-
Notifications
You must be signed in to change notification settings - Fork 22
/
CREDITS
123 lines (93 loc) · 5.91 KB
/
CREDITS
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
Peter Karman <[email protected]>, Ivo De Decker <[email protected]>
(the debian maintainer), and Deitmar Berg <[email protected]>
all supplied patches to update mod_auth_tkt to work with apache 2.4.
The 2.4 updates are based on their work.
Bearnard Hibbins <[email protected]> provided a cookie parsing fix for
when badly behaved proxy/cache servers strip whitespace from headers.
Scott Shambarger <[email protected]> added the TKTAuthGuestEmpty
directive, allowing guest access to set REMOTE_USER to "", which allows
some http-auth systems to fallback to another authenticator. He also
updated TKTAuthQuerySeparator to be a string (allowing better inheritance,
and fixed some minor compile/build issues.
David McNett <[email protected]> contributed example code for a
back-end login written in Tcl (for use with Apache Rivet). Available in
contrib/tcl.
Christian Folini <[email protected]> and an anonymous Swiss
bank sponsored the changes to include SHA256/SHA512 support, and to
integrate and test Michael Peters' TKTAuthSecretOld functionality. Version
2.0.99b1.
Michael Peters <[email protected]> provided a patch to support a
TKTAuthSecretOld fallback secret, to facilitate refreshing secrets without
losing existing sessions. Version 2.0.99b1.
Brian Kuschak <[email protected]> provided patches to convert relative
redirect URLs to absolute ones using current schema/hostinfo settings.
Sascha Hanssen <[email protected]> provided a ticket generator for Ruby on
Rails, included in the contrib directory. Version 2.0.0rc3.
Peter Karman <[email protected]>, Jose Luis Martinez <[email protected]>,
and Ton Voon <[email protected]> provided patches to Apache::AuthTkt to
allow it to parse and validate existing tickets. Version 2.0.0rc3.
Charlie Brady <[email protected]> provided patches to honour the
X-Forwarded-Host header in cookie domains and back references, if set (for use
behind a proxy). Version 2.0.0rc2.
Joost Cassee <[email protected]> provide a patch to port mod_auth_tkt to Apache
2.2 and provided help testing and debugging under that environment. Version
2.0.0rc2.
Philip Garrett <[email protected]> provided patches to implement the
TKTAuthGuestFallback functionlity, allowing validated users to fallback to
guests on ticket timeout. Version 2.0.0rc2.
Michael Peters <[email protected]> provided a patch to add an additional
TKTAuthTimeoutPostURL directive to allow timeouts on POSTs to be handled
differently (since redirects back aren't sensible). Suggested by Perrin
Hawkins. Version 2.0.0rc1.
Jay Kline <[email protected]> provided a patch to add an apachever argument
to configure (allowing mod_auth_tkt to be built with only an apache development
environment available), and provided patches to build a debian package. Version
2.0.0b8.
Larry Lansing <[email protected]> provided a patch to separate out secure
cookie functionality from TKTAuthRequireSSL flag to new TKTAuthCookieSecure
flag. Version 2.0.0b7.
Viljo Viitanen <[email protected]> provided patches to fix some URI
and HTML escaping problems in the sample cgi scripts. Version 2.0.0b7.
Christian Ramseyer <[email protected]> pointed out a couple of build problems on
Solaris and contributed fixes. Version 2.0.0b7.
Ian Bicking <[email protected]> provided patches for the excellent
TKTAuthGuestLogin functionality, for additional debug output with the
DEBUG_VERBOSE flag, and contributed a more complete python AuthTicket class. He
also identified a bug with non-base64 quoted ticket values not being parsed
correctly. Versions 2.0.0b5 and 2.0.0b6.
Viljo Viitanen <[email protected]> pointed out that using wildcard
cookie domains by default allowed hostile servers on a shared domain to steal
and reuse tickets. So the default is now to default to the server name only -
wildcard domains can easily be used, but must be done explicitly. Version
2.0.0b4.
Ian Bicking <[email protected]> patched configure to work with a less capable
getopt on FreeBSD, and provided patches to correct some non-ISO-C89 c-isms that
were causing problems for his gcc. Version 2.0.0b3.
Christian Klinger <[email protected]> contributed python code to generate
tickets, included in contrib/auth_ticket.pyc. Version 2.0.0b2.
Luc Germain and Marc-Andre Gaudreau at Universite de Sherbrooke contributed
code to generate tickets from php, included in contrib/auth_ticket.inc.php.
Version 2.0.0b2.
Andreas Leimbacher <[email protected]> submitted patches to fix some bogus
logging calls, to add secure cookie support to TktUtil.pm, and contributed a
configure script to improve the build process. Version 2.0.0b2.
Nick Cleaton <[email protected]> identified a significant vulnerability in the
calculation of the ticket md5 checksum, potentially allowing an attacker to
change or manipulate their username, tokens, and/or user data, and suggested a
change to the md5 checksum calculation to fix the problem. Version 2.0.0a1.
Joe Laffey <[email protected]> did a thorough security review of the code
and found buffer overflow vulnerabilities in both mod_auth_tkt itself and
tkt_cookie, and submitted patches to fix them. Version 1.3.11.
Matti Lattu <[email protected]> provided patches to implement the
TKTAuthRequireSSL directive, to require ssl and use secure ticket cookies.
Version 1.3.11.
Jason Burns <[email protected]> contributed code allowing tickets to be passed
via the url instead of via cookie, and suggested the initial framework about
how allowing multi-domain configurations might be able to work under
mod_auth_tkt. Version 1.3.9.
Christian Folini <[email protected]> submitted some great patches enabling
multiple TKTAuthToken directives allowing alternative tokens; adding the
strsep() function for use on Solaris; adding the scheme (http/https etc) when
generating back URLs; and suggested having user tokens made available to other
handlers (which lead to the REMOTE_USER_TOKENS env variable). Version 1.3.9.
# vim:tw=75