2015-12-24 00:38 ph3-der-loewe * Windows security fix: remove trailing dots in URI This addresses CVE-2005-0837 (sic!), which was sadly ignored after ticket #635 got closed erroneously. * Linux/Unix installations were never affected, Windows only release! * Impact is low: most installations run default XSLT files and there is nothing to be learned in such a case. Also a majority of production Icecast servers don't run on Windows. 2015-04-08 10:07:42 dm8tbr * apply fix for documentation (needed by distro packaging) 2015-04-08 09:09:26 ph3-der-loewe * Fix: Do not crash URL Auth is used with stream_auth and no credentials are given. This fixes a crash (NULL reference) in case URL Auth is used and stream_auth is trigged with no credentials passed by the client. Username and password is now set to empty strings and transmited to the backend server this way. See #2191 for more details and to keep track of the problem. Closes: #2191, DEB#782120 2015-04-08 09:02:20 ph3-der-loewe * Fix: Let util_url_escape() handle NULL parameter. This lets util_url_escape() handle NULL passed as parameter. In case the parameter is NULL it will also return NULL. This patch also does some cleanup of the code such as migration away from int and thus avoiding future failures. 2015-04-08 08:32:23 dm8tbr * update version number to 2.4.2 in preparation for release this will be a strict security release 2015-04-08 08:18:40 dm8tbr * applying curl fix for win32 from master 2014-11-19 13:42:23 dm8tbr * This is Spaaarrr^w Icecast 2.4.1! 2014-11-19 13:41:09 dm8tbr * Makefile.am and configure.in for new docs 2014-11-19 12:18:49 dm8tbr * Removing unmaintained RPM spec file 2014-11-19 11:30:58 ePirat * Set PATH_MAX to 4096 if not defined (patch by Svante Signell ) See: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=767542 2014-11-18 19:57:21 ePirat * Docs: 2.4.1 docs added 2014-11-18 10:17:16 ePirat * fix for memory errors when using a lot of headers 2014-11-18 08:51:03 dm8tbr * Comments in break things ATM. Moved the comment out to avoid this bug. Needs to be checked. 2014-11-17 19:20:57 ph3-der-loewe * subset of earlier patch so it can go into 2.4.1: disconnects stdio of scripts from server owned filehandles. * This is considered a security fix: if on-connect/on-disconnect scripts are used, file descriptors of the server process remain open and could be written to or read from. Most pressing STDIN, STDOUT, STDERR are handled. Further all file descriptors up to 1024 are closed. There is a remaining (much lower) risk in combination of either a malicious or susceptible script and FDs above 1024. 2014-11-10 10:46:55 ph3-der-loewe * patch to fix regression on header size with large headers introduced by support of and . This should ensure we have at least space for 2kB of extra headers. Depending on function and call we may have much more space. 2014-11-10 08:23:34 dm8tbr * Update minimal config to also contain ACAO * header 2014-11-10 06:25:15 dm8tbr * Update default config: SSL, headers, default-mount 2014-11-09 10:55:29 dm8tbr * Updated default openSSL cipher string * https://wiki.mozilla.org/Security/Server_Side_TLS#Intermediate_compatibility_.28default.29 * same Qualys result 2014-11-09 09:13:59 dm8tbr * Clean up default config 2014-11-08 16:23:26 dm8tbr * Applying patch by ph3-der-loewe, HTTP PUT requires content-type * In case of SOURCE we are lenient and thus quite some source clients don't send a proper content-type, especially if they only support mp3. * This was meant to be introduced in 2.4.0 already, sadly we missed it. * All source clients MUST send proper content-type after migrating to Icecast HTTP PUT protocol. 2014-11-08 13:34:45 ph3-der-loewe * Fixed regression introduced in r18356 (CVE-2011-4612): client duration time is now correctly logged. PRIu64 MUST NOT be used with log_write_direct() as depending on platform PRIu64 may be using something not supported by __vsnprintf() of log/log.c. 2014-11-08 12:28:17 ph3-der-loewe * make use of sizeof() not explicit magic numbers 2014-11-07 23:10:43 ph3-der-loewe * fixing some compiler warnings 2014-11-07 22:06:06 ph3-der-loewe * updated some copyright headers 2014-11-07 20:56:04 ph3-der-loewe * fix for %z on win*. hope it doesn't breaky anything else. 2014-11-07 19:14:28 ph3-der-loewe * added warnings on empty and default values of , , , and 2014-11-07 11:18:54 ph3-der-loewe * send errorlog (loglevel WARN) to stderr prior to opening the real logfiles. 2014-11-07 10:12:24 ph3-der-loewe * added support for type="" and status="" in
(subelement of ). 2014-11-07 02:55:57 ph3-der-loewe * Added support for within . Also support merging of headers (normal mount + default mount). 2014-11-07 01:40:28 ph3-der-loewe * handle empty strings in config file better. Now empty strings are handled in: accesslog, errorlog, logdir, webroot, adminroot and hopefully all kinds of port. 2014-11-07 00:56:02 ph3-der-loewe * initial patch to allow adding user defined headers 2014-11-06 23:55:58 ph3-der-loewe * coding style and typo correcion 2014-11-06 12:02:00 dm8tbr * Be more verbose in case of fileserve off 2014-11-05 10:09:07 dm8tbr * applied patch to update the default ciphers to be more secure * tested this successfully against https://www.ssllabs.com/ssltest/ 2014-11-03 19:34:10 ph3-der-loewe * applied patch to disable SSLv3 and SSL compression explicitly 2014-11-02 20:19:29 dm8tbr * fix JSON status API problems * Put the last item check into every filtered tag. * This way we shouldn't run into problems of this type anymore. * Also it should be easier to customize this way, if someone wants to filter differently. 2014-10-31 09:00:45 ph3-der-loewe * rename ICE_LISTEN_QUEUE, ICE_RUNNING and ICE_HALTING so they have a prefix of ICECAST_ 2014-10-31 08:46:58 ph3-der-loewe * LOG_{ERROR|WARN|INFO|DEBUG}() -> ICECAST_LOG_{ERROR|WARN|INFO|DEBUG}() * avoid collision with LOG_INFO that is defined as part of syslog. 2014-10-26 14:03:57 ph3-der-loewe * make in work if no is given. 2014-10-23 20:41:38 epirat * More detailed logging * Add source IP adress to startup and source exit logging * Add mountpoint to some log lines 2014-10-18 16:25:29 ph3-der-loewe * fix warnings, mostly related to win*-builds 2014-10-09 10:39:13 ph3-der-loewe * Replace the old logging macros with variadic argument macros. (patch by ePirat) 2014-07-23 16:55:57 dm8tbr * removed threadpool from example config it is long gone and unused 2014-07-23 10:20:47 dm8tbr * Fix autogen.sh to work properly on Mac OS * Applying patch by ePirat 2014-05-06 05:23:42 dm8tbr * This is Icecast 2.4.0! 2014-05-06 04:53:24 dm8tbr * SECURITY FIX - Override supplementary groups if 2014-05-05 05:16:44 dm8tbr * Added