- - - - - - - - - - regression tests - - - - - - - - - -

The following features are documented but lack automated test coverage.
Listed roughly in order of value vs. effort.

Medium priority:

- vhost.sh: two server{} blocks on different ports, each with its own
  webroot; verify the right content is served per port/hostname.

- useragent.sh: configure user-agent-deny with a pattern; verify
  matching UA gets 403, non-matching UA gets 200.

- custom-error.sh: place errors/404.html in webroot; request a missing
  file and verify the custom page content is returned.

- keepalive.sh: issue two GET requests over a single TCP connection;
  verify both succeed without the connection being closed in between.

- cache.sh: configure max-age; verify the response for a static file
  includes Cache-Control: max-age=N matching the configured value.

Lower priority (more setup required):

- throttle.sh: configure a very low byte rate for a URL pattern; time
  a transfer and verify it is rate-limited accordingly.

- ssl.sh: generate a self-signed cert; verify curl --insecure gets 200
  over HTTPS and that HTTP->HTTPS redirect works.

- symlink.sh: create a symlink pointing outside the webroot with
  check-symlinks = true; verify the request returns 403.

Skip / manual only:

- chroot.sh: requires root privileges; not suitable for CI.
- referer.sh: check-referer behaviour; finicky to test reliably.
- compression-level.sh: zlib level tuning; low regression risk.
- signal.sh: USR1/USR2 (log reopen / graceful restart); manual only.

- - - - - - - - - - before release - - - - - - - - - -

- Add 'server' section to config file,

  server title {
       host = virual-host.name
       port = PORT
       ssl  = BOOL
       redirect = site.tla:port
  }

- Let 'server' directives slowly replace vhost matching

  When virtual-host=false we can use either the title of the server
  directive or a separate host/server-name setting for matching the
  incoming requests.

- Add 'location' section to config file

  This to be able to set max-age per PATTERN rather than for all files,
  which may otherwise mess up reloading, e.g. a blog.

  location "PATTERN" {
       max-age = 2d
       add-header {
           key   = "Cache-Control"
  	 value = "public, no-transform"
       }
       gzip = true
  }

- Add proxy-pass to location directive

- Let command line options override port/host etc. that
  are in the global section of the config file.

- Verify cert at startup, abort if cert is too old or new
  add command line option to override (embedded systems)

- - - - - - - - - - high priority - - - - - - - - - -

Look into compressing CGI and ls() output using fmemopen()

IPv6 not working right.

Problem with ACME News downloads.  PATH_INFO interferes with the authorization.

Why is the client's IP address showing up in paths?

Fetches with numeric IP addresses and no Host: header are screwing up the
vhost code?
143.90.193.229 - - [06/Apr/2000:09:21:34 -0700] "GET /209.133.38.22/software/thttpd/ HTTP/1.0" 200 12093 "http://www.dbphotography.demon.co.uk/index.html" "Mozilla/1.22 (compatible; MSIE 2.0; Windows 95)"
143.90.193.229 - - [06/Apr/2000:09:21:37 -0700] "GET /143.90.193.229/software/thttpd/anvil_thttpd.gif HTTP/1.0" 403 - "http://www.acme.com/software/thttpd/" "Mozilla/1.22 (compatible; MSIE 2.0; Windows 95)"

Add comment on INDEX_NAMES that it should be simple filenames only.

The error page generated for non-local referers should include the
original URL as an active link.

Make open in mmc.c use O_NONBLOCK flag, to prevent DOS attack via
a named pipe?

- - - - - - - - - - later - - - - - - - - - -

Document how symlinks interact with .htpasswd - authorization is checked
on the result of the symlink, and not the origin.

Change redirect to put the Refresh command in the HTTP headers, instead of
a META tag.

Add TCP_NODELAY, but after CGIs get spawned.

Add stat cache?  1 minute expiry?

Ifdef the un-close-on-exec CGI thing for Linux only.

Add keep-alives, via a new state in thttpd.c.

- - - - - - - - - - someday - - - - - - - - - -

The special world-permissions checking is probably bogus.  For one
thing, it doesn't handle restrictive permissions on parent directories
properly.  It should probably just go away.

redirect should interpret a path with a trailing / as /index.html

ssi should change $cwd to the source document's location.

Allow .throttle files in individual directories.

Log-digesting scripts.

Config web page.
    Common errors:
	Not realizing that -c overrides CGI_PATTERN instead of augmenting it.
	Using a directory name for the -c pattern.

- - - - - - - - - - 3.x - - - - - - - - - -

Tasklets re-write.

- - - - - - - - - - general - - - - - - - - - -

Release process:
  - update version number in version.h README INSTALL and
    contrib/redhat-rpm/thttpd.spec
  - do a tdiff and update the local installation
  - do an rcstreeinfo, and check in all files
  - make tar
  - mv it to ..
  - update version number in ../thttpd.html
  - update ~acmeweb/updates.html
  - mail announcement to thttpd-announce
