.
    • Sometimes showed junk in error headers/footers from files.
    • 'Location:' header did not work in CGIs - fixed.
    • WinNT service did not recognise config files - fixed.
    • WinNT service died if specified with -r option - fixed.
    • WinNT control panel now runs in Xitami service directory.
    • Server died if run without a Xitami .cfg file; now works.
    • Server died if root directory was on an invalid drive - fixed.
    • Server died on URLs like "http://127.0.0.1/buttons.map' - fixed.
    • Server looped if URL argument contained accented chars - fixed.
    • Virtual host names containing a hyphen did not work - fixed.
    • You can now specify a password as "-", meaning 'not allowed'.
    • CGI output sometimes failed on fast NT systems - fixed.
    • CGI SCRIPT_NAME now works with normal and CGI aliases.
    • Custom.cfg renamed to defaults.cfg.
    • Added error simulation URL '/error?xxx'.
    • Added server:text-xxx options for customised HTTP error texts.
    • Added server:error-url option for error simulation.
    • Added cgi:stdio option to support Basic CGI programs.
    • Added cgi:dirlist option to control CGI directory lists.
    • Added server:base-host option for base host definition.
    • Added browser-based configuration screen via /admin URL.
    • Added win32:16bit-cgi option allows fast 32-bit CGIS.
    • Added win32:secure option to secure Windows control panel.
    • Added security:superuser password (default disabled).
    • Added [Console] configuration section.
    • Added [CGI-Alias] section for CGI aliases.
    • Added [WSX] section for web-server extensions, and added support for WSX to server kernel.
    • Sometimes failed on large forms - fixed.
    • Windows control panels completely redesigned.
  • Xitami 1.3c released 97/07/31 with these changes:
    • Alias handling cleaned-up; converts alias in URL to lowercase to match alias name (always lowercase).
    • CGI SCRIPT_NAME now compatible with MS IIS (starts with '/').
    • URLs can contain spaces (did not work with Netscape Navigator).
    • Would abort on incomplete requests like 'GET xxxxx'.
    • Virtual host server:cgi-dir option was not being used.
    • NT service control panel crashed if you started on port 0.
    • Added support for Visual Basic through CGI_STDIN and related environment variables.
  • Xitami 1.3b released 97/07/22 with these changes:
    • Windows control panel shows more statistics.
    • New [CGI-Environment] option for arbitrary CGI variables.
    • New server:hostname option for redirected URLs.
    • New [ErrorLog] section for HTTP errors.
    • Fixed various minor bugs with virtual host logic.
  • Xitami 1.3a released 97/07/16 with these changes:
    • New virtual hosts/multihoming facility.
    • New [Alias] option allows multiple document roots.
    • New webmask= option in xitami.aut lets you restrict access to a directory depending on the client's IP address.
    • New configuration scheme, custom.cfg, simplifies upgrading from older versions of Xitami.
    • New option 'cgi:workdir=-' means always use script directory.
    • New option 'server:cgi-url' defines '/cgi-bin' prefix.
    • Windows control panel now works correctly with the keyboard.
    • Improved REXX CGI support (*/ allowed on first line).
    • New CGI environment variable: SCRIPT_PATH.
    • CGI SCRIPT_NAME no longer includes the PATH_INFO.
    • Fixed bug: NT service version did not let you change the webpages or CGI directory.
    • Fixed bug: CGI script 'magic header' did not work fully.
    • Fixed bug: server could block while sending a file if the browser closed the connection during the transfer.
    • Fixed bug: "cgi:workdir" did not work under UNIX.
    • Fixed bug: no longer freezes-up if you change the clock.
    • Fixed bug: CGI URLs in map files can now have arguments.
    • Eliminated caching for default pages; browser now always shows correct page if you change the document root directory.
    • Keep-Alive default raised from 5 to 50.
    • Error-Header, Footer now reloaded for each 4xx response.
    • Added support for Midi MIME types (.mid, .rmi).
  • Xitami 1.2e released 97/06/16 with these changes:
    • Webpages directory can now be a disk drive, e.g. I:.
    • Added server:translate option for working on dynamic IP connections (e.g. PPP).
    • Added support for REXX CGIs using "/*!" magic header.
    • Xitami would sometimes freeze-up: this has been fixed.
    • You can now limit clients to a specific IP subnet mask.
    • CGI scripts (e.g. Perl) can use #! /usr/bin/perl header; the path is removed if it does not actually exist.
    • server:error-header/footer can come from a file.
  • Xitami 1.2d released 97/05/31 to correct a security hole in 1.2c; protected URLs could be accessed by supplying an empty username and password.
  • Xitami 1.2c released 97/05/28 with these changes:
    • Under 32-bit Windows, executable files can have any extension.
    • Now correctly asks for password when listing a directory.
    • Password protection also applied to CGI programs.
    • Keep-Alive did not work for some directory listings.
    • Closed security hole that allowed '...' in URLs.
    • Added REMOTE_HOST and REMOTE_ADDR variables for CGI.
    • Under Windows 95 & NT, CGI response-time was improved by an average of 500ms thanks to improved SFL timer functions.
    • New configuration option cgi:timeout specifies timeout for CGI programs. The cgi:monitor option specifies CGI monitor rate.
    • Sometimes gave file errors during rapid reloading of CGI programs; this has been improved.
    • You can now modify the xitami.aut file on-the-fly: it is refreshed every 60 seconds (by default) See server:refresh configuration option.
    • cgi:exit-ok controls whether CGI programs' exit code is checked or not.
    • Server crashed on some URLs (http://localhost/myfile.htm/); the server was treating these as directory names; fixed.
    • Server crashed when running CGI script if #! command did not exist as an executable file; fixed.
    • 'Browse' and 'Defaults' buttons added to Windows panels.
    • Improved error messages in Windows versions when there is a TCP/IP error; e.g. port in use or TCP/IP not installed.
    • Windows versions allow Terminate action at all times.
    • Relaxed HTTP header parsing to support more HTTP clients; headers may use either CRLF or LF end-of-line sequences.
  • Xitami 1.2b released 97/04/23 with these changes:
    • Improved Keep-Alive handling; sometimes failed.
    • Keep-Alive arguments are now configurable.
    • Sometimes died if very long URLs were used.
    • Windows NT control panel did not work.
  • Xitami 1.2a limited release with these changes:
    • Added server:portbaseN configuration option.
    • Keep-Alive works for CGI programs.
    • Allows non-CGI files in cgi-bin directory.
    • cgi:mixed-url controls non-CGI files in cgi-bin directory.
    • CGI stderr output logged to cgi:stderr file
    • Corrected access log file format, which had errors.
    • Output from CGI programs is now handled correctly.
    • Server occasionally aborted due to an assertion.
    • If-Modified-Since: header was not being used correctly.
  • Xitami 1.1b released 97/03/17 with these changes:
    • Improved use of 'cgi-bin' option; can now specify an absolute directory, and 'cgi-bin' can occur at any level in the URL path.
    • Added PATH_INFO variable for CGI programs.
    • Directory listings can be disabled.
    • Added support for user-defined MIME types.
    • Added support for absolute URLs in image maps.
    • Customisable CGI support.
    • Customisable server error pages.
    • Windows NT service control panel added.
    • Reduced CPU usage in 32-bit Windows versions.
    • Added support for Perl CGI programs under Windows and OS/2.
    • Added optional Xitami configuration file.
    • Auto reloading of configuration and authorization files when modified.
    • Hourly, daily, weekly, monthly cycling of log files.
    • Log files can be in any directory.
  • Xitami 1.0d released 97/02/23 with these changes:
    • Windows NT service version added.
    • 16-bit Windows version released.
    • Windows versions permit customised web pages and CGI directories; previously these were fixed.
    • Returns MIME type */* for unknown file types; previously returned text/html, which caused unknown files (such as zip files) to be shown as HTML text.
    • CGI programs get their arguments in the same way for GET methods as for PUT methods.
    • More variables passed to CGI programs.
    • Too-long requests are correctly handled, returning a 500 or 413 error code.
    • Xitami now tries port 5080 if 80 is unavailable (previous versions tried 8080, but this is commonly used for HTTP proxy servers).
    • A bug in previous versions allowed a user to browse into directories by adding '..' to the URL. This has been fixed.
  • Xitami 1.0c released 97/01/01 with various improvements:
    • Access log file using CERN/NCSA common log format.
    • Access log files automatically cycled.
    • Console log file kept separate from access log file.
  • Xitami 1.0b was released as a separate product in December 1996.
  • Xitami 1.0a was released as part of the SMT product in October 1996.

  ---

  | << | < | > | >> | Welcome To Xitami | Table Of Contents | Installing Xitami | Administration | Configuration | Using The Common Gateway Interface (CGI) | Server-Side Includes (SSI) | Using Filters | Server-Side XML Processing | Server-Side GSL Scripting | Image Maps | Virtual Hosts | The FTP Service | The Dynamic DNS Feature | Throttle Pipes | A Beginner's Guide | Writing Web Server Extension (WSX) Agents | Extending Xitami with External Peer Processes | FAQ | Getting Support | Credits | Release History | License Agreement

  Copyright © 1996-99 iMatix Corporation