v2.4.6
caddyserver/caddyv2.4.6Nov 8, 2021by github-actions[bot]
AI Summary
A patch release containing security improvements for path matching and template enhancements, including new actions and placeholders for client certificates.
Key Highlights
- Security fix for path matching to normalize URI paths.
- New template actions `httpError` and `import`.
- New placeholder for client certificate DER base64 format.
- Enhanced `try_files` directive to accept `=nnn` status codes.
New Features
- New `httpError` template action.
- New `import` template action.
- New placeholder `{http.request.tls.client.certificate_der_base64}`.
- `try_files` now supports `=nnn` to yield specific HTTP status codes.
Full Release Notes
This release contains bug fixes and minor enhancements, including [one patch](https://github.com/caddyserver/caddy/pull/4407) with potential security implications related to path matching.
Notable patches:
- Path matchers unescape/clean URI paths to normalize match space
- Fix regex matching in `map` handler
Notable enhancements:
- `try_files` can now accept `=nnn` (e.g. `=404`) to yield a status code instead of a file.
- Template actions `httpError` (stop eval and return HTTP error) and `import` (like `include` but changes template context) were added
- New placeholder `{http.request.tls.client.certificate_der_base64}`
## Changelog
749e55c7 caddycmd: Add `--keep-backup` to upgrade commands (#4387)
062657d0 caddycmd: Add `--skip-standard` to `list-modules` command, quieter output (#4386)
be5f77e8 caddycmd: fix caddy validate/fmt help message (#4377)
907e2d8d caddyhttp: Add support for triggering errors from `try_files` (#4346)
cbb045a1 caddyhttp: Placeholder for client cert in DER + base64 format (#4241)
e7457b43 caddyhttp: Sanitize the path before evaluating path matchers (#4407)
837cdc56 caddyhttp: reverseproxy: clarify warning for -insecure (#4379)
24fda751 caddytls: Mark storage clean timestamp at end of routine (#4401)
a779e1b3 fastcgi: Fix Caddyfile parsing when `handle_response` is used (#4342)
3f2c3ecf fastcgi: Implement `try_files` override in Caddyfile directive (#4347)
64f8b557 fileserver: Fix compression breaks using httpInclude (#4352) (#4358)
d3a02599 fileserver: Fix displayed file size if it is symlink (#4354)
0a5f7a67 fileserver: Make file listing links purple once visited (#4356)
a21d5a00 fileserver: Prevent focusing filter from scrolling on page load (#4393)
33c70f41 fileserver: properly handle escaped/non-ascii paths (#4332)
c4790d7f go.mod: Carefully upgrade some dependencies (fix #4251)
997e41de go.mod: Replace promptui with Apache-compatible fork (fix #4394)
f376a38b go.mod: Update ACMEz and CertMagic
a4372066 headers: Canonicalize case in replace (fix #4330)
012d2353 httpcaddyfile: Empty tls policy for internal http localhost (#4398)
0ffb2229 httpcaddyfile: Preserve IPv6 addresses through normalization (fix #4381)
a2119c09 map: Fix 95c03506 (avoid repeated expansions)
95c03506 map: Fix regex mappings
3336faf2 reverseproxy: Log error at error level (fix #4360)
b0920615 reverseproxy: Prevent copying the response if a response handler ran (#4388)
f73f55db reverseproxy: Sanitize scheme and host on incoming requests (#4237)
5fda9610 templates: Add 'import' action (#4321)
16f75212 templates: Add tests for funcInclude and funcImport (#4357)
2392478b templates: Propagate httpError to HTTP response