 @@ -1,282 +1,282 @@
-# $NetBSD: Makefile,v 1.45 2009/06/04 08:51:52 tron Exp $
+# $NetBSD: Makefile,v 1.46 2009/06/11 20:30:58 tron Exp $
 DISTNAME=	httpd-2.2.11
-PKGREVISION=	4
+PKGREVISION=	5
 PKGNAME=	${DISTNAME:S/httpd/apache/}
 CATEGORIES=	www
 MASTER_SITES=	${MASTER_SITE_APACHE:=httpd/} \
 		${MASTER_SITE_APACHE:=httpd/old/}
 EXTRACT_SUFX=	.tar.bz2
 MAINTAINER=	tron@NetBSD.org
 HOMEPAGE=	http://httpd.apache.org/
 COMMENT=	Apache HTTP (Web) server, version 2.2
 LICENSE=	apache-2.0
 PKG_DESTDIR_SUPPORT=	user-destdir
 CONFLICTS=	apache-{,*ssl}-[0-9]* apache6-[0-9]*
 BUILD_DEFS+=	IPV6_READY
 BUILD_DEFS+=	VARBASE
 USE_TOOLS+=		pax perl perl:run pkg-config
 USE_LIBTOOL=		yes
 GNU_CONFIGURE=		yes
 CONFIGURE_ARGS+=	--enable-layout=NetBSD
 CONFIGURE_ARGS+=	--with-port=80
 CONFIGURE_ARGS+=	--enable-so
 CONFIGURE_ENV+=		perlbin=${PERL5:Q}
 CONFIGURE_ENV+=		ac_cv_path_RSYNC=/nonexistent
 CONFIGURE_ARGS+=       CFLAGS=${APACHE_CUSTOM_CFLAGS:Q}
 BUILD_DEFS+=           APACHE_CUSTOM_CFLAGS
 # Apache Portable Runtime library configure options
 CONFIGURE_ARGS+=	--with-apr=${BUILDLINK_PREFIX.apr}
 CONFIGURE_ARGS+=	--with-apr-util=${BUILDLINK_PREFIX.apr-util}
 CHECK_INTERPRETER_SKIP+=	lib/httpd/httpd.exp
 CHECK_PORTABILITY_SKIP+=	srclib/pcre/* \
 				srclib/apr-util/* \
 				srclib/apr/*
 # the following must be set before bsd.prefs.mk in order to make += work
 # in mk.conf; however, it isn't expanded until referenced, so we can
 # define DFLT_APACHE_MODULES later
+#
 APACHE_MODULES?=	${DFLT_APACHE_MODULES}
 .include "../../mk/bsd.prefs.mk"
 .include "../../devel/apr/buildlink3.mk"
 .include "../../devel/apr-util/buildlink3.mk"
 .include "../../textproc/expat/buildlink3.mk"
 .include "../../mk/dlopen.buildlink3.mk"
 # Set the "Multi-Processing Model" used by Apache to handle requests.
 # Valid values are:
 # 	event		multi-threaded based in worker, designed
 # 			to allow more requests to be served
 # 			simultaneously by passing off some processing
 # 			work to supporting threads.
 # 			BEWARE: does not work with SSL or input filters.
 #	prefork		non-threaded, pre-forking web server
 #	worker		hybrid multi-threaded multi-process web server
+#
 APACHE_MPM?=		prefork
 CONFIGURE_ARGS+=	--with-mpm=${APACHE_MPM:Q}
 BUILD_DEFS+=		APACHE_MPM
 .if !empty(APACHE_MPM:Mevent) || !empty(APACHE_MPM:Mworker)
 PLIST_SRC+=		${PKGDIR}/PLIST.worker
 .endif
 CONFIGURE_ARGS+=	--disable-include
 CONFIGURE_ARGS+=	--disable-log-config
 CONFIGURE_ARGS+=	--disable-env
 CONFIGURE_ARGS+=	--disable-mime
 CONFIGURE_ARGS+=	--disable-setenvif
 CONFIGURE_ARGS+=	--disable-status
 CONFIGURE_ARGS+=	--disable-autoindex
 CONFIGURE_ARGS+=	--disable-asis
 CONFIGURE_ARGS+=	--disable-cgi
 CONFIGURE_ARGS+=	--disable-negotiation
 CONFIGURE_ARGS+=	--disable-dir
 CONFIGURE_ARGS+=	--disable-actions
 CONFIGURE_ARGS+=	--disable-userdir
 CONFIGURE_ARGS+=	--disable-alias
 DFLT_APACHE_MODULES=	all
 DFLT_APACHE_MODULES+=	proxy proxy_connect proxy_ftp proxy_http
 DFLT_APACHE_MODULES+=	ssl deflate access auth authn_alias
 DFLT_APACHE_MODULES+=	include log_config env mime setenvif
 DFLT_APACHE_MODULES+=	status autoindex asis cgi negotiation dir imap
 DFLT_APACHE_MODULES+=	actions userdir alias isapi file_cache
 DFLT_APACHE_MODULES+=	cache disk_cache mem_cache bucketeer echo
 DFLT_APACHE_MODULES+=	example case_filter case_filter_in
 DFLT_APACHE_MODULES+=	charset_lite
 DFLT_APACHE_MODULES+=	cgid dav_lock proxy_ajp proxy_balancer
 PLIST_SRC+=		${PKGDIR}/PLIST
 .include "options.mk"
 # LDAP support
 PLIST_VARS+=		ldap
 .if !empty(PKG_BUILD_OPTIONS.apr-util:Mldap)
 DFLT_APACHE_MODULES+=	ldap authnz_ldap
 .  if !empty(PKG_OPTIONS:Mapache-shared-modules)
 PLIST.ldap=		yes
 .  endif
 .endif
 APACHE_USER?=		www
 APACHE_GROUP?=		www
 PKG_GROUPS=		${APACHE_GROUP}
 PKG_USERS=		${APACHE_USER}:${APACHE_GROUP}
 PKG_GROUPS_VARS+=	APACHE_GROUP
 PKG_USERS_VARS+=	APACHE_USER
 PKG_SYSCONFVAR=		apache
 PKG_SYSCONFSUBDIR?=	httpd
 EGDIR=			${PREFIX}/share/examples/httpd
 SBINDIR=		${PREFIX}/sbin
 CONF_FILES+=		${EGDIR}/httpd.conf ${PKG_SYSCONFDIR}/httpd.conf
 .for f in autoindex dav default info languages manual mpm \
 	  multilang-errordoc ssl userdir vhosts
 CONF_FILES+=		${EGDIR}/extra/httpd-${f}.conf \
 				${PKG_SYSCONFDIR}/httpd-${f}.conf
 .endfor
 CONF_FILES+=		${EGDIR}/magic ${PKG_SYSCONFDIR}/magic
 CONF_FILES+=		${EGDIR}/mime.types ${PKG_SYSCONFDIR}/mime.types
 RCD_SCRIPTS=		apache
 REQD_DIRS=		${PREFIX}/share/httpd
 REQD_DIRS+=		${PREFIX}/share/httpd/htdocs
 OWN_DIRS= 		${VARBASE}/log/httpd
 OWN_DIRS+=		${VARBASE}/db/httpd
 OWN_DIRS_PERMS+=	${VARBASE}/db/httpd/proxy ${APACHE_USER} ${APACHE_GROUP} 0755
 FIX_PERMS=		apachectl apxs dbmmanage envvars-std mkcert
 FIX_MAN_PERMS=		man1/htdbm.1 man1/htpasswd.1 man1/htdigest.1
 FIX_MAN_PERMS+=		man1/dbmmanage.1 man8/httpd.8 man8/suexec.8
 FIX_MAN_PERMS+=		man8/rotatelogs.8 man8/logresolve.8 man8/apxs.8
 FIX_MAN_PERMS+=		man8/apachectl.8 man8/ab.8
 # Fix paths in the apache manpages.
 SUBST_CLASSES+=		man
 SUBST_STAGE.man=	post-patch
 SUBST_FILES.man=	docs/man/*.1 docs/man/*.8
 SUBST_SED.man=		-e 's,/usr/local/etc/apache,${PKG_SYSCONFDIR},'
 SUBST_SED.man+=		-e 's,/path/to/apache/etc,${PKG_SYSCONFDIR},'
 SUBST_SED.man+=		-e 's,/usr/local/apache2,${PREFIX}/share/httpd/htdocs,'
 SUBST_SED.man+=		-e 's,/usr/web,${PREFIX}/share/httpd/htdocs,'
 SUBST_CLASSES+=		paths
 SUBST_STAGE.paths=	pre-configure
 SUBST_FILES.paths=	config.layout Makefile.in support/apxs.in
 SUBST_SED.paths=	-e "s|@PREFIX@|${PREFIX}|g"
 SUBST_SED.paths+=	-e "s|@VARBASE@|${VARBASE}|g"
 SUBST_SED.paths+=	-e "s|@SYSCONFDIR@|${PKG_SYSCONFDIR}|g"
 SUBST_SED.paths+=	-e "s|@PAX@|${PAX}|g"
 SUBST_SED.paths+=	-e "s|@LOCALBASE@|${LOCALBASE}|g"
 SUBST_MESSAGE.paths=	Fixing paths.
 SUBST_CLASSES+=		apr-lt
 SUBST_STAGE.apr-lt=	post-configure
 SUBST_FILES.apr-lt=	build/config_vars.mk
 SUBST_SED.apr-lt=	-e 's|^\(LIBTOOL =\) [^ ]*|\1 $$(SHELL) $$(top_builddir)/build/libtool|g'
 SUBST_MESSAGE.apr-lt=	Fixing libtool references.
 SUBST_CLASSES+=		confs
 SUBST_STAGE.confs=	post-configure
 SUBST_MESSAGE.confs=	Fixing configuration files.
 SUBST_FILES.confs=	docs/conf/httpd.conf
 SUBST_FILES.confs+=	docs/conf/extra/httpd-ssl.conf
 SUBST_SED.confs=	-e "s|${EGDIR}|${PKG_SYSCONFDIR}|g"
 SUBST_SED.confs+=	-e "s|${PREFIX}/htdocs|${PREFIX}/share/httpd/htdocs|g"
 SUBST_SED.confs+=	-e "s|${PREFIX}/conf|${PKG_SYSCONFDIR}|g"
 SUBST_SED.confs+=	-e "s|logs/|${VARBASE}/log/httpd/|g"
 SUBST_SED.confs+=	-e 's|/var/log/httpd/foo\.log|logs/foo.log/|g'
 SUBST_SED.confs+=	-e 's|^\(User[	 ]\).*|\1${APACHE_USER}|g'
 SUBST_SED.confs+=	-e 's|^\(Group[	 ]\).*|\1${APACHE_GROUP}|g'
 # abs_srcdir in config_vars.mk is used during install so needs to reference
 # the work dir path, and by other packages such as ap2-fastcgi after install,
 # so we fix after install to reference the installed path
 SUBST_CLASSES+=		abs_srcdir
 SUBST_STAGE.abs_srcdir=	post-install
 SUBST_FILES.abs_srcdir=	${DESTDIR}${PREFIX}/share/httpd/build/config_vars.mk
 SUBST_SED.abs_srcdir=	-e 's|^\(abs_srcdir =\) .*|\1 ${PREFIX}/share/httpd|'
 SUBST_MESSAGE.abs_srcdir=	Fixing abs_srcdir
 REPLACE_PERL=		docs/cgi-examples/printenv
 # Add dependencies for the modules that will be built.  For each module
 # ap_mod listed in ${APACHE_MODULES}, _AP_DEPENDS.ap_mod is a whitespace
 # separated list of dependencies or buildlink3.mk files needed to build
 # ap_mod, and _AP_CFG_ARGS.ap_mod is a whitespace separated list of
 # configure script options for ap_mod.
+#
 AP_DEPENDS.ssl=	../../security/openssl/buildlink3.mk
 AP_DEPENDS.deflate=	../../devel/zlib/buildlink3.mk
 AP_CFG_ARGS.ssl=	--with-ssl=${BUILDLINK_PREFIX.openssl}
 AP_CFG_ARGS.deflate=	--with-z=${BUILDLINK_PREFIX.zlib}
 #.if ${APACHE_MODULES} == "all-shared"
 .if !empty(PKG_OPTIONS:Mapache-shared-modules)
 .include "${AP_DEPENDS.ssl}"
 .include "${AP_DEPENDS.deflate}"
 CONFIGURE_ARGS+=	${AP_CFG_ARGS.ssl} ${AP_CFG_ARGS.deflate}
 .else
 .for ap_mod in ${APACHE_MODULES}
 .  if defined(AP_DEPENDS.${ap_mod}) && !empty(AP_DEPENDS.${ap_mod})
 .    for ap_depend in ${AP_DEPENDS.${ap_mod}}
 .      if exists(${ap_depend})
 .        include "${ap_depend}"
 .      else
 DEPENDS+=		${ap_depend}
 .      endif
 .    endfor
 .  endif
 .  if defined(AP_CFG_ARGS.${ap_mod}) && !empty(AP_CFG_ARGS.${ap_mod})
 CONFIGURE_ARGS+=	${AP_CFG_ARGS.${ap_mod}}
 .  endif
 .endfor
 .endif
 post-extract:
 	${TOUCH} ${WRKSRC}/build/libtool
 	${ECHO} "" >> ${WRKSRC}/docs/conf/extra/httpd-languages.conf.in
 post-build:
 	${SED} "s#@PKG_SYSCONFDIR@#${PKG_SYSCONFDIR}#g"			\
 		< ${FILESDIR}/mkcert.sh > ${WRKDIR}/mkcert
 INSTALL_TARGET=		install-conf install
 INSTALL_MAKE_FLAGS+=	sysconfdir="${EGDIR}"
 post-install:
 	${LN} -sf ${LOCALBASE}/libexec/apr/libtool ${DESTDIR}${PREFIX}/share/httpd/build
 	cd ${DESTDIR}${EGDIR} &&					\
 	for file in							\
 		httpd.conf						\
 		extra/httpd-ssl.conf;					\
 	do								\
 		${AWK} '						\
 			/^Listen[ 	]*80/	{			\
 				printf "%s", "Listen 0.0.0.0:80\n";	\
 				next;					\
 			}						\
 			/^Listen[ 	]*443/	{			\
 				printf "%s", "Listen 0.0.0.0:443\n";	\
 				next;					\
 			}						\
 			{ print; }					\
 			' < "$${file}" >> $${file}.new;			\
 		${MV} -f $${file}.new $${file};				\
 	done
 	${LN} -sf ${SBINDIR}/envvars-std ${DESTDIR}${SBINDIR}/envvars
 	${INSTALL_SCRIPT} ${WRKDIR}/mkcert ${DESTDIR}${PREFIX}/sbin
 	for file in ${FIX_PERMS}; do \
 		${CHOWN} ${BINOWN}:${BINGRP} ${DESTDIR}${PREFIX}/sbin/$$file && \
 		${CHMOD} ${BINMODE} ${DESTDIR}${PREFIX}/sbin/$$file; \
 	done
 	${CHOWN} -R ${BINOWN}:${BINGRP} ${DESTDIR}${PREFIX}/share/httpd
 	${CHOWN} -R ${BINOWN}:${BINGRP} ${DESTDIR}${PREFIX}/include/httpd
 	${CHOWN} -R ${BINOWN}:${BINGRP} ${DESTDIR}${PREFIX}/lib/httpd
 	${CHOWN} ${BINOWN}:${BINGRP} ${DESTDIR}${PREFIX}/libexec/cgi-bin/test-cgi
 	${CHOWN} ${BINOWN}:${BINGRP} ${DESTDIR}${PREFIX}/libexec/cgi-bin/printenv
 	for file in ${FIX_MAN_PERMS}; do \
 		${CHOWN} ${MANOWN}:${MANGRP} ${DESTDIR}${PREFIX}/${PKGMANDIR}/$$file; \
 	done
 	${CHMOD} -x ${DESTDIR}${PREFIX}/sbin/envvars-std
 	${TEST} ! -f ${DESTDIR}${PREFIX}/sbin/suexec || ${CHMOD} -w ${DESTDIR}${PREFIX}/sbin/suexec
 .include "../../mk/bsd.pkg.mk"

 @@ -1,23 +1,22 @@
-$NetBSD: distinfo,v 1.19 2009/06/04 08:51:52 tron Exp $
+$NetBSD: distinfo,v 1.20 2009/06/11 20:30:58 tron Exp $
 SHA1 (httpd-2.2.11.tar.bz2) = 7af256d53b79342f82222bd7b86eedbd9ac21d9a
 RMD160 (httpd-2.2.11.tar.bz2) = b2012af716a459f666e0e41eb04808bd0f7fc28d
 Size (httpd-2.2.11.tar.bz2) = 5230130 bytes
 SHA1 (patch-aa) = 40f5f687a1217b8d6684dc610d3d4c430f635cbf
 SHA1 (patch-ab) = d5391ca1af9d817d35cb472b0feb05b86a95e560
 SHA1 (patch-ac) = 515043b5c215d49fe8f6d3191b502c978e2a2dad
 SHA1 (patch-ad) = 088d6ff0e7a8acfe70b4f85a6ce58d42c935fd13
 SHA1 (patch-ae) = 86b307d6eefef232b6223afc3f69e64be40bd913
 SHA1 (patch-ag) = 78dcb023f524ef65928b529320932c9664ec0d01
 SHA1 (patch-ai) = 4ebc3bd580a298973928eb6d13d2ce745eac0312
 SHA1 (patch-al) = 56b9f5c2f6fd01fe5067f9210e328cbf674c68f1
 SHA1 (patch-am) = ab4a2f7e5a1a3064e908b61157e7fd349c0b0c08
 SHA1 (patch-aq) = 27a0093fc75dcafc673abc25e9ebe80167f52ac1
 SHA1 (patch-as) = 7880eae75b702563bff8bca833ca81fb3dc4444c
 SHA1 (patch-au) = d4c623bb953ac45cb4c8d95fc1d3c2788452d9a1
 SHA1 (patch-av) = faf8fe2c72c7830daa407907b8161b56300afeaf
 SHA1 (patch-aw) = ca53d67beeb2c2c4d9adb04d3d79e24a8c427fd4
-SHA1 (patch-ba) = fad28e9305c46ec27efdf51f9a4103b870c51be0
+SHA1 (patch-ba) = ab9984391fcdda9c9793009290d95de8ec2a1371
-SHA1 (patch-bb) = a577c9ab28dd6cb2ec0805cadb3650709d960c7e
+SHA1 (patch-bc) = f980d98f1b0ee277d995e3be0f5e55622ebc3931
-SHA1 (patch-bc) = f7f17cd31dfb0f0522933a3ef662f5a4f201dc12
+SHA1 (patch-bd) = 66f882a4d8c884e5422e025ed175a17412b02fd4
 SHA1 (patch-bd) = 88b156067ea75196b1d82587c439c2cf524656cf

 @@ -1,35 +1,42 @@
-$NetBSD: patch-ba,v 1.1 2009/06/04 08:51:52 tron Exp $
+$NetBSD: patch-ba,v 1.2 2009/06/11 20:30:59 tron Exp $
 Patch for CVE-2009-1195 taken from:
-http://svn.apache.org/viewvc/httpd/httpd/trunk/include/http_core.h?r1=739382&r2=772997&pathrev=772997
+http://svn.apache.org/viewvc?view=rev&revision=773881
 http://svn.apache.org/viewvc?view=rev&revision=779472
 --- include/http_core.h.orig	2008-02-26 19:47:51.000000000 +0000
-+++ include/http_core.h	2009-06-04 09:39:58.000000000 +0100
++++ include/http_core.h	2009-06-11 20:53:26.000000000 +0100
 @@ -65,7 +65,7 @@
  #define OPT_NONE 0
  /** Indexes directive */
  #define OPT_INDEXES 1
 -/**  Includes directive */
 +/** SSI is enabled without exec= permission  */
  #define OPT_INCLUDES 2
  /**  FollowSymLinks directive */
  #define OPT_SYM_LINKS 4
-@@ -73,14 +73,14 @@
+@@ -80,9 +80,22 @@
  #define OPT_EXECCGI 8
  /**  directive unset */
  #define OPT_UNSET 16
 -/**  IncludesNOEXEC directive */
 -#define OPT_INCNOEXEC 32
 +/**  SSI exec= permission is permitted, iff OPT_INCLUDES is also set */
 +#define OPT_INC_WITH_EXEC 32
  /** SymLinksIfOwnerMatch directive */
  #define OPT_SYM_OWNER 64
  /** MultiViews directive */
  #define OPT_MULTI 128
  /**  All directives */
 -#define OPT_ALL (OPT_INDEXES|OPT_INCLUDES|OPT_SYM_LINKS|OPT_EXECCGI)
-+#define OPT_ALL (OPT_INDEXES|OPT_INCLUDES|OPT_INC_WITH_EXEC|OPT_SYM_LINKS|OPT_EXECCGI)
++#define OPT_ALL (OPT_INDEXES|OPT_INCLUDES|OPT_INCNOEXEC|OPT_SYM_LINKS|OPT_EXECCGI)
  /** @} */
 +#ifdef CORE_PRIVATE
 +/* For internal use only - since 2.2.12, the OPT_INCNOEXEC bit is
 + * internally replaced by OPT_INC_WITH_EXEC.  The internal semantics
 + * of the two SSI-related bits are hence:
 + *
 + *  OPT_INCLUDES => "enable SSI, without exec= permission"
 + *  OPT_INC_WITH_EXEC => "iff OPT_INCLUDES is set, also enable exec="
 + *
 + * The set of options exposed via ap_allow_options() retains the
 + * semantics of OPT_INCNOEXEC by flipping the bit. */
 +#define OPT_INC_WITH_EXEC OPT_INCNOEXEC
 +#endif
++
  /**
   * @defgroup get_remote_host Remote Host Resolution
   * @ingroup APACHE_CORE_HTTPD

 @@ -1,35 +1,35 @@
-$NetBSD: patch-bc,v 1.1 2009/06/04 08:51:52 tron Exp $
+$NetBSD: patch-bc,v 1.2 2009/06/11 20:30:59 tron Exp $
 Patch for CVE-2009-1195 taken from:
-http://svn.apache.org/viewvc/httpd/httpd/trunk/server/config.c?r1=759924&r2=772997&pathrev=772997
+http://svn.apache.org/viewvc?view=rev&revision=773881
 --- server/config.c.orig	2008-12-02 22:28:21.000000000 +0000
 +++ server/config.c	2009-06-04 09:44:24.000000000 +0100
 @@ -1510,7 +1510,7 @@
      parms.temp_pool = ptemp;
      parms.server = s;
      parms.override = (RSRC_CONF | OR_ALL) & ~(OR_AUTHCFG | OR_LIMIT);
 -    parms.override_opts = OPT_ALL | OPT_INCNOEXEC | OPT_SYM_OWNER | OPT_MULTI;
 +    parms.override_opts = OPT_ALL | OPT_SYM_OWNER | OPT_MULTI;
      parms.config_file = ap_pcfg_open_custom(p, "-c/-C directives",
                                              &arr_parms, NULL,
 @@ -1617,7 +1617,7 @@
      parms.temp_pool = ptemp;
      parms.server = s;
      parms.override = (RSRC_CONF | OR_ALL) & ~(OR_AUTHCFG | OR_LIMIT);
 -    parms.override_opts = OPT_ALL | OPT_INCNOEXEC | OPT_SYM_OWNER | OPT_MULTI;
 +    parms.override_opts = OPT_ALL | OPT_SYM_OWNER | OPT_MULTI;
      rv = ap_pcfg_openfile(&cfp, p, fname);
      if (rv != APR_SUCCESS) {
 @@ -1755,7 +1755,7 @@
      parms.temp_pool = ptemp;
      parms.server = s;
      parms.override = (RSRC_CONF | OR_ALL) & ~(OR_AUTHCFG | OR_LIMIT);
 -    parms.override_opts = OPT_ALL | OPT_INCNOEXEC | OPT_SYM_OWNER | OPT_MULTI;
 +    parms.override_opts = OPT_ALL | OPT_SYM_OWNER | OPT_MULTI;
      parms.limited = -1;
      errmsg = ap_walk_config(conftree, &parms, s->lookup_defaults);

 @@ -1,62 +1,22 @@
-$NetBSD: patch-bd,v 1.1 2009/06/04 08:51:52 tron Exp $
+$NetBSD: patch-bd,v 1.2 2009/06/11 20:30:59 tron Exp $
 Patch for CVE-2009-1195 taken from:
-http://svn.apache.org/viewvc/httpd/httpd/trunk/server/core.c?r1=759699&r2=772997&pathrev=772997
+http://svn.apache.org/viewvc?view=rev&revision=773881
 http://svn.apache.org/viewvc?view=rev&revision=779472
---- server/core.c.orig	2008-06-02 22:18:18.000000000 +0100
+--- server/core.c.orig	2009-06-11 20:51:15.000000000 +0100
-+++ server/core.c	2009-06-04 09:46:04.000000000 +0100
++++ server/core.c	2009-06-11 21:01:04.000000000 +0100
-@@ -108,8 +108,7 @@
+@@ -659,7 +659,11 @@
-     conf->opts = dir ? OPT_UNSET : OPT_UNSET|OPT_ALL;
+     core_dir_config *conf =
-     conf->opts_add = conf->opts_remove = OPT_NONE;
+       (core_dir_config *)ap_get_module_config(r->per_dir_config, &core_module);
      conf->override = dir ? OR_UNSET : OR_UNSET|OR_ALL;
 -    conf->override_opts = OPT_UNSET | OPT_ALL | OPT_INCNOEXEC | OPT_SYM_OWNER
 -                          | OPT_MULTI;
 +    conf->override_opts = OPT_UNSET | OPT_ALL | OPT_SYM_OWNER | OPT_MULTI;
-     conf->content_md5 = 2;
+-    return conf->opts;
-     conf->accept_path_info = 3;
++    /* Per comment in http_core.h - the OPT_INC_WITH_EXEC bit is
-@@ -242,8 +241,13 @@
++     * inverted, such that the exposed semantics match that of
-         conf->opts_remove = (conf->opts_remove & ~new->opts_add)
++     * OPT_INCNOEXEC; i.e., the bit is only enabled if exec= is *not*
-                             | new->opts_remove;
++     * permitted. */
-         conf->opts = (conf->opts & ~conf->opts_remove) | conf->opts_add;
++    return conf->opts ^ OPT_INC_WITH_EXEC;
 -        if ((base->opts & OPT_INCNOEXEC) && (new->opts & OPT_INCLUDES)) {
 -            conf->opts = (conf->opts & ~OPT_INCNOEXEC) | OPT_INCLUDES;
  AP_DECLARE(int) ap_allow_overrides(request_rec *r)
 +        /* if Includes was enabled without exec in the new config, but
 +         * was enabled with exec in the base, then disable exec in the
 +         * resulting options. */
 +        if ((base->opts & OPT_INC_WITH_EXEC)
 +            && (new->opts & OPT_INC_WITH_EXEC) == 0) {
 +            conf->opts &= ~OPT_INC_WITH_EXEC;
      else {
@@ -1304,10 +1308,12 @@
              opt = OPT_INDEXES;
          else if (!strcasecmp(w, "Includes")) {
 -            opt = OPT_INCLUDES;
 +            /* If Includes is permitted, both Includes and
 +             * IncludesNOEXEC may be changed. */
 +            opt = (OPT_INCLUDES | OPT_INC_WITH_EXEC);
          else if (!strcasecmp(w, "IncludesNOEXEC")) {
 -            opt = (OPT_INCLUDES | OPT_INCNOEXEC);
 +            opt = OPT_INCLUDES;
          else if (!strcasecmp(w, "FollowSymLinks")) {
              opt = OPT_SYM_LINKS;
@@ -1428,10 +1434,10 @@
              opt = OPT_INDEXES;
          else if (!strcasecmp(w, "Includes")) {
 -            opt = OPT_INCLUDES;
 +            opt = (OPT_INCLUDES | OPT_INC_WITH_EXEC);
          else if (!strcasecmp(w, "IncludesNOEXEC")) {
 -            opt = (OPT_INCLUDES | OPT_INCNOEXEC);
 +            opt = OPT_INCLUDES;
          else if (!strcasecmp(w, "FollowSymLinks")) {
              opt = OPT_SYM_LINKS;