<commit_before><?xml version="1.0" encoding="UTF-8"?>
<!--
  Licensed to the Apache Software Foundation (ASF) under one or more
  contributor license agreements.  See the NOTICE file distributed with
  this work for additional information regarding copyright ownership.
  The ASF licenses this file to You under the Apache License, Version 2.0
  (the "License"); you may not use this file except in compliance with
  the License.  You may obtain a copy of the License at

      http://www.apache.org/licenses/LICENSE-2.0

  Unless required by applicable law or agreed to in writing, software
  distributed under the License is distributed on an "AS IS" BASIS,
  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  See the License for the specific language governing permissions and
  limitations under the License.
-->
<!DOCTYPE document [
  <!ENTITY project SYSTEM "project.xml">
]>
<?xml-stylesheet type="text/xsl" href="tomcat-docs.xsl"?>
<document url="changelog.html">

  &project;

  <properties>
    <title>Changelog</title>
    <no-comments />
  </properties>

<body>
<!--
  Subsection ordering:
  General, Catalina, Coyote, Jasper, Cluster, WebSocket, Web applications,
  Extras, Tribes, jdbc-pool, Other

  Item Ordering:

  Fixes having an issue number are sorted by their number, ascending.

  There is no ordering by add/update/fix.

  Other fixed issues are added to the end of the list, chronologically.
  They eventually become mixed with the numbered issues. (I.e., numbered
  issues to not "pop up" wrt. others).
-->
<section name="Tomcat 8.0.15 (markt)">
  <subsection name="Catalina">
    <changelog>
      <add>
        <bug>43548</bug>: Add an XML schema for the tomcat-users.xml file.
        (markt)
      </add>
      <add>
        <bug>43682</bug>: Add support for referring to the current context, host
        and service name in per Context logging.properties files by using the
        properties <code>${classloader.webappName}</code>,
        <code>${classloader.hostName}</code> and
        <code>${classloader.serviceName}</code>. (markt)
      </add>
      <add>
        <bug>47919</bug>: Extend the information logged when Tomcat starts to
        optionally include (enabled by default) the values of key environment
        variables. (markt)
      </add>
      <add>
        <bug>49939</bug>: Expose the method that clears the static resource
        cache for a web application via JMX. (markt)
      </add>
      <fix>
        <bug>55951</bug>: Allow cookies to use UTF-8 encoded values in HTTP
        headers. This requires the use of the RFC6265
        <strong>CookieProcessor</strong>. (markt)
      </fix>
      <fix>
        <bug>55984</bug>: Using the allow separators in version 0 cookies option
        with the legacy cookie processor should only apply to version 0 cookies.
        Version 1 cookies with values that contain separators should not be
        affected and should continue to be quoted. (markt)
      </fix>
      <add>
        <bug>56393</bug>: Add support for RFC6265 cookie parsing and generation.
        This is currently disabled by default and may be enabled via the
        <strong>CookieProcessor</strong> element of a <strong>Context</strong>.
        (markt)
      </add>
      <add>
        <bug>56394</bug>: Introduce new configuration element CookieProcessor in
        Context to allow context-specific configuration of cookie processing
        options. Attributes of Context element that were added in Tomcat 8.0.13
        to allow configuration of a new experimental RFC6265 based cookie parser
        (<code>useRfc6265</code> and <code>cookieEncoding</code>) are
        replaced by this new configuration element. (markt)
      </add>
      <fix>
        Improve the previous fix for <bug>56401</bug>. Avoid logging version
        information in the constructor since it then gets logged at undesirable
        times such as when using <code>StoreConfig</code>. (markt)
      </fix>
      <fix>
        <bug>56403</bug>: Add pluggable password derivation support to the
        Realms via the new <code>CredentialHandler</code> interface.
        (markt/schultz)
      </fix>
      <fix>
        <bug>57016</bug>: When using the <code>PersistentValve</code> do not
        remove sessions from the store when persisting them. (markt)
      </fix>
      <add>
        Deprecate the use of system proprties to control cookie parsing and
        replace them with attributes on the new <code>CookieProcessor</code>
        that may be configured on a per context basis. (markt)
      </add>
      <fix>
        Correct an edge case and allow a cookie if the value starts with an
        equals character and the <code>CookieProcessor</code> is not configured
        to allow equals characters in cookie values but is configured to allow
        name only cookies. (markt)
      </fix>
      <fix>
        <bug>57022</bug>: Ensure SPNEGO authentication continues to work with
        the JNDI Realm using delegated credentials with recent Oracle JREs.
        (markt)
      </fix>
      <fix>
        <bug>57027</bug>: Add additional validation for stored credentials used
        by Realms when the credential is stored using hex encoding. (markt)
      </fix>
      <fix>
        <bug>57038</bug>: Add a <code>WebResource.getCodeBase()</code> method,
        implement for all <code>WebResource</code> implementations and then use
        it in the web application class loader to set the correct code base for
        resources loaded from JARs and WARs. (markt)
      </fix>
      <fix>
        Correct a couple of NPEs in the JNDI Realm that could be triggered with
        when not specifying a roleBase and enabling roleSearchAsUser. (markt)
      </fix>
      <fix>
        Correctly handle relative values for the docBase attribute of a Context.
        (markt)
      </fix>
      <fix>
        Ensure that log messages generated by the web application class loader
        correctly identify the associated Context when multiple versions of a
        Context with the same path are present. (markt)
      </fix>
      <fix>
        Remove the unnecessary registration of context.xml as a redeploy
        resource. The context.xml having an external docBase has already been
        registered as a redeploy resource at first. (kfujino)
      </fix>
      <fix>
        <bug>57089</bug>: Ensure that configuration of a session ID generator is
        not lost when a web application is reloaded. (markt)
      </fix>
    </changelog>
  </subsection>
  <subsection name="Coyote">
    <changelog>
      <add>
        <bug>53952</bug>: Add support for TLSv1.1 and TLSv1.2 for APR connector.
        Based upon a patch by Marcel &#352;ebek. (schultz/jfclere)
      </add>
      <scode>
        Cache the <code>Encoder</code> instances used to convert Strings to byte
        arrays in the Connectors (e.g. when writing HTTP headers) to improve
        throughput. (markt)
      </scode>
      <add>
        Disable SSLv3 by default for JSSE based HTTPS connectors (BIO, NIO and
        NIO2). The change also ensures that SSLv2 is disabled for these
        connectors although SSLv2 should already be disabled by default by the
        JRE. (markt)
      </add>
      <add>
        Disable SSLv3 by default for the APR/native HTTPS connector. (markt)
      </add>
    </changelog>
  </subsection>
  <subsection name="Jasper">
    <changelog>
      <fix>
        <bug>57099</bug>: Ensure that semi-colons are not permitted in JSP
        import page directives. (markt)
      </fix>
    </changelog>
  </subsection><commit_msg>Note that using SSLProtocol="TLSv1.1,TLSv1.2" requires native 1.1.32 or later. Running with 1.1.31 is OK as long as the new values are not used in configuration.<commit_after><?xml version="1.0" encoding="UTF-8"?>
<!--
  Licensed to the Apache Software Foundation (ASF) under one or more
  contributor license agreements.  See the NOTICE file distributed with
  this work for additional information regarding copyright ownership.
  The ASF licenses this file to You under the Apache License, Version 2.0
  (the "License"); you may not use this file except in compliance with
  the License.  You may obtain a copy of the License at

      http://www.apache.org/licenses/LICENSE-2.0

  Unless required by applicable law or agreed to in writing, software
  distributed under the License is distributed on an "AS IS" BASIS,
  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  See the License for the specific language governing permissions and
  limitations under the License.
-->
<!DOCTYPE document [
  <!ENTITY project SYSTEM "project.xml">
]>
<?xml-stylesheet type="text/xsl" href="tomcat-docs.xsl"?>
<document url="changelog.html">

  &project;

  <properties>
    <title>Changelog</title>
    <no-comments />
  </properties>

<body>
<!--
  Subsection ordering:
  General, Catalina, Coyote, Jasper, Cluster, WebSocket, Web applications,
  Extras, Tribes, jdbc-pool, Other

  Item Ordering:

  Fixes having an issue number are sorted by their number, ascending.

  There is no ordering by add/update/fix.

  Other fixed issues are added to the end of the list, chronologically.
  They eventually become mixed with the numbered issues. (I.e., numbered
  issues to not "pop up" wrt. others).
-->
<section name="Tomcat 8.0.15 (markt)">
  <subsection name="Catalina">
    <changelog>
      <add>
        <bug>43548</bug>: Add an XML schema for the tomcat-users.xml file.
        (markt)
      </add>
      <add>
        <bug>43682</bug>: Add support for referring to the current context, host
        and service name in per Context logging.properties files by using the
        properties <code>${classloader.webappName}</code>,
        <code>${classloader.hostName}</code> and
        <code>${classloader.serviceName}</code>. (markt)
      </add>
      <add>
        <bug>47919</bug>: Extend the information logged when Tomcat starts to
        optionally include (enabled by default) the values of key environment
        variables. (markt)
      </add>
      <add>
        <bug>49939</bug>: Expose the method that clears the static resource
        cache for a web application via JMX. (markt)
      </add>
      <fix>
        <bug>55951</bug>: Allow cookies to use UTF-8 encoded values in HTTP
        headers. This requires the use of the RFC6265
        <strong>CookieProcessor</strong>. (markt)
      </fix>
      <fix>
        <bug>55984</bug>: Using the allow separators in version 0 cookies option
        with the legacy cookie processor should only apply to version 0 cookies.
        Version 1 cookies with values that contain separators should not be
        affected and should continue to be quoted. (markt)
      </fix>
      <add>
        <bug>56393</bug>: Add support for RFC6265 cookie parsing and generation.
        This is currently disabled by default and may be enabled via the
        <strong>CookieProcessor</strong> element of a <strong>Context</strong>.
        (markt)
      </add>
      <add>
        <bug>56394</bug>: Introduce new configuration element CookieProcessor in
        Context to allow context-specific configuration of cookie processing
        options. Attributes of Context element that were added in Tomcat 8.0.13
        to allow configuration of a new experimental RFC6265 based cookie parser
        (<code>useRfc6265</code> and <code>cookieEncoding</code>) are
        replaced by this new configuration element. (markt)
      </add>
      <fix>
        Improve the previous fix for <bug>56401</bug>. Avoid logging version
        information in the constructor since it then gets logged at undesirable
        times such as when using <code>StoreConfig</code>. (markt)
      </fix>
      <fix>
        <bug>56403</bug>: Add pluggable password derivation support to the
        Realms via the new <code>CredentialHandler</code> interface.
        (markt/schultz)
      </fix>
      <fix>
        <bug>57016</bug>: When using the <code>PersistentValve</code> do not
        remove sessions from the store when persisting them. (markt)
      </fix>
      <add>
        Deprecate the use of system proprties to control cookie parsing and
        replace them with attributes on the new <code>CookieProcessor</code>
        that may be configured on a per context basis. (markt)
      </add>
      <fix>
        Correct an edge case and allow a cookie if the value starts with an
        equals character and the <code>CookieProcessor</code> is not configured
        to allow equals characters in cookie values but is configured to allow
        name only cookies. (markt)
      </fix>
      <fix>
        <bug>57022</bug>: Ensure SPNEGO authentication continues to work with
        the JNDI Realm using delegated credentials with recent Oracle JREs.
        (markt)
      </fix>
      <fix>
        <bug>57027</bug>: Add additional validation for stored credentials used
        by Realms when the credential is stored using hex encoding. (markt)
      </fix>
      <fix>
        <bug>57038</bug>: Add a <code>WebResource.getCodeBase()</code> method,
        implement for all <code>WebResource</code> implementations and then use
        it in the web application class loader to set the correct code base for
        resources loaded from JARs and WARs. (markt)
      </fix>
      <fix>
        Correct a couple of NPEs in the JNDI Realm that could be triggered with
        when not specifying a roleBase and enabling roleSearchAsUser. (markt)
      </fix>
      <fix>
        Correctly handle relative values for the docBase attribute of a Context.
        (markt)
      </fix>
      <fix>
        Ensure that log messages generated by the web application class loader
        correctly identify the associated Context when multiple versions of a
        Context with the same path are present. (markt)
      </fix>
      <fix>
        Remove the unnecessary registration of context.xml as a redeploy
        resource. The context.xml having an external docBase has already been
        registered as a redeploy resource at first. (kfujino)
      </fix>
      <fix>
        <bug>57089</bug>: Ensure that configuration of a session ID generator is
        not lost when a web application is reloaded. (markt)
      </fix>
    </changelog>
  </subsection>
  <subsection name="Coyote">
    <changelog>
      <add>
        <bug>53952</bug>: Add support for TLSv1.1 and TLSv1.2 for APR connector.
        Based upon a patch by Marcel &#352;ebek. This feature requires
        Tomcat Native library 1.1.32 or later. (schultz/jfclere)
      </add>
      <scode>
        Cache the <code>Encoder</code> instances used to convert Strings to byte
        arrays in the Connectors (e.g. when writing HTTP headers) to improve
        throughput. (markt)
      </scode>
      <add>
        Disable SSLv3 by default for JSSE based HTTPS connectors (BIO, NIO and
        NIO2). The change also ensures that SSLv2 is disabled for these
        connectors although SSLv2 should already be disabled by default by the
        JRE. (markt)
      </add>
      <add>
        Disable SSLv3 by default for the APR/native HTTPS connector. (markt)
      </add>
    </changelog>
  </subsection>
  <subsection name="Jasper">
    <changelog>
      <fix>
        <bug>57099</bug>: Ensure that semi-colons are not permitted in JSP
        import page directives. (markt)
      </fix>
    </changelog>
  </subsection>
{'fraction_non_alphanumeric': 0.08198413210346385, 'fraction_numerical': 0.018061020447655292, 'mean_word_length': 2.657466383581033, 'pattern_counts': {'":': 0, '<': 291, '<?xml version=': 2, '>': 291, 'https://': 0, 'lorem ipsum': 0, 'www.': 2, 'xml': 12}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2854693', 'n_tokens_mistral': 4398, 'n_tokens_neox': 4177, 'n_words': 1798}