<!--
 File        :  $Source: /cvsroot/ijbswa/current/doc/source/changelog.sgml,v $

 Purpose     :  Entity included in other project documents.

 $Id: changelog.sgml,v 2.16 2016/01/22 10:20:48 fabiankeil Exp $

 Copyright (C) 2013 Privoxy Developers http://www.privoxy.org/
 See LICENSE.

 ======================================================================
  This file used for inclusion with other documents only.
 ======================================================================

 If you make changes to this file, please verify the finished
 docs all display as intended.

 This file is included into:

  user-manual
-->

<para>
  <application>Privoxy 3.0.24</application> stable contains a couple
  of new features but is mainly a bug-fix release. Two of the fixed
  bugs are security issues and may be used to remotely trigger crashes
  on platforms that carefully check memory accesses (most don't).
</para>

<!--
 The SGML ChangeLog can be generated with: utils/changelog2doc.pl ChangeLog
-->
<para>

<para>
 <itemizedlist>
  <listitem>
   <para>
    Security fixes (denial of service):
    <itemizedlist>
    <listitem>
     <para>
      Prevent invalid reads in case of corrupt chunk-encoded content.
      CVE-2016-1982. Bug discovered with afl-fuzz and AddressSanitizer.
     </para>
    </listitem>
    <listitem>
     <para>
      Remove empty Host headers in client requests.
      Previously they would result in invalid reads. CVE-2016-1983.
      Bug discovered with afl-fuzz and AddressSanitizer.
     </para>
     </listitem>
    </itemizedlist>
   </para>
  </listitem>
  <listitem>
   <para>
    Bug fixes:
    <itemizedlist>
    <listitem>
     <para>
      When using socks5t, send the request body optimistically as well.
      Previously the request body wasn't guaranteed to be sent at all
      and the error message incorrectly blamed the server.
      Fixes #1686 reported by Peter Müller and G4JC.
     </para>
    </listitem>
    <listitem>
     <para>
      Fixed buffer scaling in execute_external_filter() that could lead
      to crashes. Submitted by Yang Xia in #892.
     </para>
    </listitem>
    <listitem>
     <para>
      Fixed crashes when executing external filters on platforms like
      Mac OS X. Reported by Jonathan McKenzie on ijbswa-users@.
     </para>
    </listitem>
    <listitem>
     <para>
      Properly parse ACL directives with ports when compiled with HAVE_RFC2553.
      Previously the port wasn't removed from the host and in case of
      'permit-access 127.0.0.1 example.org:80' Privoxy would try (and fail)
      to resolve "example.org:80" instead of example.org.
      Reported by Pak Chan on ijbswa-users@.
     </para>
    </listitem>
    <listitem>
     <para>
      Check requests more carefully before serving them forcefully
      when blocks aren't enforced. Privoxy always adds the force token
      at the beginning of the path, but would previously accept it anywhere
      in the request line. This could result in requests being served that
      should be blocked. For example in case of pages that were loaded with
      force and contained JavaScript to create additionally requests that
      embed the origin URL (thus inheriting the force prefix).
      The bug is not considered a security issue and the fix does not make
      it harder for remote sites to intentionally circumvent blocks if
      Privoxy isn't configured to enforce them.
      Fixes #1695 reported by Korda.
     </para>
    </listitem>
    <listitem>
     <para>
      Normalize the request line in intercepted requests to make rewriting
      the destination more convenient. Previously rewrites for intercepted
      requests were expected to fail unless $hostport was being used, but
      they failed "the wrong way" and would result in an out-of-memory
      message (vanilla host patterns) or a crash (extended host patterns).
      Reported by "Guybrush Threepwood" in #1694.
     </para>
    </listitem>
    <listitem>
     <para>
      Enable socket lingering for the correct socket.
      Previously it was repeatedly enabled for the listen socket
      instead of for the accepted socket. The bug was found by
      code inspection and did not cause any (reported) issues.
     </para>
    </listitem>
    <listitem>
     <para>
      Detect and reject parameters for parameter-less actions.
      Previously they were silently ignored.
     </para>
    </listitem>
    <listitem>
     <para>
      Fixed invalid reads in internal and outdated pcre code.
      Found with afl-fuzz and AddressSanitizer.
     </para>
    </listitem>
    <listitem>
     <para>
      Prevent invalid read when loading invalid action files.
      Found with afl-fuzz and AddressSanitizer.
     </para>
    </listitem>
    <listitem>
     <para>
      Windows build: Use the correct function to close the event handle.
      It's unclear if this bug had a negative impact on Privoxy's behaviour.
      Reported by Jarry Xu in #891.
     </para>
    </listitem>
    <listitem>
     <para>
      In case of invalid forward-socks5(t) directives, use the
      correct directive name in the error messages. Previously they
      referred to forward-socks4t failures.
      Reported by Joel Verhagen in #889.
     </para>
     </listitem>
    </itemizedlist>
   </para>
  </listitem>
  <listitem>
   <para>
    General improvements:
    <itemizedlist>
    <listitem>
     <para>
      Set NO_DELAY flag for the accepting socket. This significantly reduces
      the latency if the operating system is not configured to set the flag
      by default. Reported by Johan Sintorn in #894.
     </para>
    </listitem>
    <listitem>
     <para>
      Allow to build with mingw x86_64. Submitted by Rustam Abdullaev in #135.
     </para>
    </listitem>
    <listitem>
     <para>
      Introduce the new forwarding type 'forward-webserver'.
      Currently it is only supported by the forward-override{} action and
      there's no config directive with the same name. The forwarding type
      is similar to 'forward', but the request line only contains the path
      instead of the complete URL.
     </para>
    </listitem>
    <listitem>
     <para>
      The CGI editor no longer treats 'standard.action' special.
      Nowadays the official "standards" are part of default.action
      and there's no obvious reason to disallow editing them through
      the cgi editor anyway (if the user decided that the lack of
      authentication isn't an issue in her environment).
     </para>
    </listitem>
    <listitem>
     <para>
      Improved error messages when rejecting intercepted requests
      with unknown destination.
     </para>
    </listitem>
    <listitem>
     <para>
      A couple of log messages now include the number of active threads.
     </para>
    </listitem>
    <listitem>
     <para>
      Removed non-standard Proxy-Agent headers in HTTP snipplets
      to make testing more convenient.
     </para>
    </listitem>
    <listitem>
     <para>
      Include the error code for pcre errors Privoxy does not recognize.
     </para>
    </listitem>
    <listitem>
     <para>
      Config directives with numerical arguments are checked more carefully.
     </para>
    </listitem>
    <listitem>
     <para>
      Privoxy's malloc() wrapper has been changed to prevent zero-size
      allocations which should only occur as the result of bugs.
     </para>
    </listitem>
    <listitem>
     <para>
      Various cosmetic changes.
     </para>
     </listitem>
    </itemizedlist>
   </para>
  </listitem>
  <listitem>
   <para>
    Action file improvements:
    <itemizedlist>
    <listitem>
     <para>
      Unblock ".deutschlandradiokultur.de/".
      Reported by u302320 in #924.
     </para>
    </listitem>
    <listitem>
     <para>
      Add two fast-redirect exceptions for "yandex.ru".
     </para>
    </listitem>
    <listitem>
     <para>
      Disable filter{banners-by-size} for ".plasmaservice.de/".
     </para>
    </listitem>
    <listitem>
     <para>
      Unblock "klikki.fi/adv/".
     </para>
    </listitem>
    <listitem>
     <para>
      Block requests for "resources.infolinks.com/".
      Reported by "Black Rider" on ijbswa-users@.
     </para>
    </listitem>
    <listitem>
     <para>
      Block a bunch of criteo domains.
      Reported by Black Rider.
     </para>
    </listitem>
    <listitem>
     <para>
      Block "abs.proxistore.com/abe/".
      Reported by Black Rider.
     </para>
    </listitem>
    <listitem>
     <para>
      Disable filter{banners-by-size} for ".black-mosquito.org/".
     </para>
    </listitem>
    <listitem>
     <para>
      Disable fast-redirects for "disqus.com/".
     </para>
     </listitem>
    </itemizedlist>
   </para>
  </listitem>
  <listitem>
   <para>
    Documentation improvements:
    <itemizedlist>
    <listitem>
     <para>
      FAQ: Explicitly point fingers at ASUS as an example of a
      company that has been reported to force malware based on
      Privoxy upon its customers.
     </para>
    </listitem>
    <listitem>
     <para>
      Correctly document the action type for a bunch of "multi-value"
      actions that were incorrectly documented to be "parameterized".
      Reported by Gregory Seidman on ijbswa-users@.
     </para>
    </listitem>
    <listitem>
     <para>
      Fixed the documented type of the forward-override{} action
      which is obviously 'parameterized'.
     </para>
     </listitem>
    </itemizedlist>
   </para>
  </listitem>
  <listitem>
   <para>
    Website improvements:
    <itemizedlist>
    <listitem>
     <para>
      Users who don't trust binaries served by SourceForge
      can get them from a mirror. Migrating away from SourceForge
      is planned for 2016 (TODO list item #53).
     </para>
    </listitem>
    <listitem>
     <para>
      The website is now available as onion service
      (http://jvauzb4sb3bwlsnc.onion/).
     </para>
     </listitem>
    </itemizedlist>
   </para>
  </listitem>
 </itemizedlist>
</para>
