WebKit 0.9.3 Release Notes

WebKit version 0.9.3 released on 04/26/07

Introduction

This release comprises a lot of small bugfixes, changes and cleanup in WebKit, in an attempt to straighten out some irregularities before the 1.0 version is released. Not all of these small changes can be listed here.

New Features

• It is now possible to set up custom error pages for HTTP errors and any other exceptions raised in Webware servlets. This is controlled by the ErrorPage setting in Application.config and described in the Configuration Guide.

Improvements and Refinements

• Added JSON-RPC base class and usage example (as suggested by Jean-Francois Pieronne).
• HTTPResponse now sends status code 500 in case an error has occurred (suggested by Veros Kaplan).
• Optimized uploading of large files with the built-in HTTPServer (as suggested by Dan Milstein).
• Some improvements, hints and updates for easier compilation of mod_webkit (renamed to mod_webkit1) and mod_webkit2. Created fresh mod_webkit.dll files for Windows.
• Do not move "one-shot sessions" (usually created by crawler bots) to FileStore on periodical clean-up (patch submitted by Veros Kaplan).
• Changed cleanStaleSessions() to iterate over the keys, rather than the items, so that it will not load all sessions into memory (patch submitted by Ben Parker).
• Made the request queue and buffer size and the response buffer size configurable via the settings RequestQueueSize, RequestBufferSize and ResponseBufferSize in AppServer.config.
• New methods SessionTimeout(), SessionPrefix(), SessionName() and SessionCookiePath() have been introduced, which can be replaced with variants which are dependent on the transaction. This can be used to implement a different behavior for different contexts (suggested by Michael Hanselmann).
• The Session and SessionStore classes are now configurable via the settings SessionModule and SessionStore in Application.config (as suggested by Ben Parker).
• If there is a root Docs context, then contexts for the Docs of all plug-ins are added automatically when they are loaded. The same mechanism was already used for the Examples context.

Security

• WebKit now by default uses the servlet path instead of root for the cookie path. This separates sessions if you run several applications in parallel and also improves the security of the application. You can change this by replacing the sessionCookiePath() method.
• Fixed security issue in HTTPExceptions: With older web browsers it could be exploited that the URI in the 404 page was not properly encoded (report with fix by Michael Hanselmann).
• Added some security measures against "JavaScript hijacking" to the JSON-RPC servlet base class (implemented by Jean-Francois Pieronne and Christoph Zwerschke).

Minor Changes

• Changed the names of the pid and address files for more consistency and clarity:

  old name	new name
  webkit.pid	unchanged
  appserverpid.txt	appserver.pid
  monitorpid.txt	monitor.pid
  address.text	adapter.address
  monitor.text	monitor.address
  http.text	http.address

Bugfixes

• ImportSpy (and thus the AutoReload feature) did not work correctly with Python 2.5.
• Using psp-handler for PSP pages outside a Webware context did not work; this has been fixed (bug report by Fionn Behrens).
• Fixed and improved CGIAdapter and OneShotAdapter (also solving the CGI Adapter problem reported by Mico Siahaan).
• Fixed a bug in HTTPRequest: empty FieldStorage is False (reported by Jean-Francois Pieronne).
• Fixed bug in normURL function (patch by Veros Kaplan).
• Fixed bug regarding aborted connections (reported by Stephan Diehl).
• Made sure servlets are always returned to their pool.