In #1733476: Make default htaccess rules protocol sensitive to avoid man-in-the-middle-attacks if users don't fully customize the rule the question came up of whether or not we support Apache 1.3.

It seems that the Apache foundation no longer makes new releases of Apache 1.3.x since February of 2010.

For 8.x it seems like we should drop it, but maybe we can drop it from old versions as well?

Comments

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
CreditAttribution: greggles commented
Status: Needs review » Reviewed & tested by the community

Nobody complained so far.

webchick’s picture

webchick
she/they
Primary language English
Location Vancouver 🇨🇦
CreditAttribution: webchick commented

+1 here. :) Let it be so.

webchick’s picture

webchick
she/they
Primary language English
Location Vancouver 🇨🇦
CreditAttribution: webchick commented

Errr. To D8 that is. D7 should "technically" be ok too since it wasn't released until January 2011, but you'd want to ping David about that. Not sure about D6 though; It was released in 2008, which is well within Apache 1.3's heyday.

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
CreditAttribution: greggles commented

It's true that D6 as it was originally released should work on 1.3, but I think the question still remains if we still can/should support it. For a completely hypothetical example: if we're working on a security issue and there's a fix that works on Apache 2.x+ but not 1.3, is that OK to release for D6? In my opinion it's fine because nobody should be running 1.3 any more since it's long EOL and no doubt insecure.

webchick’s picture

webchick
she/they
Primary language English
Location Vancouver 🇨🇦
CreditAttribution: webchick commented

Yeah, fair enough. But I think there's a difference between extenuating circumstances like that and saying we don't support Apache 1.3 at all. I mean, we still support IE*6* in Drupal 7, and that was EOLed probably a decade ago by now. :P

I just have no idea what the prevalence of Apache 1.3 is out there. Any way to know? http://trends.builtwith.com/Web-Server/Apache doesn't break it down per-version, unfortunately.

Wonder if it's worth posting this through g.d.o/core just to get a wider set of eyes on it? Otherwise, we could always introduce an Apache 1.3-breaking change in D6/D7 and see what happens. :P

webchick’s picture

webchick
she/they
Primary language English
Location Vancouver 🇨🇦
CreditAttribution: webchick commented
Status: Reviewed & tested by the community » Needs review

I guess this is still in needs review after all.

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
CreditAttribution: greggles commented
Title: [no-code] Say that we no longer support Apache 1.3 » [no-code] Say that we no longer support Apache 1.3 for D8
Status: Needs review » Reviewed & tested by the community

OK, RTBC for D8 only.

We can repurpose after for previous versions.

catch’s picture

catch
he/him
Primary language English
CreditAttribution: catch commented
Version: 8.x-dev » 7.x-dev
Status: Reviewed & tested by the community » Patch (to be ported)

Fine with me for 8.x. Also there's loads of other web servers we "don't support" officially but Drupal works fine on.

I guess this status?

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
CreditAttribution: greggles commented
Status: Patch (to be ported) » Fixed

I don't feel passionate enough about the old ones at this point - http://drupal.org/node/1783056/revisions/view/2492352/2524140 for now.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.