This is a live mirror of the Perl 5 development currently hosted at https://github.com/perl/perl5
Upgrade to CGI-3.20
[perl5.git] / lib / CGI / Changes
CommitLineData
adb86593
SP
1 Version 3.20
2 1. Patch from David Wheeler for CGI::Cookie->bake(). Uses mod_perl headers_out->add()
3 rather than headers_out->set().
4 2. Fixed problem identified by Andrei Voronkov in which start_form() output was screwed
5 up when initial argument begins with a dash and subsequent arguments do not.
6 3. Quashed uninitialized variable warnings coming from script_name(), url() and other
7 functions that require access to the PATH_INFO environment variable.
8
cb3b230c
SP
9 Version 3.19
10 1. Added patch from Stephen Frost that allows one to suppress use of the temp file that is
11 created during uploads.
12 2. Fixed problem noted by Martin Foster in which regular expression meta-character terms
13 in the path information were not quoted, causing URL parsing
14 to fail on URLs that contained metacharacters (such as +).
15 3. More fixes to the url() method.
16 4. Removed "hack to fix broken PATH_INFO in MSII".
17
18 Version 3.18
19 1. Doc typo fixes.
20 2. Patch from Steve Peters to default the document type to match the charset.
21 3. Fixed param() so that param(-name=>'foo',-values=>[]) sets the parameter to empty list.
22
55b5d700
SP
23 Version 3.16 Wed Feb 8 13:29:11 EST 2006
24 1. header() -charset option now works even when the MIME type is not "text".
25 2. Fixed documentation for cookie() function and fastCGI.
26 3. Upload filehandles now only closed automatically on Windows systems.
27 4. Apache::Cookie compatibility fix from David Wheeler
28 5. CGI::Carp->fatalsToBrowser() does not work correctly with
29 mod_perl 2. No workaround is known.
30 6. Fixed text status code associated with 302 redirects. Should be "Found"
31 but was "Moved".
32 7. Fixed charset in start_html() and header() to be in synch.
33
edc47407
SP
34 Version 3.15 Wed Dec 7 15:13:22 EST 2005
35 1. Remove extraneous "?" from self_url() when URI contains a ? but no query string.
36
1f426928
SP
37 Version 3.14 Tue Dec 6 17:12:03 EST 2005
38 1. Fixed broken scrolling_list() select attribute.
39
0a9bdad4
SP
40 Version 3.13
41 1. Removed extraneous empty "?" from end of self_url().
42
43 Version 3.12
44 1. Fixed virtual_port so that it works properly with https protocol.
45 2. Fixed documentation for upload_hook().
46 3. Added POSTDATA documentation.
47 4. Made upload_hook() work in function-oriented mode.
48 5. Fixed POST_MAX behavior so that it doesn't cause client to hang.
49 6. Disabled automatic tab indexes and added new -tabindex pragma to
50 turn automatic indexes back on.
51 7. The url() and self_url() methods now work better in the context of Apache
52 mod_rewrite. Be advised that path_info() may give you confusing results
53 when mod_rewrite is active because Apache calculates the path info *after*
54 rewriting. This is mostly worked around in url() and self_url(), but you
55 may notice some anomalies.
56 8. Removed empty (and non-validating) <div> from code emitted by end_form().
57 9. Fixed CGI::Carp to work correctly with Mod_perl 1.29 in an Apache 2 environment.
58 10. Setting $CGI::TMPDIRECTORY should now be effective.
59
7dc108d1
SP
60 Version 3.11
61 1. Killed warning in CGI::Cookie about MOD_PERL_API_VERSION
62 2. Fixed append() so that it works in function mode.
63 3. Workaround for a bug that appears in Apache2 versions through 2.0.54
64 in which SCRIPT_NAME and PATH_INFO are incorrect if the additional path_info
65 contains a double slash. This workaround will handle the common case of
66 http://mysite.com/cgi-bin/log.cgi/http://www.some.other.site/args, but will
67 not handle the uncommon case of a ScriptAlias directive that adds additional
68 path information to the end of the translated URI.
69
70194bd6
NC
70 Version 3.10
71 1. Added Apache2::RequestIO, which is necessary for mp2 interoperability.
72
73 Version 3.09
74 1. Fixed tabindex="0" when using CGI to create forms without a prior start_html
75 2. Removed warning about non-numeric MOD_PERL_API_VERSION.
76
741ff09d
RGS
77 Version 3.08
78 1. update support for mod_perl 2.0. versions prior to
79 mod_perl 1.999_22 (2.0.0-RC5) are no longer supported.
80
976c4ade
RGS
81 Version 3.07
82 1. Fixed typo in mod_perl detection.
83
84 Version 3.06
85
86 1. Fixed bare call to script() in start_html
87 2. Moved Fh::DESTROY out of autoloaded functions so as to avoid
88 clobbering $@ when CGI functions are executed in an eval{}
89 context.
90 3. mod_perl 2.0 version detection patch in CGI::Cookie provided by
91 Allen Day.
92 4. autoEscape() flag is now respected when generating extra
93 attributes.
94 5. Tests for *tag start/end generation from Shlomi Fish.
95 6. Support for can() method provided by Ron Savage.
96 7. Fix for lang='' when outputting XHTML.
97 8. Added support for chunked transfer encoding, as suggested by
98 Hakan Ardo
99 9. Fixed clobbering of row and column headers in tableized radio
100 and checkbox groups, as reported by Nicolas Thierry-Mieg.
101 10. <Label> tags are now associated with form elements, as suggested
102 by accessibility guidelines.
103 11. The <?xml> directive produced by start_html is now turned off by
104 default and the charset is specified in a <meta> directive. Apparently
105 IE6 (and maybe some versions of Opera) were getting confused by this.
106 12. Support for tab indexes.
107 13. Retired the HTML docs. The POD docs are now primary documentation.
108 14. CGI::Carp now correctly detects and handles Apache::Dispatch.
109 15. CGI::Util::utf8_chr now correctly sets the UTF8 flag on 5.006 or
110 higher perls (fix courtesy Slaven Rezic).
111
112
113 Version 3.05
114
115 1. Fixed uninitialized variable warning on start_form() when running
116 from command line.
117 2. Fixed CGI::_set_attributes so that attributes with a - are handled
118 correctly.
119 3. Fixed CGI::Carp::die() so as to avoid problems from _longmess()
120 clobbering @_.
121 4. If HTTP_X_FORWARDED_HOST is defined (i.e. running under a proxy),
122 the various functions that return HOST will use that instead.
123 5. Fix for undefined utf8() call in CGI::Util.
124 6. Changed the call to warningsToBrowser() in
125 CGI::Carp::fatalsToBrowser to call only after HTTP header is sent
126 (thanks to Didier Lebrun for noticing).
127 7. Patches from Dan Harkless to make CGI.pm validatable against HTML
128 3.2.
129 8. Fixed an extraneous "foo=bar" appearing when extra style
130 parameters passed to start_html;
131 9. Fixed cross-site scripting bug in startform() pointed out by Dan
132 Harkless.
133 10. Fixed documentation to discuss list context behavior of
134 form-element generators explicitly.
135 11. Fixed incorrect results from end_form() when called in OO manner.
136 12. Fixed query string stripping in order to handle URLs containing
137 escaped newlines.
138 13. During server push, set NPH to 0 rather than 1. This is supposed
139 to fix problems with Apache.
140 14. Fixed incorrect processing of multipart form fields that contain
141 embedded quotes. There's still the issue of how to handle ones
142 that contain embedded semicolons, but no one has complained (yet).
143 15. Fixed documentation bug in -style argument to start_html()
144 16. Added -status argument to redirect().
145
146 Version 3.04
147
148 1. Fixed the problem with mod_perl crashing when "defaults" button
149 pressed.
150
151 Version 3.03
152
153 1. Fix upload hook functionality
154 2. Workaround for CGI->unescape_html()
155 3. Bumped version numbers in CGI::Fast and CGI::Util for 5.8.3-tobe
156
157 Version 3.02
158
159 1. Bring in Apache::Response just in case.
160 2. File upload on EBCDIC systems now works.
161
162 Version 3.01
163
164 1. No fix yet for upload failures when running on EBCDIC server.
165 2. Fixed uninitialized glob warnings that appeared when file
166 uploading under perl 5.8.2.
167 3. Added patch from Schlomi Fish to allow debugging of PATH_INFO from
168 command line.
169 4. Added patch from Steve Hay to correctly unlink tmp files under
170 mod_perl/windows
171 5. Added upload_hook functionality from Jamie LeTaul
172 6. Workarounds for mod_perl 2 IO issues. Check that file upload and
173 state saving still working.
174 7. Added code for underreads.
175 8. Fixed misleading description of redirect() and relative URLs in
176 the POD docs.
177 9. Workaround for weird interaction of CGI::Carp with Safe module
178 reported by William McKee.
179 10. Added patches from Ilmari Karonen to improve behavior of
180 CGI::Carp.
181 11. Fixed documentation error in -style argument.
182 12. Added virtual_port() method for finding out what port server is
183 listening on in a virtual-host aware fashion.
184
185 Version 3.00
186
187 1. Patch from Randal Schwartz to fix bug introduced by cross-site
188 scripting vulnerability "fix."
189 2. Patch from JFreeman to replace UTF-8 escape constant of 0xfe with
190 0xfc. Hope this is right!
191
192 Version 2.99
193
194 1. Patch from Steve Hay to fix extra Content-type: appearing on
195 browser screen when FatalsToBrowser invoked.
196 2. Patch from Ewann Corvellec to fix cross-site scripting
197 vulnerability.
198 3. Fixed tmpdir routine for file uploading to solve problem that
199 occurs under mod_perl when tmpdir is writable at startup time, but
200 not at session time.
201
202 Version 2.98
203
204 1. Fixed crash in Dump() function.
205
206 Version 2.97
207
208 1. Sigh. Uploaded wrong 2.96 to CPAN.
209
210 Version 2.96
211
212 1. More bugfixes to the -style argument.
213
214 Version 2.95
215
216 1. Fixed bugs in start_html(-style=>...) support introduced in 2.94.
217
218 Version 2.94
219
220 1. Removed warning from reset() method.
221 2. Moved
222
223 and tags into the :html3 group. Hope this removes undefined CGI::Area
224 errors.
225
226 Changed CGI::Carp to play with mod_perl2 and to (hopefully) restore
227 reporting of compile-time errors.
228
229 Fixed potential deadlock between web server and CGI.pm when aborting
230 a read due to POST_MAX (reported by Antti Lankila).
231
232 Fixed issue with tag-generating function not incorporating content
233 when first variable undef.
234
235 Fixed cross-site scripting bug reported by obscure.
236
237 Fixed Dump() function to return correctly formed XHTML - bug
238 reported by Ralph Siemsen.
239
240 Version 2.93
241
242 1. Fixed embarassing bug in mp1 support.
243
244 Version 2.92
245
246 1. Fix to be P3P compliant submitted from MPREWITT.
247 2. Added CGI->r() API for mod_perl1/mod_perl2.
248 3. Fixed bug in redirect() that was corrupting cookies.
249 4. Minor fix to behavior of reset() button to make it consistent with
250 submit() button (first time this has been changed in 9 years).
251 5. Patch from Dan Kogai to handle UTF-8 correctly in 5.8 and higher.
252 6. Patch from Steve Hay to make CGI::Carp's error messages appear on
253 MSIE browsers.
254 7. Added Yair Lenga's patch for non-urlencoded postings.
255 8. Added Stas Bekman's patches for mod_perl 2 compatibility.
256 9. Fixed uninitialized escape behavior submitted by William Campbell.
257 10. Fixed tied behavior so that you can pass arguments to tie()
258 11. Fixed incorrect generation of URLs when the path_info contains +
259 and other odd characters.
260 12. Fixed redirect(-cookies=>$cookie) problem.
261 13. Fixed tag generation bug that affects -javascript passed to
262 start_html().
263
264 Version 2.91
265
266 1. Attribute generation now correctly respects the value of
267 autoEscape().
268 2. Fixed endofrm() syntax error introduced by Ben Edgington's patch.
269
270 Version 2.90
271
272 1. Fixed bug in redirect header handling.
273 2. Added P3P option to header().
274 3. Patches from Alexey Mahotkin to make CGI::Carp work correctly with
275 object-oriented exceptions.
276 4. Removed inaccurate description of how to set multiple cookies from
277 CGI::Cookie pod file.
278 5. Patch from Kevin Mahony to prevent running out of filehandles when
279 uploading lots of files.
280 6. Documentation enhancement from Mark Fisher to note that the
281 import_names() method transforms the parameter names into valid
282 Perl names.
283 7. Patch from Dan Harkless to suppress lang attribute in <html> tag
284 if specified as a null string.
285 8. Patch from Ben Edgington to fix broken XHTML-transitional 1.0
286 validation on endform().
287 9. Custom html header fix from Steffen Beyer (first letter correctly
288 upcased now)
289 10. Added a -verbatim option to stylesheet generation from Michael
290 Dickson
291 11. Faster delete() method from Neelam Gupta
292 12. Fixed broken Cygwin support.
293 13. Added empty charset support from Bradley Baetz
294 14. Patches from Doug Perham and Kevin Mahoney to fix file upload
295 failures when uploaded file is a multiple of 4096.
296
297 Version 2.89
298
299 1. Fixed behavior of ACTION tag when POSTING to a URL that has a
300 query string.
301 2. Added Patch from Michael Rommel to handle multipart/mixed uploads
302 from Opera
303
304 Version 2.88
305
306 1. Fixed problem with uploads being refused under Perl 5.8 when under
307 Taint mode.
308 2. Fixed uninitialized variable warnings under Perl 5.8.
309 3. Fixed CGI::Pretty regression test failures.
310
311 Version 2.87
312
313 1. Security hole patched: when processing multipart/form-data
314 postings, most arguments were being untainted silently. Returned
315 arguments are now tainted correctly. This may cause some scripts
316 to fail that used to work (thanks to Nick Cleaton for pointing
317 this out and persisting until it was fixed).
318 2. Update for mod_perl 2.0.
319 3. Pragmas such as -no_xhtml are now respected in mod_perl
320 environment.
321
322 Version 2.86
323
324 1. Fixes for broken CGI::Cookie expiration dates introduced in 2.84.
325
326 Version 2.85
327
328 1. Fix for broken autoEscape function introduced in 2.84.
329
330 Version 2.84
331
332 1. Fix for failed file uploads on Cygwin platforms.
333 2. HTML escaping code now replaced 0x8b and 0x9b with unicode
334 references < and *#8250;
335
336 Version 2.83
337
338 1. Fixed autoEscape() documentation inconsistencies.
339 2. Patch from Ville Skyttä to fix a number of XHTML inconsistencies.
340 3. Added Max-Age to list of CGI::Cookie headers.
341
342 Version 2.82
343
344 1. Patch from Rudolf Troller to add attribute setting and option
345 groups to form fields.
346 2. Patch from Simon Perreault for silent crashes when using CGI::Carp
347 under mod_perl.
348 3. Patch from Scott Gifford allows you to set the program name for
349 CGI::Carp.
350
351 Version 2.81
352
353 1. Removed extraneous slash from end of stylesheet tags generated by
354 start_html in non-XHTML mode.
355 2. Changed behavior of CGI::Carp with respect to eval{} contexts so
356 that output behaves properly in mod_perl environments.
357 3. Fixed default DTD so that it validates with W3C validator.
358
359 Version 2.80
360
361 1. Fixed broken messages in CGI::Carp.
362 2. Changed checked="1" to checked="checked" for real XHTML
363 compatibility.
364 3. Resurrected REQUEST_URI code so that url() works correctly with
365 multiviews.
366
367 Version 2.79
368
369 1. Changes to CGI::Carp to avoid "subroutine redefined" error
370 messages.
371 2. Default DTD is now XHTML 1.0 Transitional
372 3. Patches to support all HTML4 tags.
373
374 Version 2.78
375
376 1. Added ability to change encoding in <?xml> assertion.
377 2. Fixed the old escapeHTML('CGI') ne "CGI" bug
378 3. In accordance with XHTML requirements, there are no longer any
379 minimized attributes, such as "checked".
380 4. Patched bug which caused file uploads of exactly 4096 bytes to be
381 truncated to 4094 (thanks to Kevin Mahony)
382 5. New tests and fixes to CGI::Pretty (thanks to Michael Schwern).
383
384 Version 2.77
385
386 1. No new features, but released in order to fix an apparent CPAN
387 bug.
388
389 Version 2.76
390
391 1. New esc.t regression test for EBCDIC translations courtesy Peter
392 Prymmer.
393 2. Patches from James Jurach to make compatible with FCGI-ProcManager
394 3. Additional fields passed to header() (like -Content_disposition)
395 now honor initial capitalization.
396 4. Patch from Andrew McNaughton to handle utf-8 escapes (%uXXXX
397 codes) in URLs.
398
399 Version 2.752
400
401 1. Syntax error in the autoloaded Fh::new() subroutine.
402 2. Better error reporting in autoloaded functions.
403
404 Version 2.751
405
406 1. Tiny tweak to filename regular expression function on line 3355.
407
408 Version 2.75
409
410 1. Fixed bug in server push boundary strings (CGI.pm and CGI::Push).
411 2. Fixed bug that occurs when uploading files with funny characters
412 in the name
413 3. Fixed non-XHTML-compliant attributes produced by textfield()
414 4. Added EPOC support, courtesy Olaf Flebbe
415 5. Fixed minor XHTML bugs.
416 6. Made escape() and unescape() symmetric with respect to EBCDIC,
417 courtesy Roca, Ignasi <ignasi.roca@fujitsu.siemens.es>
418 7. Removed uninitialized variable warning from CGI::Cookie, provided
419 by Atipat Rojnuckarin <rojnuca@yahoo.com>
420 8. Fixed bug in CGI::Pretty that causes it to print partial end tags
421 when the $INDENT global is changed.
422 9. Single quotes are changed to character entity ' for compatibility
423 with URLs.
424
425 Version 2.74
426
427 September 13, 2000
428 1. Quashed one-character bug that caused CGI.pm to fail on file
429 uploads.
430
431 Version 2.73
432
433 September 12, 2000
434 1. Added -base to the list of arguments accepted by url().
435 2. Fixes to XHTML support.
436 3. POST parameters no longer show up in the Location box.
437
438 Version 2.72
439
440 August 19, 2000
441 1. Fixed the defaults button so that it works again
442 2. Charset is now correctly saved and restored when saving to files
443 3. url() now works correctly when given scripts with %20 and other
444 escapes in the additional path info. This undoes a patch
445 introduced in version 2.47 that I no longer understand the
446 rationale for.
447
448 Version 2.71
449
450 August 13, 2000
451 1. Newlines in the value attributes of hidden fields and other form
452 elements are now escaped when using ISO-Latin.
453 2. Inline script and style sections are now protected as CDATA
454 sections when XHTML mode is on (the default).
455
456 Version 2.70
457
458 August 4, 2000
459 1. Fixed bug in scrolling_list() which omitted a space in front of
460 the "multiple" attribute.
461 2. Squashed the "useless use of string in void context" message from
462 redirects.
463
464 Version 2.69
465
466 1. startform() now creates default ACTION for POSTs as well as GETs.
467 This may break some browsers, but it no longer violates the HTML
468 spec.
469 2. CGI.pm now emits XHTML by default. Disable with -no_xhtml.
470 3. We no longer interpret &#ddd sequences in non-latin character
471 sets.
472
473 Version 2.68
474
475 1. No longer attempts to escape characters when dealing with non
476 ISO-8861 character sets.
477 2. checkbox() function now defaults to using -value as its label,
478 rather than -name. The current behavior is what has been
479 documented from the beginning.
480 3. -style accepts array reference to incorporate multiple stylesheets
481 into document.
482
483 1. Fixed two bugs that caused the -compile pragma to fail with a
484 syntax error.
485
486 Version 2.67
487
488 1. Added XHTML support (incomplete; tags need to be lowercased).
489 2. Fixed CGI/Carp when running under mod_perl. Probably broke in
490 other contexts.
491 3. Fixed problems when passing multiple cookies.
492 4. Suppress warnings from _tableize() that were appearing when using
493 -w switch with radio_group() and checkbox_group().
494 5. Support for the header() -attachment argument, which can give
495 pages a default file name when saving to disk.
496
497 Version 2.66
498
499 1. 2.65 changes in make_attributes() broke HTTP header functions
500 (including redirect), so made it context sensitive.
501
502 Version 2.65
503
504 1. Fixed regression tests to skip tests that require implicit fork on
505 machines without fork().
506 2. Changed make_attributes() to automatically escape any HTML
507 reserved characters.
508 3. Minor documentation fix in javascript example.
509
510 Version 2.64
511
512 1. Changes introduced in 2.63 broke param() when retrieving parameter
513 lists containing only a single argument. This is now fixed.
514 2. self_url() now defaults to returning parameters delimited with
515 semicolon. Use the pragma -oldstyle_urls to get the old "&"
516 delimiter.
517
518 Version 2.63
519
520 1. Fixed CGI::Push to pull out parameters correctly.
521 2. Fixed redirect() so that it works with default character set
522 3. Changed param() so as to returned empty string '' when referring
523 to variables passed in query strings like 'name1=&name2'
524
525 Version 2.62
526
527 1. Fixed broken ReadParse() function, and added regression tests
528 2. Fixed broken CGI::Pretty, and added regression tests
529
530 Version 2.61
531
532 1. Moved more functions from CGI.pm proper into CGI/Util.pm.
533 CGI/Cookie should now be standalone.
534 2. Disabled per-user temporary directories, which were causing grief.
535
536 Version 2.60
537
538 1. Fixed junk appearing in autogenerated HTML functions when using
539 object-oriented mode.
540
541 Version 2.59
542
543 1. autoescape functionality breaks too much existing code, removed
544 it.
545 2. use escapeHTML() manually
546
547 Version 2.58
548
549 This is the release version of 2.57.
550
551 Version 2.57
552
553 1. Added -debug pragma and turned off auto reading of STDIN.
554 2. Default DTD updated to HTML 4.01 transitional.
555 3. Added charset() method and the -charset argument to header().
556 4. Fixed behavior of escapeHTML() to respect charset() and to escape
557 nasty Windows characters (thanks to Tom Christiansen).
558 5. Handle REDIRECT_QUERY_STRING correctly.
559 6. Removed use_named_parameters() because of dependency problems and
560 general lameness.
561 7. Fixed problems with bad HREF links generated by url(-relative=>1)
562 when the url is like /people/.
563 8. Silenced a warning on upload (patch provided by Jonas Liljegren)
564 9. Fixed race condition in CGI::Carp when errors occur during parsing
565 (patch provided by Maurice Aubrey).
566 10. Fixed failure of url(-path_info=>1) when path contains % signs.
567 11. Fixed warning from CGI::Cookie when receiving foreign cookies that
568 don't use name=value format.
569 12. Fixed incompatibilities with file uploading on VMS systems.
570
571 Version 2.56
572
573 1. Fixed bugs in file upload introduced in version 2.55
574 2. Fixed long-standing bug that prevented two files with identical
575 names from being uploaded.
576
577 Version 2.55
578
579 1. Fixed cookie regression test so as not to produce an error.
580 2. Fixed path_info() and self_url() to work correctly together when
581 path_info() modified.
582 3. Removed manify warnings from CGI::{Switch,Apache}.
583
584 Version 2.54
585
586 1. This will be the last release of the monolithic CGI.pm module.
587 Later versions will be modularized and optimized.
588 2. DOMAIN tag no longer added to cookies by default. This will break
589 some versions of Internet Explorer, but will avoid breaking
590 networks which use host tables without fully qualified domain
591 names. For compatibility, please always add the -domain tag when
592 creating cookies.
593 3. Fixed escape() method so that +'s are treated correctly.
594 4. Updated CGI::Pretty module.
595
596 Version 2.53
597
598 1. Forgot to upgrade regression tests before releasing 2.52. NOTHING
599 ELSE HAS CHANGED IN LIBRARY
600
601 Version 2.52
602
603 1. Spurious newline in checkbox() routine removed. (courtesy John
604 Essen)
605 2. TEXTAREA linebreaks now respected in dump() routine. (courtesy
606 John Essen)
607 3. Patches for DOS ports (courtesy Robert Davies)
608 4. Patches for VMS
609 5. More fixes for cookie problems
610 6. Fix CGI::Carp so that it doesn't affect eval{} blocks (courtesy
611 Byron Brummer)
612
613 Version 2.51
614
615 1. Fixed problems with cookies not being remembered when sent to IE
616 5.0 (and Netscape 5.0 too?)
617 2. Numerous HTML compliance problems in cgi_docs.html; fixed thanks
618 to Michael Leahy
619
620 Version 2.50
621
622 1. Added a new Vars() method to retrieve all parameters as a tied
623 hash.
624 2. Untainted tainted tempfile name so that script doesn't fail on
625 terminal unlink.
626 3. Made picking of upload tempfile name more intelligent so that
627 doesn't fail in case of name collision.
628 4. Fixed handling of expire times when passed an absolute timestamp.
629 5. Changed dump() to Dump() to avoid name clashes.
630
631 Version 2.49
632
633 1. Fixes for FastCGI (globals not getting reset)
634 2. Fixed url() to correctly handle query string and path under
635 MOD_PERL
636
637 Version 2.48
638
639 1. Reverted detection of MOD_PERL to avoid breaking PerlEX.
640
641 Version 2.47
642
643 1. Patch to fix file upload bug appearing in IE 3.01 for
644 Macintosh/PowerPC.
645 2. Replaced use of $ENV{SCRIPT_NAME} with $ENV{REQUEST_URI} when
646 running under Apache, to fix self-referencing URIs.
647 3. Fixed bug in escapeHTML() which caused certain constructs, such as
648 CGI->image_button(), to fail.
649 4. Fixed bug which caused strong('CGI') to fail. Be careful to use
650 CGI::strong('CGI') and not CGI->strong('CGI'). The latter will
651 produce confusing results.
652 5. Added upload() function, as a preferred replacement for the
653 "filehandle as string" feature.
654 6. Added cgi_error() function.
655 7. Rewrote file upload handling to return undef rather than dieing
656 when an error is encountered. Be sure to call cgi_error() to find
657 out what went wrong.
658
659 Version 2.46
660
661 1. Fix for failure of the "include" tests under mod_perl
662 2. Added end_multipart_form to prevent failures during qw(-compile
663 :all)
664
665 Version 2.45
666
667 1. Multiple small documentation fixes
668 2. CGI::Pretty didn't get into 2.44. Fixed now.
669
670 Version 2.44
671
672 1. Fixed file descriptor leak in upload function.
673 2. Fixed bug in header() that prevented fields from containing double
674 quotes.
675 3. Added Brian Paulsen's CGI::Pretty package for pretty-printing
676 output HTML.
677 4. Removed CGI::Apache and CGI::Switch from the distribution.
678 5. Generated start_* shortcuts so that start_table(), end_table(),
679 start_ol(), end_ol(), and so forth now work (see the docs on how
680 to enable this feature).
681 6. Changed accept() to Accept(), sub() to Sub(). There's still a
682 conflict with reset(), but this will break too many existing
683 scripts!
684
685 Version 2.43
686
687 1. Fixed problem with "use strict" and file uploads (thanks to Peter
688 Haworth)
689 2. Fixed problem with not MSIE 3.01 for the power_mac not doing file
690 uploads right.
691 3. Fixed problem with file upload on IIS 4.0 when authorization in
692 use.
693 4. -content_type and '-content-type' can now be provided to header()
694 as synonyms for -type.
695 5. CGI::Carp now escapes the ampersand BEFORE escaping the > and <
696 signs.
697 6. Fixed "not an array reference" error when passing a hash reference
698 to radio_group().
699 7. Fixed non-removal of uploaded TMP files on NT platforms which
700 occurs when server runs on non-C drive (thanks to Steve Kilbane
701 for finding this one).
702
703 Version 2.42
704
705 1. Too many screams of anguish at changed behavior of url(). Is now
706 back to its old behavior by default, with options to generate all
707 the variants.
708 2. Added regression tests. "make test" now works.
709 3. Documentation fixes.
710 4. Fixes for Macintosh uploads, but uploads STILL do not work pending
711 changes to MacPerl.
712
713 Version 2.41
714
715 1. url() method now includes the path info. Use script_name() to get
716 it without path info().
717 2. Changed handling of empty attributes in HTML tag generation. Be
718 warned! Use table({-border=>undef}) rather than
719 table({-border=>''}).
720 3. Changes to allow uploaded filenames to be compared to other
721 strings with "eq", "cmp" and "ne".
722 4. Changes to allow CGI.pm to coexist more peacefully with
723 ActiveState PerlEX.
724 5. Changes to prevent exported variables from clashing when importing
725 ":all" set in combination with cookies.
726
727 Version 2.40
728
729 1. CGI::Carp patched to work better with mod_perl (thanks to Chris
730 Dean).
731 2. Uploads of files whose names begin with numbers or the Windows
732 \\UNC\shared\file nomenclature should no longer fail.
733 3. The <STYLE> tag (for cascading style sheets) now generates the
734 required TYPE attribute.
735 4. Server push primitives added, thanks to Ed Jordan.
736 5. Table and other HTML3 functions are now part of the :standard set.
737 6. Small documentation fixes.
738
739 TO DO:
740 1. Do something about the DTD mess. The module should generate
741 correct DTDs, or at least offer the programmer a way to specify
742 the correct one.
743 2. Split CGI.pm into CGI processing and HTML-generating modules.
744 3. More robust file upload (?still not working on the Macintosh?).
745 4. Bring in all the HTML4 functionality, particular the accessibility
746 features.
747
748 Version 2.39
749
750 1. file uploads failing because of VMS patch; fixed.
751 2. -dtd parameter was not being properly processed.
752
753 Version 2.38
754
755 I finally got tired of all the 2.37 betas and released 2.38. The main
756 difference between this version and the last 2.37 beta (2.37b30) are
757 some fixes for VMS. This should allow file upload to work properly on
758 all VMS Web servers.
759
760 Version 2.37, various beta versions
761
762 1. Added a CGI::Cookie::parse() method for lucky mod_perl users.
763 2. No longer need separate -values and -labels arguments for
764 multi-valued form elements.
765 3. Added better interface to raw cookies (fix courtesy Ken Fox,
766 kfox@ford.com)
767 4. Added param_fetch() function for direct access to parameter list.
768 5. Fix to checkbox() to allow for multi-valued single checkboxes
769 (weird problem).
770 6. Added a compile() method for those who want to compile without
771 importing.
772 7. Documented the import pragmas a little better.
773 8. Added a -compile switch to the use clause for the long-suffering
774 mod_perl and Perl compiler users.
775 9. Fixed initialization routines so that FileHandle and type globs
776 work correctly (and hash initialization doesn't fail!).
777 10. Better deletion of temporary files on NT systems.
778 11. Added documentation on escape(), unescape(), unescapeHTML() and
779 unescapeHTML() subroutines.
780 12. Added documentation on creating subclasses.
781 13. Fixed problem when calling $self->SUPER::foo() from inheriting
782 subclasses.
783 14. Fixed problem using filehandles from within subroutines.
784 15. Fixed inability to use the string "CGI" as a parameter.
785 16. Fixed exponentially growing $FILLUNIT bug
786 17. Check for undef filehandle in read_from_client()
787 18. Now requires the UNIVERSAL.pm module, present in Perl 5.003_7 or
788 higher.
789 19. Fixed problem with uppercase-only parameters being ignored.
790 20. Fixed vanishing cookie problem.
791 21. Fixed warning in initialize_globals() under mod_perl.
792 22. File uploads from Macintosh versions of MSIE should now work.
793 23. Pragmas now preceded by dashes (-nph) rather than colons (:nph).
794 Old style is supported for backward compatability.
795 24. Can now pass arguments to all functions using {} brackets,
796 resolving historical inconsistencies.
797 25. Removed autoloader warnings about absent MultipartBuffer::DESTROY.
798 26. Fixed non-sticky checkbox() when -name used without -value.
799 27. Hack to fix path_info() in IIS 2.0. Doesn't help with IIS 3.0.
800 28. Parameter syntax for debugging from command line now more
801 straightforward.
802 29. Added $DISABLE_UPLOAD to disable file uploads.
803 30. Added $POST_MAX to error out if POSTings exceed some ceiling.
804 31. Fixed url_param(), which wasn't working at all.
805 32. Fixed variable suicide problem in s///e expressions, where the
806 autoloader was needed during evaluation.
807 33. Removed excess spaces between elements of checkbox and radio
808 groups
809 34. Can now create "valueless" submit buttons
810 35. Can now set path_info as well as read it.
811 36. ReadParse() now returns a useful function result.
812 37. import_names() now allows you to optionally clear out the
813 namespace before importing (for mod_perl users)
814 38. Made it possible to have a popup menu or radio button with a value
815 of "0".
816 39. link() changed to Link() to avoid overriding native link function.
817 40. Takes advantage of mod_perl's register_cleanup() function to clear
818 globals.
819 41. <LAYER> and <ILAYER> added to :html3 functions.
820 42. Fixed problems with private tempfiles and NT/IIS systems.
821 43. No longer prints the DTD by default (I bet no one will complain).
822 44. Allow underscores to replace internal hyphens in parameter names.
823 45. CGI::Push supports heterogeneous MIME types and adjustable delays
824 between pages.
825 46. url_param() method added for retrieving URL parameters even when a
826 fill-out form is POSTed.
827 47. Got rid of warnings when radio_group() is called.
828 48. Cookies now moved to their very own module.
829 49. Fixed documentation bug in CGI::Fast.
830 50. Added a :no_debug pragma to the import list.
831
832 Version 2.36
833
834 1. Expanded JavaScript functionality
835 2. Preliminary support for cascading stylesheets
836 3. Security fixes for file uploads:
837 + Module will bail out if its temporary file already exists
838 + Temporary files can now be made completely private to avoid
839 peeking by other users or CGI scripts.
840 4. use CGI qw/:nph/ wasn't working correctly. Now it is.
841 5. Cookie and HTTP date formats didn't meet spec. Thanks to Mark
842 Fisher (fisherm@indy.tce.com) for catching and fixing this.
843
844 p
845
846 Version 2.35
847
848 1. Robustified multipart file upload against incorrect syntax in
849 POST.
850 2. Fixed more problems with mod_perl.
851 3. Added -noScript parameter to start_html().
852 4. Documentation fixes.
853
854 Version 2.34
855
856 1. Stupid typo fix
857
858 Version 2.33
859
860 1. Fixed a warning about an undefined environment variable.
861 2. Doug's patch for redirect() under mod_perl
862 3. Partial fix for busted inheritence from CGI::Apache
863 4. Documentation fixes.
864
865 Version 2.32
866
867 1. Improved support for Apache's mod_perl.
868 2. Changes to better support inheritance.
869 3. Support for OS/2.
870
871 Version 2.31
872
873 1. New uploadInfo() method to obtain header information from uploaded
874 files.
875 2. cookie() without any arguments returns all the cookies passed to a
876 script.
877 3. Removed annoying warnings about $ENV{NPH} when running with the -w
878 switch.
879 4. Removed operator overloading throughout to make compatible with
880 new versions of perl.
881 5. -expires now implies the -date header, to avoid clock skew.
882 6. WebSite passes cookies in $ENV{COOKIE} rather than
883 $ENV{HTTP_COOKIE}. We now handle this, even though it's O'Reilly's
884 fault.
885 7. Tested successfully against new sfio I/O layer.
886 8. Documentation fixes.
887
888 Version 2.30
889
890 1. Automatic detection of operating system at load time.
891 2. Changed select() function to Select() in order to avoid conflict
892 with Perl built-in.
893 3. Added Tr() as an alternative to TR(); some people think it looks
894 better that way.
895 4. Fixed problem with autoloading of MultipartBuffer::DESTROY code.
896 5. Added the following methods:
897 + virtual_host()
898 + server_software()
899 6. Automatic NPH mode when running under Microsoft IIS server.
900
901 Version 2.29
902
903 1. Fixed cookie bugs
904 2. Fixed problems that cropped up when useNamedParameters was set to
905 1.
906 3. Prevent CGI::Carp::fatalsToBrowser() from crapping out when
907 encountering a die() within an eval().
908 4. Fixed problems with filehandle initializers.
909
910 Version 2.28
911
912 1. Added support for NPH scripts; also fixes problems with Microsoft
913 IIS.
914 2. Fixed a problem with checkbox() values not being correctly saved
915 and restored.
916 3. Fixed a bug in which CGI objects created with empty string
917 initializers took on default values from earlier CGI objects.
918 4. Documentation fixes.
919
920 Version 2.27
921
922 1. Small but important bug fix: the automatic capitalization of tag
923 attributes was accidentally capitalizing the VALUES as well as the
924 ATTRIBUTE names (oops).
925
926 Version 2.26
927
928 1. Changed behavior of scrolling_list(), checkbox() and
929 checkbox_group() methods so that defaults are honored correctly.
930 The "fix" causes endform() to generate additional <INPUT
931 TYPE="HIDDEN"> tags -- don't be surpised.
932 2. Fixed bug involving the detection of the SSL protocol.
933 3. Fixed documentation error in position of the -meta argument in
934 start_html().
935 4. HTML shortcuts now generate tags in ALL UPPERCASE.
936 5. start_html() now generates correct SGML header:
937 <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
938
939 6. CGI::Carp no longer fails "use strict refs" pragma.
940
941 Version 2.25
942
943 1. Fixed bug that caused bad redirection on destination URLs with
944 arguments.
945 2. Fixed bug involving use_named_parameters() followed by
946 start_multipart_form()
947 3. Fixed bug that caused incorrect determination of binmode for
948 Macintosh.
949 4. Spelling fixes on documentation.
950
951 Version 2.24
952
953 1. Fixed bug that caused generation of lousy HTML for some form
954 elements
955 2. Fixed uploading bug in Windows NT
956 3. Some code cleanup (not enough)
957
958 Version 2.23
959
960 1. Fixed an obscure bug that caused scripts to fail mysteriously.
961 2. Fixed auto-caching bug.
962 3. Fixed bug that prevented HTML shortcuts from passing taint checks.
963 4. Fixed some -w warning problems.
964
965 Version 2.22
966
967 1. New CGI::Fast module for use with FastCGI protocol. See pod
968 documentation for details.
969 2. Fixed problems with inheritance and autoloading.
970 3. Added TR() (<tr>) and PARAM() (<param>) methods to list of
971 exported HTML tag-generating functions.
972 4. Moved all CGI-related I/O to a bottleneck method so that this can
973 be overridden more easily in mod_perl (thanks to Doug MacEachern).
974 5. put() method as substitute for print() for use in mod_perl.
975 6. Fixed crash in tmpFileName() method.
976 7. Added tmpFileName(), startform() and endform() to export list.
977 8. Fixed problems with attributes in HTML shortcuts.
978 9. Functions that don't actually need access to the CGI object now no
979 longer generate a default one. May speed things up slightly.
980 10. Aesthetic improvements in generated HTML.
981 11. New examples.
982
983 Version 2.21
984
985 1. Added the -meta argument to start_html().
986 2. Fixed hidden fields (again).
987 3. Radio_group() and checkbox_group() now return an appropriate
988 scalar value when called in a scalar context, rather than
989 returning a numeric value!
990 4. Cleaned up the formatting of form elements to avoid unesthetic
991 extra spaces within the attributes.
992 5. HTML elements now correctly include the closing tag when
993 parameters are present but null: em('')
994 6. Added password_field() to the export list.
995
996 Version 2.20
997
998 1. Dumped the SelfLoader because of problems with running with taint
999 checks and rolled my own. Performance is now significantly
1000 improved.
1001 2. Added HTML shortcuts.
1002 3. import() now adheres to the Perl module conventions, allowing
1003 CGI.pm to import any or all method names into the user's name
1004 space.
1005 4. Added the ability to initialize CGI objects from strings and
1006 associative arrays.
1007 5. Made it possible to initialize CGI objects with filehandle
1008 references rather than filehandle strings.
1009 6. Added the delete_all() and append() methods.
1010 7. CGI objects correctly initialize from filehandles on NT/95 systems
1011 now.
1012 8. Fixed the problem with binary file uploads on NT/95 systems.
1013 9. Fixed bug in redirect().
1014 10. Added '-Window-target' parameter to redirect().
1015 11. Fixed import_names() so that parameter names containing funny
1016 characters work.
1017 12. Broke the unfortunate connection between cookie and CGI parameter
1018 name space.
1019 13. Fixed problems with hidden fields whose values are 0.
1020 14. Cleaned up the documentation somewhat.
1021
1022 Version 2.19
1023
1024 1. Added cookie() support routines.
1025 2. Added -expires parameter to header().
1026 3. Added cgi-lib.pl compatability mode.
1027 4. Made the module more configurable for different operating systems.
1028 5. Fixed a dumb bug in JavaScript button() method.
1029
1030 Version 2.18
1031
1032 1. Fixed a bug that corrects a hang that occurs on some platforms
1033 when processing file uploads. Unfortunately this disables the
1034 check for bad Netscape uploads.
1035 2. Fixed bizarre problem involving the inability to process uploaded
1036 files that begin with a non alphabetic character in the file name.
1037 3. Fixed a bug in the hidden fields involving the -override directive
1038 being ignored when scalar defaults were passed.
1039 4. Added documentation on how to disable the SelfLoader features.
1040
1041 Version 2.17
1042
1043 1. Added support for the SelfLoader module.
1044 2. Added oodles of JavaScript support routines.
1045 3. Fixed bad bug in query_string() method that caused some parameters
1046 to be silently dropped.
1047 4. Robustified file upload code to handle premature termination by
1048 the client.
1049 5. Exported temporary file names on file upload.
1050 6. Removed spurious "uninitialized variable" warnings that appeared
1051 when running under 5.002.
1052 7. Added the Carp.pm library to the standard distribution.
1053 8. Fixed a number of errors in this documentation, and probably added
1054 a few more.
1055 9. Checkbox_group() and radio_group() now return the buttons as
1056 arrays, so that you can incorporate the individual buttons into
1057 specialized tables.
1058 10. Added the '-nolabels' option to checkbox_group() and
1059 radio_group(). Probably should be added to all the other
1060 HTML-generating routines.
1061 11. Added the url() method to recover the URL without the entire query
1062 string appended.
1063 12. Added request_method() to list of environment variables available.
1064 13. Would you believe it? Fixed hidden fields again!
1065
1066 Version 2.16
1067
1068 1. Fixed hidden fields yet again.
1069 2. Fixed subtle problems in the file upload method that caused
1070 intermittent failures (thanks to Keven Hendrick for this one).
1071 3. Made file upload more robust in the face of bizarre behavior by
1072 the Macintosh and Windows Netscape clients.
1073 4. Moved the POD documentation to the bottom of the module at the
1074 request of Stephen Dahmen.
1075 5. Added the -xbase parameter to the start_html() method, also at the
1076 request of Stephen Dahmen.
1077 6. Added JavaScript form buttons at Stephen's request. I'm not sure
1078 how to use this Netscape extension correctly, however, so for now
1079 the form() method is in the module as an undocumented feature. Use
1080 at your own risk!
1081
1082 Version 2.15
1083
1084 1. Added the -override parameter to all field-generating methods.
1085 2. Documented the user_name() and remote_user() methods.
1086 3. Fixed bugs that prevented empty strings from being recognized as
1087 valid textfield contents.
1088 4. Documented the use of framesets and added a frameset example.
1089
1090 Version 2.14
1091
1092 This was an internal experimental version that was never released.
1093
1094 Version 2.13
1095
1096 1. Fixed a bug that interfered with the value "0" being entered into
1097 text fields.
1098
1099 Version 2.01
1100
1101 1. Added -rows and -columns to the radio and checkbox groups. No
1102 doubt this will cause much grief because it seems to promise a
1103 level of meta-organization that it doesn't actually provide.
1104 2. Fixed a bug in the redirect() method -- it was not truly HTTP/1.0
1105 compliant.
1106
1107 Version 2.0
1108
1109 The changes seemed to touch every line of code, so I decided to bump
1110 up the major version number.
1111 1. Support for named parameter style method calls. This turns out
1112 to be a big win for extending CGI.pm when Netscape adds new HTML
1113 "features".
1114 2. Changed behavior of hidden fields back to the correct "sticky"
1115 behavior. This is going to break some programs, but it is for
1116 the best in the long run.
1117 3. Netscape 2.0b2 broke the file upload feature. CGI.pm now handles
1118 both 2.0b1 and 2.0b2-style uploading. It will probably break again
1119 in 2.0b3.
1120 4. There were still problems with library being unable to distinguish
1121 between a form being loaded for the first time, and a subsequent
1122 loading with all fields blank. We now forcibly create a default
1123 name for the Submit button (if not provided) so that there's
1124 always at least one parameter.
1125 5. More workarounds to prevent annoying spurious warning messages
1126 when run under the -w switch. -w is seriously broken in perl
1127 5.001!
1128
1129 Version 1.57
1130
1131 1. Support for the Netscape 2.0 "File upload" field.
1132 2. The handling of defaults for selected items in scrolling lists and
1133 multiple checkboxes is now consistent.
1134
1135 Version 1.56
1136
1137 1. Created true "pod" documentation for the module.
1138 2. Cleaned up the code to avoid many of the spurious "use of
1139 uninitialized variable" warnings when running with the -w switch.
1140 3. Added the autoEscape() method. v
1141 4. Added string interpolation of the CGI object.
1142 5. Added the ability to pass additional parameters to the <BODY> tag.
1143 6. Added the ability to specify the status code in the HTTP header.
1144
1145 Bug fixes in version 1.55
1146
1147 1. Every time self_url() was called, the parameter list would grow.
1148 This was a bad "feature".
1149 2. Documented the fact that you can pass "-" to radio_group() in
1150 order to prevent any button from being highlighted by default.
1151
1152 Bug fixes in version 1.54
1153
1154 1. The user_agent() method is now documented;
1155 2. A potential security hole in import() is now plugged.
1156 3. Changed name of import() to import_names() for compatability with
1157 CGI:: modules.
1158
1159 Bug fixes in version 1.53
1160
1161 1. Fixed several typos in the code that were causing the following
1162 subroutines to fail in some circumstances
1163 1. checkbox()
1164 2. hidden()
1165 2. No features added
1166
1167 New features added in version 1.52
1168
1169 1. Added backslashing, quotation marks, and other shell-style escape
1170 sequences to the parameters passed in during debugging off-line.
1171 2. Changed the way that the hidden() method works so that the default
1172 value always overrides the current one.
1173 3. Improved the handling of sticky values in forms. It's now less
1174 likely that sticky values will get stuck.
1175 4. If you call server_name(), script_name() and several other methods
1176 when running offline, the methods now create "dummy" values to
1177 work with.
1178
1179 Bugs fixed in version 1.51
1180
1181 1. param() when called without arguments was returning an array of
1182 length 1 even when there were no parameters to be had. Bad bug!
1183 Bad!
1184 2. The HTML code generated would break if input fields contained the
1185 forbidden characters ">< or &. You can now use these characters
1186 freely.
1187
1188 New features added in version 1.50
1189
1190 1. import() method allows all the parameters to be imported into a
1191 namespace in one fell swoop.
1192 2. Parameters are now returned in the same order in which they were
1193 defined.
1194
1195 Bugs fixed in version 1.45
1196
1197 1. delete() method didn't work correctly. This is now fixed.
1198 2. reset() method didn't allow you to set the name of the button.
1199 Fixed.
1200
1201 Bugs fixed in version 1.44
1202
1203 1. self_url() didn't include the path information. This is now fixed.
1204
1205 New features added in version 1.43
1206
1207 1. Added the delete() method.
1208
1209 New features added in version 1.42
1210
1211 1. The image_button() method to create clickable images.
1212 2. A few bug fixes involving forms embedded in <PRE> blocks.
1213
1214 New features added in version 1.4
1215
1216 1. New header shortcut methods
1217 + redirect() to create HTTP redirection messages.
1218 + start_html() to create the HTML title, complete with the
1219 recommended <LINK> tag that no one ever remembers to include.
1220 + end_html() for completeness' sake.
1221 2. A new save() method that allows you to write out the state of an
1222 script to a file or pipe.
1223 3. An improved version of the new() method that allows you to restore
1224 the state of a script from a file or pipe. With (2) this gives you
1225 dump and restore capabilities! (Wow, you can put a "121,931
1226 customers served" banner at the bottom of your pages!)
1227 4. A self_url() method that allows you to create state-maintaining
1228 hypertext links. In addition to allowing you to maintain the state
1229 of your scripts between invocations, this lets you work around a
1230 problem that some browsers have when jumping to internal links in
1231 a document that contains a form -- the form information gets lost.
1232 5. The user-visible labels in checkboxes, radio buttons, popup menus
1233 and scrolling lists have now been decoupled from the values sent
1234 to your CGI script. Your script can know a checkbox by the name of
1235 "cb1" while the user knows it by a more descriptive name. I've
1236 also added some parameters that were missing from the text fields,
1237 such as MAXLENGTH.
1238 6. A whole bunch of methods have been added to get at environment
1239 variables involved in user verification and other obscure
1240 features.
1241
1242 Bug fixes
1243
1244 1. The problems with the hidden fields have (I hope at last) been
1245 fixed.
1246 2. You can create multiple query objects and they will all be
1247 initialized correctly. This simplifies the creation of multiple
1248 forms on one page.
1249 3. The URL unescaping code works correctly now.