Merge ~ahasenack/ubuntu/+source/apache2:xenial-includeoptional-1766186 into ubuntu/+source/apache2:ubuntu/xenial-devel

[Andreas Hasenack]

Please use git to review this MP. The diff generated by LP is incorrect.

Simple backport from upstream to silently ignore a not existent file path when IncludeOptional is used. I also included documentation changes, even though this version of apache only includes the generated html and not the xml source. Another drawback is that I updated only the English doc. If preferred, I can drop that from the patch.

PPA with test packages: ppa:ahasenack/apache-includeoptional-1766186 (https://launchpad.net/~ahasenack/+archive/ubuntu/apache-includeoptional-1766186/)

Testing instructions:
sudo apt install apache2 apache2-doc
echo "IncludeOptional /etc/apache2/nothere/bug*.conf" | sudo tee /etc/apache2/conf-enabled/bug.conf
echo "IncludeOptional /etc/apache2/nothere/bug.conf" | sudo tee -a /etc/apache2/conf-enabled/bug.conf
echo "IncludeOptional /etc/apache2/bug.conf" | sudo tee -a /etc/apache2/conf-enabled/bug.conf
# this will fail with the non-fixed packages, and restart fine with the fixed packages
sudo systemctl restart apache2

Browse to http://<apache-ip>/manual/en/mod/core.html#includeoptional and verify the documentation was updated:
"""
... or if a file path does not exist on the file system.
"""

Cosmic is already fixed, since it has a newer apache where the fix was applied upstream.

[Christian Ehrhardt  (paelzer)]

as in the Bionic merge +1
https://code.launchpad.net/~ahasenack/ubuntu/+source/apache2/+git/apache2/+merge/347651

[Christian Ehrhardt  (paelzer)]

review: Approve

[Andreas Hasenack (ahasenack)]

Thanks, fixed. Could you please push the upload tag for 3c6c23745e576466bebd936cd0ff92a7606619d5 (current xenial branch HEAD). I can upload this one.

[Christian Ehrhardt  (paelzer)]

Tag pushed after ppa version fixup

diff --git a/debian/changelog b/debian/changelog
index 583443c..d5870c6 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,11 @@
+apache2 (2.4.18-2ubuntu3.9) xenial; urgency=medium
+
+  * debian/patches/includeoptional-ignore-non-existent.patch: silently
+    ignore a not existent file path with IncludeOptional .  Closes LP:
+    #1766186.
+
+ -- Andreas Hasenack <[e-mail]>  Thu, 07 Jun 2018 16:43:03 -0300
+
 apache2 (2.4.18-2ubuntu3.8) xenial-security; urgency=medium
 
   * SECURITY UPDATE: DoS via missing header with AuthLDAPCharsetConfig
diff --git a/debian/patches/includeoptional-ignore-non-existent.patch b/debian/patches/includeoptional-ignore-non-existent.patch
new file mode 100644
index 0000000..cc002ad
--- /dev/null
+++ b/debian/patches/includeoptional-ignore-non-existent.patch
@@ -0,0 +1,61 @@
+Description: silently ignore a not existent file path with IncludeOptional
+ In https://bz.apache.org/bugzilla/show_bug.cgi?id=57585 some use cases
+ were reported in which IncludeOptional seems to be too strict in its
+ sanity checks.
+ .
+ This change is a proposal to relax IncludeOptional checks to silently
+ fail when a file path is not existent rather than returning SyntaxError.
+Origin: backport, https://github.com/apache/httpd/commit/a17ce7dd5e6277867ca48659f70c4bb8a11add56
+Bug: https://bz.apache.org/bugzilla/show_bug.cgi?id=57585
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/1766186
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=878920
+Last-Update: 2018-06-07
+
+--- a/server/config.c
++++ b/server/config.c
+@@ -1888,6 +1888,15 @@
+ 
+         return NULL;
+     }
++    else if (optional) {
++        /* If the optinal flag is set (like for IncludeOptional) we can
++         * tolerate that no file or directory is present and bail out.
++         */
++        apr_finfo_t finfo;
++        if (apr_stat(&finfo, fname, APR_FINFO_TYPE, ptemp) != APR_SUCCESS
++            || finfo.filetype == APR_NOFILE)
++            return NULL;
++    }
+ 
+     return ap_process_resource_config(s, fname, conftree, p, ptemp);
+ }
+@@ -1938,6 +1947,12 @@
+      */
+     rv = apr_dir_open(&dirp, path, ptemp);
+     if (rv != APR_SUCCESS) {
++        /* If the directory doesn't exist and the optional flag is set
++         * there is no need to return an error.
++         */
++        if (rv == APR_ENOENT && optional) {
++            return NULL;
++        }
+         return apr_psprintf(p, "Could not open config directory %s: %pm",
+                             path, &rv);
+     }
+--- a/docs/manual/mod/core.html.en
++++ b/docs/manual/mod/core.html.en
+@@ -2201,10 +2201,10 @@
+ </table>
+     <p>This directive allows inclusion of other configuration files
+     from within the server configuration files. It works identically to the
+-    <code class="directive"><a href="#include">Include</a></code> directive, with the
+-    exception that if wildcards do not match any file or directory, the
+-    <code class="directive"><a href="#includeoptional">IncludeOptional</a></code> directive will be
+-    silently ignored instead of causing an error.</p>
++    <code class="directive"><a href="#include">Include</a></code> directive, but it will be
++    silently ignored (instead of causing an error) if wildcards are used and
++    they do not match any file or directory or if a file path does not exist
++    on the file system.</p>
+ 
+ <h3>See also</h3>
+ <ul>
diff --git a/debian/patches/series b/debian/patches/series
index e270fe1..d2152b5 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -30,3 +30,4 @@ CVE-2018-1283.patch
 CVE-2018-1301.patch
 CVE-2018-1303.patch
 CVE-2018-1312.patch
+includeoptional-ignore-non-existent.patch
diff --git a/docs/manual/style/latex/atbeginend.sty b/docs/manual/style/latex/atbeginend.sty
new file mode 100644
index 0000000..79b555d
--- /dev/null
+++ b/docs/manual/style/latex/atbeginend.sty
@@ -0,0 +1,80 @@
+% atbeginend.sty 
+%
+% Licensed to the Apache Software Foundation (ASF) under one or more
+% contributor license agreements.  See the NOTICE file distributed with
+% this work for additional information regarding copyright ownership.
+% The ASF licenses this file to You under the Apache License, Version 2.0
+% (the "License"); you may not use this file except in compliance with
+% the License.  You may obtain a copy of the License at
+%
+%     http://www.apache.org/licenses/LICENSE-2.0
+%
+% Unless required by applicable law or agreed to in writing, software
+% distributed under the License is distributed on an "AS IS" BASIS,
+% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+% See the License for the specific language governing permissions and
+% limitations under the License.
+
+% defines
+% \BeforeBegin{environment}{code-to-execute}
+% \BeforeEnd  {environment}{code-to-execute}
+% \AfterBegin {environment}{code-to-execute}
+% \AfterEnd   {environment}{code-to-execute}
+%
+% Save \begin and \end to \BeginEnvironment and \EndEnvironment
+\let\BeginEnvironment=\begin
+\let\EndEnvironment=\end
+
+\def\IfUnDef#1{\expandafter\ifx\csname#1\endcsname\relax}
+
+% Null command needed to for \nothing{something}=.nothing.
+\def\NullCom#1{}
+
+\def\begin#1{%
+%
+% if defined \BeforeBeg for this environment, execute it
+\IfUnDef{BeforeBeg#1}\else\csname BeforeBeg#1\endcsname\fi%
+%
+%
+%
+\IfUnDef{AfterBeg#1}% This is done to skip the command for environments
+		     % which can take arguments, like multicols; YOU MUST NOT
+		     % USE \AfterBegin{...}{...} for such environments!
+	\let\SaveBegEng=\BeginEnvironment%
+\else%
+	% Start this environment
+		\BeginEnvironment{#1}%
+	% and execute code after \begin{environment}
+		\csname AfterBeg#1\endcsname%
+	% 
+	\let\SaveBegEng=\NullCom%
+\fi%
+\SaveBegEng{#1}%
+}
+
+
+\def\end#1{%
+%
+% execute code before \end{environment}
+\IfUnDef{BeforeEnd#1}\else\csname BeforeEnd#1\endcsname\fi%
+%
+% close this environment
+\EndEnvironment{#1}%
+%
+% and execute code after \begin{environment}
+\IfUnDef{AfterEnd#1}\else\csname AfterEnd#1\endcsname\fi%
+}
+
+
+%% Now, define commands
+% \BeforeBegin{environment}{code-to-execute}
+% \BeforeEnd  {environment}{code-to-execute}
+% \AfterBegin {environment}{code-to-execute}
+% \AfterEnd   {environment}{code-to-execute}
+
+\def\BeforeBegin#1#2{\expandafter\gdef\csname BeforeBeg#1\endcsname
+{#2}}
+\def\BeforeEnd  #1#2{\expandafter\gdef\csname BeforeEnd#1\endcsname
+{#2}}
+\def\AfterBegin #1#2{\expandafter\gdef\csname AfterBeg#1\endcsname {#2}}
+\def\AfterEnd   #1#2{\expandafter\gdef\csname AfterEnd#1\endcsname{#2}}
diff --git a/docs/manual/style/manualpage.dtd b/docs/manual/style/manualpage.dtd
new file mode 100644
index 0000000..e9c22a0
--- /dev/null
+++ b/docs/manual/style/manualpage.dtd
@@ -0,0 +1,29 @@
+<?xml version='1.0' encoding='UTF-8' ?>
+
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements.  See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License.  You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+
+<!ENTITY % common SYSTEM "common.dtd">
+%common;
+
+<!-- <manualpage> is the root element -->
+<!ELEMENT manualpage (parentdocument?, title, summary?,
+seealso*, section*)>
+
+<!ATTLIST manualpage metafile CDATA  #REQUIRED
+                     upgrade  CDATA  #IMPLIED
+>
diff --git a/docs/manual/style/modulesynopsis.dtd b/docs/manual/style/modulesynopsis.dtd
new file mode 100644
index 0000000..4dac5ef
--- /dev/null
+++ b/docs/manual/style/modulesynopsis.dtd
@@ -0,0 +1,77 @@
+<?xml version='1.0' encoding='UTF-8' ?>
+
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements.  See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License.  You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+
+<!ENTITY % sitemap SYSTEM "sitemap.dtd">
+%sitemap;
+
+<!ELEMENT modulesynopsis (name , description, status, hint?, sourcefile?,
+identifier? , compatibility? , summary? , seealso* , section*,
+directivesynopsis*)>
+
+<!ATTLIST modulesynopsis metafile CDATA  #REQUIRED
+                         upgrade  CDATA  #IMPLIED>
+
+<!ELEMENT directivesynopsis (name , description? , syntax? , default?
+, contextlist? , override? , modulelist?, status?, compatibility? ,
+usage?, seealso*)>
+
+<!ELEMENT name (#PCDATA)>
+
+<!ELEMENT status (#PCDATA)>
+
+<!ELEMENT hint %Inline;>
+
+<!ELEMENT identifier (#PCDATA)>
+
+<!ELEMENT sourcefile (#PCDATA)>
+
+<!ELEMENT compatibility %Inline;>
+
+<!ELEMENT description %Inline;>
+
+<!ATTLIST directivesynopsis  type CDATA  #IMPLIED
+                             location CDATA  #IMPLIED >
+
+<!ELEMENT syntax %Inline;>
+
+<!ELEMENT default (#PCDATA | directive | br)*>
+
+<!ELEMENT contextlist (context+)+>
+
+<!ELEMENT context (#PCDATA)>
+
+<!ELEMENT override (#PCDATA)>
+
+<!ELEMENT usage %Block;>
+
+<!-- Used in index.xml -->
+<!ELEMENT moduleindex (title, summary, seealso*)>
+
+<!ATTLIST moduleindex metafile CDATA  #REQUIRED>
+
+<!-- Used in directive.xml -->
+<!ELEMENT directiveindex (title | summary)+>
+
+<!ATTLIST directiveindex metafile CDATA  #REQUIRED>
+
+<!-- Used in quickreference.xml -->
+<!ELEMENT quickreference (title | summary | legend)+>
+<!ATTLIST quickreference metafile CDATA  #REQUIRED>
+
+<!ELEMENT legend (table, table)>
diff --git a/docs/manual/style/scripts/MINIFY b/docs/manual/style/scripts/MINIFY
new file mode 100644
index 0000000..2c1efc3
--- /dev/null
+++ b/docs/manual/style/scripts/MINIFY
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+(echo '// see prettify.js for copyright, license and expanded version'; python -mrjsmin <prettify.js) >prettify.min.js
+
+# needs python and rjsmin installed
diff --git a/docs/manual/style/scripts/prettify.js b/docs/manual/style/scripts/prettify.js
new file mode 100644
index 0000000..2fa959a
--- /dev/null
+++ b/docs/manual/style/scripts/prettify.js
@@ -0,0 +1,1622 @@
+// Copyright (C) 2006 Google Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+
+/**
+ * @fileoverview
+ * some functions for browser-side pretty printing of code contained in html.
+ *
+ * <p>
+ * For a fairly comprehensive set of languages see the
+ * <a href="http://google-code-prettify.googlecode.com/svn/trunk/README.html#langs">README</a>
+ * file that came with this source.  At a minimum, the lexer should work on a
+ * number of languages including C and friends, Java, Python, Bash, SQL, HTML,
+ * XML, CSS, Javascript, and Makefiles.  It works passably on Ruby, PHP and Awk
+ * and a subset of Perl, but, because of commenting conventions, doesn't work on
+ * Smalltalk, Lisp-like, or CAML-like languages without an explicit lang class.
+ * <p>
+ * Usage: <ol>
+ * <li> include this source file in an html page via
+ *   {@code <script type="text/javascript" src="/path/to/prettify.js"></script>}
+ * <li> define style rules.  See the example page for examples.
+ * <li> mark the {@code <pre>} and {@code <code>} tags in your source with
+ *    {@code class=prettyprint.}
+ *    You can also use the (html deprecated) {@code <xmp>} tag, but the pretty
+ *    printer needs to do more substantial DOM manipulations to support that, so
+ *    some css styles may not be preserved.
+ * </ol>
+ * That's it.  I wanted to keep the API as simple as possible, so there's no
+ * need to specify which language the code is in, but if you wish, you can add
+ * another class to the {@code <pre>} or {@code <code>} element to specify the
+ * language, as in {@code <pre class="prettyprint lang-java">}.  Any class that
+ * starts with "lang-" followed by a file extension, specifies the file type.
+ * See the "lang-*.js" files in this directory for code that implements
+ * per-language file handlers.
+ * <p>
+ * Change log:<br>
+ * cbeust, 2006/08/22
+ * <blockquote>
+ *   Java annotations (start with "@") are now captured as literals ("lit")
+ * </blockquote>
+ * @requires console
+ */
+
+// JSLint declarations
+/*global console, document, navigator, setTimeout, window, define */
+
+/**
+ * Split {@code prettyPrint} into multiple timeouts so as not to interfere with
+ * UI events.
+ * If set to {@code false}, {@code prettyPrint()} is synchronous.
+ */
+window['PR_SHOULD_USE_CONTINUATION'] = true;
+
+/**
+ * Find all the {@code <pre>} and {@code <code>} tags in the DOM with
+ * {@code class=prettyprint} and prettify them.
+ *
+ * @param {Function?} opt_whenDone if specified, called when the last entry
+ *     has been finished.
+ */
+var prettyPrintOne;
+/**
+ * Pretty print a chunk of code.
+ *
+ * @param {string} sourceCodeHtml code as html
+ * @return {string} code as html, but prettier
+ */
+var prettyPrint;
+
+
+(function () {
+  var win = window;
+  // Keyword lists for various languages.
+  // We use things that coerce to strings to make them compact when minified
+  // and to defeat aggressive optimizers that fold large string constants.
+  var FLOW_CONTROL_KEYWORDS = ["break,continue,do,else,for,if,return,while"];
+  var C_KEYWORDS = [FLOW_CONTROL_KEYWORDS,"auto,case,char,const,default," + 
+      "double,enum,extern,float,goto,int,long,register,short,signed,sizeof,module," +
+      "static,struct,switch,typedef,union,unsigned,void,volatile"];
+  var COMMON_KEYWORDS = [C_KEYWORDS,"catch,class,delete,false,import," +
+      "new,operator,private,protected,public,this,throw,true,try,typeof"];
+  var CPP_KEYWORDS = [COMMON_KEYWORDS,"alignof,align_union,asm,axiom,bool," +
+      "concept,concept_map,const_cast,constexpr,decltype," +
+      "dynamic_cast,explicit,export,friend,inline,late_check," +
+      "mutable,namespace,nullptr,reinterpret_cast,static_assert,static_cast," +
+      "template,typeid,typename,using,virtual,where,request_req"];
+  var JAVA_KEYWORDS = [COMMON_KEYWORDS,
+      "abstract,boolean,byte,extends,final,finally,implements,import," +
+      "instanceof,null,native,package,strictfp,super,synchronized,throws," +
+      "transient"];
+  var CSHARP_KEYWORDS = [JAVA_KEYWORDS,
+      "as,base,by,checked,decimal,delegate,descending,dynamic,event," +
+      "fixed,foreach,from,group,implicit,in,interface,internal,into,is,let," +
+      "lock,object,out,override,orderby,params,partial,readonly,ref,sbyte," +
+      "sealed,stackalloc,string,select,uint,ulong,unchecked,unsafe,ushort," +
+      "var,virtual,where"];
+  var COFFEE_KEYWORDS = "all,and,by,catch,class,else,extends,false,finally," +
+      "for,if,in,is,isnt,loop,new,no,not,null,of,off,on,or,return,super,then," +
+      "throw,true,try,unless,until,when,while,yes";
+  var JSCRIPT_KEYWORDS = [COMMON_KEYWORDS,
+      "debugger,eval,export,function,get,null,set,undefined,var,with," +
+      "Infinity,NaN"];
+  var PERL_KEYWORDS = "caller,delete,die,do,dump,else,elsif,eval,exit,foreach,for," +
+      "goto,if,import,last,local,my,next,no,our,print,printf,package,redo,require," +
+      "sub,undef,unless,until,use,wantarray,while,BEGIN,END";
+  var PHP_KEYWORDS = "abstract,and,array,as,break,case,catch,cfunction,class," +
+      "clone,const,continue,declare,default,do,else,elseif,enddeclare,endfor," + 
+      "endforeach,endif,endswitch,endwhile,extends,final,for,foreach,function," +
+      "global,goto,if,implements,interface,instanceof,namespace,new,old_function," +
+      "or,private,protected,public,static,switch,throw,try,use,var,while,xor," + 
+      "die,echo,empty,exit,eval,include,include_once,isset,list,require," + 
+      "require_once,return,print,unset";
+  var PYTHON_KEYWORDS = [FLOW_CONTROL_KEYWORDS, "and,as,assert,class,def,del," +
+      "elif,except,exec,finally,from,global,import,in,is,lambda," +
+      "nonlocal,not,or,pass,print,raise,try,with,yield," +
+      "False,True,None"];
+  var RUBY_KEYWORDS = [FLOW_CONTROL_KEYWORDS, "alias,and,begin,case,class," +
+      "def,defined,elsif,end,ensure,false,in,module,next,nil,not,or,redo," +
+      "rescue,retry,self,super,then,true,undef,unless,until,when,yield," +
+      "BEGIN,END"];
+  var SH_KEYWORDS = [FLOW_CONTROL_KEYWORDS, "case,done,elif,esac,eval,fi," +
+      "function,in,local,set,then,until,echo"];
+  var CONFIG_ENVS = ["User-Agent,HTTP_USER_AGENT,HTTP_REFERER,HTTP_COOKIE,HTTP_FORWARDED,HTTP_HOST,HTTP_PROXY_CONNECTION,HTTP_ACCEPT,REMOTE_ADDR,REMOTE_HOST,REMOTE_PORT,REMOTE_USER,REMOTE_IDENT,REQUEST_METHOD,SCRIPT_FILENAME,PATH_INFO,QUERY_STRING,AUTH_TYPE,DOCUMENT_ROOT,SERVER_ADMIN,SERVER_NAME,SERVER_ADDR,SERVER_PORT,SERVER_PROTOCOL,SERVER_SOFTWARE,TIME_YEAR,TIME_MON,TIME_DAY,TIME_HOUR,TIME_MIN,TIME_SEC,TIME_WDAY,TIME,API_VERSION,THE_REQUEST,REQUEST_URI,REQUEST_FILENAME,IS_SUBREQ,HTTPS,REQUEST_SCHEME"];
+  var CONFIG_KEYWORDS = ["Macro,UndefMacro,Use,AuthLDAPURL,AcceptFilter,AcceptPathInfo,AccessFileName,Action,AddAlt,AddAltByEncoding,AddAltByType,AddCharset,AddDefaultCharset,AddDescription,AddEncoding,AddHandler,AddIcon,AddIconByEncoding,AddIconByType,AddInputFilter,AddLanguage,AddModuleInfo,AddOutputFilter,AddOutputFilterByType,AddType,Alias,AliasMatch,Allow,AllowCONNECT,AllowEncodedSlashes,AllowMethods,AllowOverride,AllowOverrideList,Anonymous,Anonymous_LogEmail,Anonymous_MustGiveEmail,Anonymous_NoUserID,Anonymous_VerifyEmail,AsyncRequestWorkerFactor,AuthBasicAuthoritative,AuthBasicProvider,AuthDBDUserPWQuery,AuthDBDUserRealmQuery,AuthDBMGroupFile,AuthDBMType,AuthDBMUserFile,AuthDigestAlgorithm,AuthDigestDomain,AuthDigestNcCheck,AuthDigestNonceFormat,AuthDigestNonceLifetime,AuthDigestProvider,AuthDigestQop,AuthDigestShmemSize,AuthFormAuthoritative,AuthFormBody,AuthFormDisableNoStore,AuthFormFakeBasicAuth,AuthFormLocation,AuthFormLoginRequiredLocation,AuthFormLoginSuccessLocation,AuthFormLogoutLocation,AuthFormMethod,AuthFormMimetype,AuthFormPassword,AuthFormProvider,AuthFormSitePassphrase,AuthFormSize,AuthFormUsername,AuthGroupFile,AuthLDAPAuthorizePrefix,AuthLDAPBindAuthoritative,AuthLDAPBindDN,AuthLDAPBindPassword,AuthLDAPCharsetConfig,AuthLDAPCompareAsUser,AuthLDAPCompareDNOnServer,AuthLDAPDereferenceAliases,AuthLDAPGroupAttribute,AuthLDAPGroupAttributeIsDN,AuthLDAPInitialBindAsUser,AuthLDAPInitialBindPattern,AuthLDAPMaxSubGroupDepth,AuthLDAPRemoteUserAttribute,AuthLDAPRemoteUserIsDN,AuthLDAPSearchAsUser,AuthLDAPSubGroupAttribute,AuthLDAPSubGroupClass,AuthLDAPUrl,AuthMerging,AuthName,AuthnCacheContext,AuthnCacheEnable,AuthnCacheProvideFor,AuthnCacheSOCache,AuthnCacheTimeout,<AuthnProviderAlias>,AuthType,AuthUserFile,AuthzDBDLoginToReferer,AuthzDBDQuery,AuthzDBDRedirectQuery,AuthzDBMType,<AuthzProviderAlias>,AuthzSendForbiddenOnFailure,BalancerGrowth,BalancerMember,BrowserMatch,BrowserMatchNoCase,BufferedLogs,BufferSize,CacheDefaultExpire,CacheDetailHeader,CacheDirLength,CacheDirLevels,CacheDisable,CacheEnable,CacheFile,CacheHeader,CacheIgnoreCacheControl,CacheIgnoreHeaders,CacheIgnoreNoLastMod,CacheIgnoreQueryString,CacheIgnoreURLSessionIdentifiers,CacheKeyBaseURL,CacheLastModifiedFactor,CacheLock,CacheLockMaxAge,CacheLockPath,CacheMaxExpire,CacheMaxFileSize,CacheMinExpire,CacheMinFileSize,CacheNegotiatedDocs,CacheQuickHandler,CacheReadSize,CacheReadTime,CacheRoot,CacheStaleOnError,CacheStoreExpired,CacheStoreNoStore,CacheStorePrivate,CGIMapExtension,CharsetDefault,CharsetOptions,CharsetSourceEnc,CheckCaseOnly,CheckSpelling,ChrootDir,ContentDigest,CookieDomain,CookieExpires,CookieName,CookieStyle,CookieTracking,CoreDumpDirectory,CustomLog,Dav,DavDepthInfinity,DavGenericLockDB,DavLockDB,DavMinTimeout,DBDExptime,DBDInitSQL,DBDKeep,DBDMax,DBDMin,DBDParams,DBDPersist,DBDPrepareSQL,DBDriver,DefaultIcon,DefaultLanguage,DefaultRuntimeDir,DefaultType,Define,DeflateBufferSize,DeflateCompressionLevel,DeflateFilterNote,DeflateMemLevel,DeflateWindowSize,Deny,<Directory>,DirectoryIndex,DirectoryIndexRedirect,<DirectoryMatch>,DirectorySlash,DocumentRoot,DTracePrivileges,DumpIOInput,DumpIOOutput,<Else>,<ElseIf>,EnableExceptionHook,EnableMMAP,EnableSendfile,Error,ErrorDocument,ErrorLog,ErrorLogFormat,Example,ExpiresActive,ExpiresByType,ExpiresDefault,ExtendedStatus,ExtFilterDefine,ExtFilterOptions,FallbackResource,FileETag,<Files>,<FilesMatch>,FilterChain,FilterDeclare,FilterProtocol,FilterProvider,FilterTrace,ForceLanguagePriority,ForceType,ForensicLog,GprofDir,GracefulShutdownTimeout,Group,Header,HeaderName,HeartbeatAddress,HeartbeatListen,HeartbeatMaxServers,HeartbeatStorage,HeartbeatStorage,HostnameLookups,IdentityCheck,IdentityCheckTimeout,<If>,<IfDefine>,<IfModule>,<IfVersion>,ImapBase,ImapDefault,ImapMenu,Include,IncludeOptional,IndexHeadInsert,IndexIgnore,IndexIgnoreReset,IndexOptions,IndexOrderDefault,IndexStyleSheet,InputSed,ISAPIAppendLogToErrors,ISAPIAppendLogToQuery,ISAPICacheFile,ISAPIFakeAsync,ISAPILogNotSupported,ISAPIReadAheadBuffer,KeepAlive,KeepAliveTimeout,KeptBodySize,LanguagePriority,LDAPCacheEntries,LDAPCacheTTL,LDAPConnectionPoolTTL,LDAPConnectionTimeout,LDAPLibraryDebug,LDAPOpCacheEntries,LDAPOpCacheTTL,LDAPReferralHopLimit,LDAPReferrals,LDAPRetries,LDAPRetryDelay,LDAPSharedCacheFile,LDAPSharedCacheSize,LDAPTimeout,LDAPTrustedClientCert,LDAPTrustedGlobalCert,LDAPTrustedMode,LDAPVerifyServerCert,<Limit>,<LimitExcept>,LimitInternalRecursion,LimitRequestBody,LimitRequestFields,LimitRequestFieldSize,LimitRequestLine,LimitXMLRequestBody,Listen,ListenBackLog,LoadFile,LoadModule,<Location>,<LocationMatch>,LogFormat,LogLevel,LogMessage,LuaCodeCache,LuaHookAccessChecker,LuaHookAuthChecker,LuaAuthzProvider,LuaHookCheckUserID,LuaHookFixups,LuaHookInsertFilter,LuaHookMapToStorage,LuaHookTranslateName,LuaHookTypeChecker,LuaInherit,LuaInputFilter,LuaMapHandler,LuaOutputFilter,LuaPackageCPath,LuaPackagePath,LuaQuickHandler,LuaRoot,LuaScope,MaxConnectionsPerChild,MaxKeepAliveRequests,MaxMemFree,MaxRangeOverlaps,MaxRangeReversals,MaxRanges,MaxRequestWorkers,MaxSpareServers,MaxSpareThreads,MaxThreads,MetaDir,MetaFiles,MetaSuffix,MimeMagicFile,MinSpareServers,MinSpareThreads,MMapFile,ModemStandard,ModMimeUsePathInfo,MultiviewsMatch,Mutex,NameVirtualHost,NoProxy,NWSSLTrustedCerts,NWSSLUpgradeable,Options,Order,OutputSed,PassEnv,PidFile,PrivilegesMode,Protocol,ProtocolEcho,<Proxy>,ProxyAddHeaders,ProxyBadHeader,ProxyBlock,ProxyDomain,ProxyErrorOverride,ProxyExpressDBMFile,ProxyExpressDBMType,ProxyExpressEnable,ProxyFtpDirCharset,ProxyFtpEscapeWildcards,ProxyFtpListOnWildcard,ProxyHTMLBufSize,ProxyHTMLCharsetOut,ProxyHTMLDocType,ProxyHTMLEnable,ProxyHTMLEvents,ProxyHTMLExtended,ProxyHTMLFixups,ProxyHTMLInterp,ProxyHTMLLinks,ProxyHTMLStripComments,ProxyHTMLURLMap,ProxyIOBufferSize,<ProxyMatch>,ProxyMaxForwards,ProxyPass,ProxyPassInterpolateEnv,ProxyPassMatch,ProxyPassReverse,ProxyPassReverseCookieDomain,ProxyPassReverseCookiePath,ProxyPreserveHost,ProxyReceiveBufferSize,ProxyRemote,ProxyRemoteMatch,ProxyRequests,ProxySCGIInternalRedirect,ProxySCGISendfile,ProxySet,ProxySourceAddress,ProxyStatus,ProxyTimeout,ProxyVia,ReadmeName,ReceiveBufferSize,Redirect,RedirectMatch,RedirectPermanent,RedirectTemp,ReflectorHeader,RemoteIPHeader,RemoteIPInternalProxy,RemoteIPInternalProxyList,RemoteIPProxiesHeader,RemoteIPTrustedProxy,RemoteIPTrustedProxyList,RemoveCharset,RemoveEncoding,RemoveHandler,RemoveInputFilter,RemoveLanguage,RemoveOutputFilter,RemoveType,RequestHeader,RequestReadTimeout,Require,<RequireAll>,<RequireAny>,<RequireNone>,RewriteBase,RewriteCond,RewriteEngine,RewriteMap,RewriteOptions,RewriteRule,RLimitCPU,RLimitMEM,RLimitNPROC,Satisfy,ScoreBoardFile,Script,ScriptAlias,ScriptAliasMatch,ScriptInterpreterSource,ScriptLog,ScriptLogBuffer,ScriptLogLength,ScriptSock,SecureListen,SeeRequestTail,SendBufferSize,ServerAdmin,ServerAlias,ServerLimit,ServerName,ServerPath,ServerRoot,ServerSignature,ServerTokens,Session,SessionCookieName,SessionCookieName2,SessionCookieRemove,SessionCryptoCipher,SessionCryptoDriver,SessionCryptoPassphrase,SessionCryptoPassphraseFile,SessionDBDCookieName,SessionDBDCookieName2,SessionDBDCookieRemove,SessionDBDDeleteLabel,SessionDBDInsertLabel,SessionDBDPerUser,SessionDBDSelectLabel,SessionDBDUpdateLabel,SessionEnv,SessionExclude,SessionHeader,SessionInclude,SessionMaxAge,SetEnv,SetEnvIf,SetEnvIfExpr,SetEnvIfNoCase,SetHandler,SetInputFilter,SetOutputFilter,SSIEndTag,SSIErrorMsg,SSIETag,SSILastModified,SSILegacyExprParser,SSIStartTag,SSITimeFormat,SSIUndefinedEcho,SSLCACertificateFile,SSLCACertificatePath,SSLCADNRequestFile,SSLCADNRequestPath,SSLCARevocationCheck,SSLCARevocationFile,SSLCARevocationPath,SSLCertificateChainFile,SSLCertificateFile,SSLCertificateKeyFile,SSLCipherSuite,SSLCryptoDevice,SSLEngine,SSLFIPS,SSLHonorCipherOrder,SSLInsecureRenegotiation,SSLOCSPDefaultResponder,SSLOCSPEnable,SSLOCSPOverrideResponder,SSLOCSPResponderTimeout,SSLOCSPResponseMaxAge,SSLOCSPResponseTimeSkew,SSLOptions,SSLPassPhraseDialog,SSLProtocol,SSLProxyCACertificateFile,SSLProxyCACertificatePath,SSLProxyCARevocationCheck,SSLProxyCARevocationFile,SSLProxyCARevocationPath,SSLProxyCheckPeerCN,SSLProxyCheckPeerExpire,SSLProxyCipherSuite,SSLProxyEngine,SSLProxyMachineCertificateChainFile,SSLProxyMachineCertificateFile,SSLProxyMachineCertificatePath,SSLProxyProtocol,SSLProxyVerify,SSLProxyVerifyDepth,SSLRandomSeed,SSLRenegBufferSize,SSLRequire,SSLRequireSSL,SSLSessionCache,SSLSessionCacheTimeout,SSLSessionTicketKeyFile,SSLStaplingCache,SSLStaplingErrorCacheTimeout,SSLStaplingFakeTryLater,SSLStaplingForceURL,SSLStaplingResponderTimeout,SSLStaplingResponseMaxAge,SSLStaplingResponseTimeSkew,SSLStaplingReturnResponderErrors,SSLStaplingStandardCacheTimeout,SSLStrictSNIVHostCheck,SSLUserName,SSLUseStapling,SSLVerifyClient,SSLVerifyDepth,StartServers,StartThreads,Substitute,Suexec,SuexecUserGroup,ThreadLimit,ThreadsPerChild,ThreadStackSize,TimeOut,TraceEnable,TransferLog,TypesConfig,UnDefine,UnsetEnv,UseCanonicalName,UseCanonicalPhysicalPort,User,UserDir,VHostCGIMode,VHostCGIPrivs,VHostGroup,VHostPrivs,VHostSecure,VHostUser,VirtualDocumentRoot,VirtualDocumentRootIP,<VirtualHost>,VirtualScriptAlias,VirtualScriptAliasIP,WatchdogInterval,XBitHack,xml2EncAlias,xml2EncDefault,xml2StartParse,RewriteLog,RewriteLogLevel"];
+  var CONFIG_OPTIONS = /^[\\+\\-]?(AuthConfig|IncludesNOEXEC|ExecCGI|FollowSymLinks|MultiViews|Includes|Indexes|SymLinksIfOwnerMatch)\b/i;
+  var ALL_KEYWORDS = [
+      CPP_KEYWORDS, CSHARP_KEYWORDS, JSCRIPT_KEYWORDS, PERL_KEYWORDS +
+      PYTHON_KEYWORDS, RUBY_KEYWORDS, SH_KEYWORDS, CONFIG_KEYWORDS, PHP_KEYWORDS];
+  var C_TYPES = /^(DIR|FILE|vector|(de|priority_)?queue|list|stack|(const_)?iterator|(multi)?(set|map)|bitset|u?(int|float|char|void|const|static|struct)\d*(_t)?\b)|[a-z_]+_rec|cmd_parms\b/;
+
+  // token style names.  correspond to css classes
+  /**
+   * token style for a string literal
+   * @const
+   */
+  var PR_STRING = 'str';
+  /**
+   * token style for a keyword
+   * @const
+   */
+  var PR_KEYWORD = 'kwd';
+  /**
+   * token style for a comment
+   * @const
+   */
+  var PR_COMMENT = 'com';
+  /**
+   * token style for a type
+   * @const
+   */
+  var PR_TYPE = 'typ';
+  /**
+   * token style for a literal value.  e.g. 1, null, true.
+   * @const
+   */
+  var PR_LITERAL = 'lit';
+  /**
+   * token style for a punctuation string.
+   * @const
+   */
+  var PR_PUNCTUATION = 'pun';
+  /**
+   * token style for plain text.
+   * @const
+   */
+  var PR_PLAIN = 'pln';
+
+  /**
+   * token style for an sgml tag.
+   * @const
+   */
+  var PR_TAG = 'tag';
+  /**
+   * token style for a markup declaration such as a DOCTYPE.
+   * @const
+   */
+  var PR_DECLARATION = 'dec';
+  /**
+   * token style for embedded source.
+   * @const
+   */
+  var PR_SOURCE = 'src';
+  /**
+   * token style for an sgml attribute name.
+   * @const
+   */
+  var PR_ATTRIB_NAME = 'atn';
+  /**
+   * token style for an sgml attribute value.
+   * @const
+   */
+  var PR_ATTRIB_VALUE = 'atv';
+
+  /**
+   * A class that indicates a section of markup that is not code, e.g. to allow
+   * embedding of line numbers within code listings.
+   * @const
+   */
+  var PR_NOCODE = 'nocode';
+
+
+
+/**
+ * A set of tokens that can precede a regular expression literal in
+ * javascript
+ * http://web.archive.org/web/20070717142515/http://www.mozilla.org/js/language/js20/rationale/syntax.html
+ * has the full list, but I've removed ones that might be problematic when
+ * seen in languages that don't support regular expression literals.
+ *
+ * <p>Specifically, I've removed any keywords that can't precede a regexp
+ * literal in a syntactically legal javascript program, and I've removed the
+ * "in" keyword since it's not a keyword in many languages, and might be used
+ * as a count of inches.
+ *
+ * <p>The link above does not accurately describe EcmaScript rules since
+ * it fails to distinguish between (a=++/b/i) and (a++/b/i) but it works
+ * very well in practice.
+ *
+ * @private
+ * @const
+ */
+var REGEXP_PRECEDER_PATTERN = '(?:^^\\.?|[+-]|[!=]=?=?|\\#|%=?|&&?=?|\\(|\\*=?|[+\\-]=|->|\\/=?|::?|<<?=?|>>?>?=?|,|;|\\?|@|\\[|~|{|\\^\\^?=?|\\|\\|?=?|break|case|continue|delete|do|else|finally|instanceof|return|throw|try|typeof)\\s*';
+
+// CAVEAT: this does not properly handle the case where a regular
+// expression immediately follows another since a regular expression may
+// have flags for case-sensitivity and the like.  Having regexp tokens
+// adjacent is not valid in any language I'm aware of, so I'm punting.
+// TODO: maybe style special characters inside a regexp as punctuation.
+
+
+  /**
+   * Given a group of {@link RegExp}s, returns a {@code RegExp} that globally
+   * matches the union of the sets of strings matched by the input RegExp.
+   * Since it matches globally, if the input strings have a start-of-input
+   * anchor (/^.../), it is ignored for the purposes of unioning.
+   * @param {Array.<RegExp>} regexs non multiline, non-global regexs.
+   * @return {RegExp} a global regex.
+   */
+  function combinePrefixPatterns(regexs) {
+    var capturedGroupIndex = 0;
+  
+    var needToFoldCase = false;
+    var ignoreCase = false;
+    for (var i = 0, n = regexs.length; i < n; ++i) {
+      var regex = regexs[i];
+      if (regex.ignoreCase) {
+        ignoreCase = true;
+      } else if (/[a-z]/i.test(regex.source.replace(
+                     /\\u[0-9a-f]{4}|\\x[0-9a-f]{2}|\\[^ux]/gi, ''))) {
+        needToFoldCase = true;
+        ignoreCase = false;
+        break;
+      }
+    }
+  
+    var escapeCharToCodeUnit = {
+      'b': 8,
+      't': 9,
+      'n': 0xa,
+      'v': 0xb,
+      'f': 0xc,
+      'r': 0xd
+    };
+  
+    function decodeEscape(charsetPart) {
+      var cc0 = charsetPart.charCodeAt(0);
+      if (cc0 !== 92 /* \\ */) {
+        return cc0;
+      }
+      var c1 = charsetPart.charAt(1);
+      cc0 = escapeCharToCodeUnit[c1];
+      if (cc0) {
+        return cc0;
+      } else if ('0' <= c1 && c1 <= '7') {
+        return parseInt(charsetPart.substring(1), 8);
+      } else if (c1 === 'u' || c1 === 'x') {
+        return parseInt(charsetPart.substring(2), 16);
+      } else {
+        return charsetPart.charCodeAt(1);
+      }
+    }
+  
+    function encodeEscape(charCode) {
+      if (charCode < 0x20) {
+        return (charCode < 0x10 ? '\\x0' : '\\x') + charCode.toString(16);
+      }
+      var ch = String.fromCharCode(charCode);
+      return (ch === '\\' || ch === '-' || ch === ']' || ch === '^')
+          ? "\\" + ch : ch;
+    }
+  
+    function caseFoldCharset(charSet) {
+      var charsetParts = charSet.substring(1, charSet.length - 1).match(
+          new RegExp(
+              '\\\\u[0-9A-Fa-f]{4}'
+              + '|\\\\x[0-9A-Fa-f]{2}'
+              + '|\\\\[0-3][0-7]{0,2}'
+              + '|\\\\[0-7]{1,2}'
+              + '|\\\\[\\s\\S]'
+              + '|-'
+              + '|[^-\\\\]',
+              'g'));
+      var ranges = [];
+      var inverse = charsetParts[0] === '^';
+  
+      var out = ['['];
+      if (inverse) { out.push('^'); }
+  
+      for (var i = inverse ? 1 : 0, n = charsetParts.length; i < n; ++i) {
+        var p = charsetParts[i];
+        if (/\\[bdsw]/i.test(p)) {  // Don't muck with named groups.
+          out.push(p);
+        } else {
+          var start = decodeEscape(p);
+          var end;
+          if (i + 2 < n && '-' === charsetParts[i + 1]) {
+            end = decodeEscape(charsetParts[i + 2]);
+            i += 2;
+          } else {
+            end = start;
+          }
+          ranges.push([start, end]);
+          // If the range might intersect letters, then expand it.
+          // This case handling is too simplistic.
+          // It does not deal with non-latin case folding.
+          // It works for latin source code identifiers though.
+          if (!(end < 65 || start > 122)) {
+            if (!(end < 65 || start > 90)) {
+              ranges.push([Math.max(65, start) | 32, Math.min(end, 90) | 32]);
+            }
+            if (!(end < 97 || start > 122)) {
+              ranges.push([Math.max(97, start) & ~32, Math.min(end, 122) & ~32]);
+            }
+          }
+        }
+      }
+  
+      // [[1, 10], [3, 4], [8, 12], [14, 14], [16, 16], [17, 17]]
+      // -> [[1, 12], [14, 14], [16, 17]]
+      ranges.sort(function (a, b) { return (a[0] - b[0]) || (b[1]  - a[1]); });
+      var consolidatedRanges = [];
+      var lastRange = [];
+      for (var i = 0; i < ranges.length; ++i) {
+        var range = ranges[i];
+        if (range[0] <= lastRange[1] + 1) {
+          lastRange[1] = Math.max(lastRange[1], range[1]);
+        } else {
+          consolidatedRanges.push(lastRange = range);
+        }
+      }
+  
+      for (var i = 0; i < consolidatedRanges.length; ++i) {
+        var range = consolidatedRanges[i];
+        out.push(encodeEscape(range[0]));
+        if (range[1] > range[0]) {
+          if (range[1] + 1 > range[0]) { out.push('-'); }
+          out.push(encodeEscape(range[1]));
+        }
+      }
+      out.push(']');
+      return out.join('');
+    }
+  
+    function allowAnywhereFoldCaseAndRenumberGroups(regex) {
+      // Split into character sets, escape sequences, punctuation strings
+      // like ('(', '(?:', ')', '^'), and runs of characters that do not
+      // include any of the above.
+      var parts = regex.source.match(
+          new RegExp(
+              '(?:'
+              + '\\[(?:[^\\x5C\\x5D]|\\\\[\\s\\S])*\\]'  // a character set
+              + '|\\\\u[A-Fa-f0-9]{4}'  // a unicode escape
+              + '|\\\\x[A-Fa-f0-9]{2}'  // a hex escape
+              + '|\\\\[0-9]+'  // a back-reference or octal escape
+              + '|\\\\[^ux0-9]'  // other escape sequence
+              + '|\\(\\?[:!=]'  // start of a non-capturing group
+              + '|[\\(\\)\\^]'  // start/end of a group, or line start
+              + '|[^\\x5B\\x5C\\(\\)\\^]+'  // run of other characters
+              + ')',
+              'g'));
+      var n = parts.length;
+  
+      // Maps captured group numbers to the number they will occupy in
+      // the output or to -1 if that has not been determined, or to
+      // undefined if they need not be capturing in the output.
+      var capturedGroups = [];
+  
+      // Walk over and identify back references to build the capturedGroups
+      // mapping.
+      for (var i = 0, groupIndex = 0; i < n; ++i) {
+        var p = parts[i];
+        if (p === '(') {
+          // groups are 1-indexed, so max group index is count of '('
+          ++groupIndex;
+        } else if ('\\' === p.charAt(0)) {
+          var decimalValue = +p.substring(1);
+          if (decimalValue) {
+            if (decimalValue <= groupIndex) {
+              capturedGroups[decimalValue] = -1;
+            } else {
+              // Replace with an unambiguous escape sequence so that
+              // an octal escape sequence does not turn into a backreference
+              // to a capturing group from an earlier regex.
+              parts[i] = encodeEscape(decimalValue);
+            }
+          }
+        }
+      }
+  
+      // Renumber groups and reduce capturing groups to non-capturing groups
+      // where possible.
+      for (var i = 1; i < capturedGroups.length; ++i) {
+        if (-1 === capturedGroups[i]) {
+          capturedGroups[i] = ++capturedGroupIndex;
+        }
+      }
+      for (var i = 0, groupIndex = 0; i < n; ++i) {
+        var p = parts[i];
+        if (p === '(') {
+          ++groupIndex;
+          if (!capturedGroups[groupIndex]) {
+            parts[i] = '(?:';
+          }
+        } else if ('\\' === p.charAt(0)) {
+          var decimalValue = +p.substring(1);
+          if (decimalValue && decimalValue <= groupIndex) {
+            parts[i] = '\\' + capturedGroups[decimalValue];
+          }
+        }
+      }
+  
+      // Remove any prefix anchors so that the output will match anywhere.
+      // ^^ really does mean an anchored match though.
+      for (var i = 0; i < n; ++i) {
+        if ('^' === parts[i] && '^' !== parts[i + 1]) { parts[i] = ''; }
+      }
+  
+      // Expand letters to groups to handle mixing of case-sensitive and
+      // case-insensitive patterns if necessary.
+      if (regex.ignoreCase && needToFoldCase) {
+        for (var i = 0; i < n; ++i) {
+          var p = parts[i];
+          var ch0 = p.charAt(0);
+          if (p.length >= 2 && ch0 === '[') {
+            parts[i] = caseFoldCharset(p);
+          } else if (ch0 !== '\\') {
+            // TODO: handle letters in numeric escapes.
+            parts[i] = p.replace(
+                /[a-zA-Z]/g,
+                function (ch) {
+                  var cc = ch.charCodeAt(0);
+                  return '[' + String.fromCharCode(cc & ~32, cc | 32) + ']';
+                });
+          }
+        }
+      }
+  
+      return parts.join('');
+    }
+  
+    var rewritten = [];
+    for (var i = 0, n = regexs.length; i < n; ++i) {
+      var regex = regexs[i];
+      if (regex.global || regex.multiline) { throw new Error('' + regex); }
+      rewritten.push(
+          '(?:' + allowAnywhereFoldCaseAndRenumberGroups(regex) + ')');
+    }
+  
+    return new RegExp(rewritten.join('|'), ignoreCase ? 'gi' : 'g');
+  }
+
+
+  /**
+   * Split markup into a string of source code and an array mapping ranges in
+   * that string to the text nodes in which they appear.
+   *
+   * <p>
+   * The HTML DOM structure:</p>
+   * <pre>
+   * (Element   "p"
+   *   (Element "b"
+   *     (Text  "print "))       ; #1
+   *   (Text    "'Hello '")      ; #2
+   *   (Element "br")            ; #3
+   *   (Text    "  + 'World';")) ; #4
+   * </pre>
+   * <p>
+   * corresponds to the HTML
+   * {@code <p><b>print </b>'Hello '<br>  + 'World';</p>}.</p>
+   *
+   * <p>
+   * It will produce the output:</p>
+   * <pre>
+   * {
+   *   sourceCode: "print 'Hello '\n  + 'World';",
+   *   //                     1          2
+   *   //           012345678901234 5678901234567
+   *   spans: [0, #1, 6, #2, 14, #3, 15, #4]
+   * }
+   * </pre>
+   * <p>
+   * where #1 is a reference to the {@code "print "} text node above, and so
+   * on for the other text nodes.
+   * </p>
+   *
+   * <p>
+   * The {@code} spans array is an array of pairs.  Even elements are the start
+   * indices of substrings, and odd elements are the text nodes (or BR elements)
+   * that contain the text for those substrings.
+   * Substrings continue until the next index or the end of the source.
+   * </p>
+   *
+   * @param {Node} node an HTML DOM subtree containing source-code.
+   * @param {boolean} isPreformatted true if white-space in text nodes should
+   *    be considered significant.
+   * @return {Object} source code and the text nodes in which they occur.
+   */
+  function extractSourceSpans(node, isPreformatted) {
+    var nocode = /(?:^|\s)nocode(?:\s|$)/;
+  
+    var chunks = [];
+    var length = 0;
+    var spans = [];
+    var k = 0;
+  
+    function walk(node) {
+      switch (node.nodeType) {
+        case 1:  // Element
+          if (nocode.test(node.className)) { return; }
+          for (var child = node.firstChild; child; child = child.nextSibling) {
+            walk(child);
+          }
+          var nodeName = node.nodeName.toLowerCase();
+          if ('br' === nodeName || 'li' === nodeName) {
+            chunks[k] = '\n';
+            spans[k << 1] = length++;
+            spans[(k++ << 1) | 1] = node;
+          }
+          break;
+        case 3: case 4:  // Text
+          var text = node.nodeValue;
+          if (text.length) {
+            if (!isPreformatted) {
+              text = text.replace(/[ \t\r\n]+/g, ' ');
+            } else {
+              text = text.replace(/\r\n?/g, '\n');  // Normalize newlines.
+              text = text.replace(/^(\r?\n\s*)+/g, '');  // Remove leading newlines
+              text = text.replace(/^\s*/g, '');  // Remove leading spaces due to indented formatting
+              text = text.replace(/(\r?\n\s*)+$/g, '');  // Remove ending newlines
+              
+            }
+            // TODO: handle tabs here?
+            chunks[k] = text;
+            spans[k << 1] = length;
+            length += text.length;
+            spans[(k++ << 1) | 1] = node;
+          }
+          break;
+      }
+    }
+  
+    walk(node);
+  
+    return {
+      sourceCode: chunks.join('').replace(/\n$/, ''),
+      spans: spans
+    };
+  }
+
+
+  /**
+   * Apply the given language handler to sourceCode and add the resulting
+   * decorations to out.
+   * @param {number} basePos the index of sourceCode within the chunk of source
+   *    whose decorations are already present on out.
+   */
+  function appendDecorations(basePos, sourceCode, langHandler, out) {
+    if (!sourceCode) { return; }
+    var job = {
+      sourceCode: sourceCode,
+      basePos: basePos
+    };
+    langHandler(job);
+    out.push.apply(out, job.decorations);
+  }
+
+  var notWs = /\S/;
+
+  /**
+   * Given an element, if it contains only one child element and any text nodes
+   * it contains contain only space characters, return the sole child element.
+   * Otherwise returns undefined.
+   * <p>
+   * This is meant to return the CODE element in {@code <pre><code ...>} when
+   * there is a single child element that contains all the non-space textual
+   * content, but not to return anything where there are multiple child elements
+   * as in {@code <pre><code>...</code><code>...</code></pre>} or when there
+   * is textual content.
+   */
+  function childContentWrapper(element) {
+    var wrapper = undefined;
+    for (var c = element.firstChild; c; c = c.nextSibling) {
+      var type = c.nodeType;
+      wrapper = (type === 1)  // Element Node
+          ? (wrapper ? element : c)
+          : (type === 3)  // Text Node
+          ? (notWs.test(c.nodeValue) ? element : wrapper)
+          : wrapper;
+    }
+    return wrapper === element ? undefined : wrapper;
+  }
+
+  /** Given triples of [style, pattern, context] returns a lexing function,
+    * The lexing function interprets the patterns to find token boundaries and
+    * returns a decoration list of the form
+    * [index_0, style_0, index_1, style_1, ..., index_n, style_n]
+    * where index_n is an index into the sourceCode, and style_n is a style
+    * constant like PR_PLAIN.  index_n-1 <= index_n, and style_n-1 applies to
+    * all characters in sourceCode[index_n-1:index_n].
+    *
+    * The stylePatterns is a list whose elements have the form
+    * [style : string, pattern : RegExp, DEPRECATED, shortcut : string].
+    *
+    * Style is a style constant like PR_PLAIN, or can be a string of the
+    * form 'lang-FOO', where FOO is a language extension describing the
+    * language of the portion of the token in $1 after pattern executes.
+    * E.g., if style is 'lang-lisp', and group 1 contains the text
+    * '(hello (world))', then that portion of the token will be passed to the
+    * registered lisp handler for formatting.
+    * The text before and after group 1 will be restyled using this decorator
+    * so decorators should take care that this doesn't result in infinite
+    * recursion.  For example, the HTML lexer rule for SCRIPT elements looks
+    * something like ['lang-js', /<[s]cript>(.+?)<\/script>/].  This may match
+    * '<script>foo()<\/script>', which would cause the current decorator to
+    * be called with '<script>' which would not match the same rule since
+    * group 1 must not be empty, so it would be instead styled as PR_TAG by
+    * the generic tag rule.  The handler registered for the 'js' extension would
+    * then be called with 'foo()', and finally, the current decorator would
+    * be called with '<\/script>' which would not match the original rule and
+    * so the generic tag rule would identify it as a tag.
+    *
+    * Pattern must only match prefixes, and if it matches a prefix, then that
+    * match is considered a token with the same style.
+    *
+    * Context is applied to the last non-whitespace, non-comment token
+    * recognized.
+    *
+    * Shortcut is an optional string of characters, any of which, if the first
+    * character, gurantee that this pattern and only this pattern matches.
+    *
+    * @param {Array} shortcutStylePatterns patterns that always start with
+    *   a known character.  Must have a shortcut string.
+    * @param {Array} fallthroughStylePatterns patterns that will be tried in
+    *   order if the shortcut ones fail.  May have shortcuts.
+    *
+    * @return {function (Object)} a
+    *   function that takes source code and returns a list of decorations.
+    */
+  function createSimpleLexer(shortcutStylePatterns, fallthroughStylePatterns) {
+    var shortcuts = {};
+    var tokenizer;
+    (function () {
+      var allPatterns = shortcutStylePatterns.concat(fallthroughStylePatterns);
+      var allRegexs = [];
+      var regexKeys = {};
+      for (var i = 0, n = allPatterns.length; i < n; ++i) {
+        var patternParts = allPatterns[i];
+        var shortcutChars = patternParts[3];
+        if (shortcutChars) {
+          for (var c = shortcutChars.length; --c >= 0;) {
+            shortcuts[shortcutChars.charAt(c)] = patternParts;
+          }
+        }
+        var regex = patternParts[1];
+        var k = '' + regex;
+        if (!regexKeys.hasOwnProperty(k)) {
+          allRegexs.push(regex);
+          regexKeys[k] = null;
+        }
+      }
+      allRegexs.push(/[\0-\uffff]/);
+      tokenizer = combinePrefixPatterns(allRegexs);
+    })();
+
+    var nPatterns = fallthroughStylePatterns.length;
+
+    /**
+     * Lexes job.sourceCode and produces an output array job.decorations of
+     * style classes preceded by the position at which they start in
+     * job.sourceCode in order.
+     *
+     * @param {Object} job an object like <pre>{
+     *    sourceCode: {string} sourceText plain text,
+     *    basePos: {int} position of job.sourceCode in the larger chunk of
+     *        sourceCode.
+     * }</pre>
+     */
+    var decorate = function (job) {
+      var sourceCode = job.sourceCode, basePos = job.basePos;
+      /** Even entries are positions in source in ascending order.  Odd enties
+        * are style markers (e.g., PR_COMMENT) that run from that position until
+        * the end.
+        * @type {Array.<number|string>}
+        */
+      var decorations = [basePos, PR_PLAIN];
+      var pos = 0;  // index into sourceCode
+      var tokens = sourceCode.match(tokenizer) || [];
+      var styleCache = {};
+
+      for (var ti = 0, nTokens = tokens.length; ti < nTokens; ++ti) {
+        var token = tokens[ti];
+        var style = styleCache[token];
+        var match = void 0;
+
+        var isEmbedded;
+        if (typeof style === 'string') {
+          isEmbedded = false;
+        } else {
+          var patternParts = shortcuts[token.charAt(0)];
+          if (patternParts) {
+            match = token.match(patternParts[1]);
+            style = patternParts[0];
+          } else {
+            for (var i = 0; i < nPatterns; ++i) {
+              patternParts = fallthroughStylePatterns[i];
+              match = token.match(patternParts[1]);
+              if (match) {
+                style = patternParts[0];
+                break;
+              }
+            }
+
+            if (!match) {  // make sure that we make progress
+              style = PR_PLAIN;
+            }
+          }
+
+          isEmbedded = style.length >= 5 && 'lang-' === style.substring(0, 5);
+          if (isEmbedded && !(match && typeof match[1] === 'string')) {
+            isEmbedded = false;
+            style = PR_SOURCE;
+          }
+
+          if (!isEmbedded) { styleCache[token] = style; }
+        }
+
+        var tokenStart = pos;
+        pos += token.length;
+
+        if (!isEmbedded) {
+          decorations.push(basePos + tokenStart, style);
+        } else {  // Treat group 1 as an embedded block of source code.
+          var embeddedSource = match[1];
+          var embeddedSourceStart = token.indexOf(embeddedSource);
+          var embeddedSourceEnd = embeddedSourceStart + embeddedSource.length;
+          if (match[2]) {
+            // If embeddedSource can be blank, then it would match at the
+            // beginning which would cause us to infinitely recurse on the
+            // entire token, so we catch the right context in match[2].
+            embeddedSourceEnd = token.length - match[2].length;
+            embeddedSourceStart = embeddedSourceEnd - embeddedSource.length;
+          }
+          var lang = style.substring(5);
+          // Decorate the left of the embedded source
+          appendDecorations(
+              basePos + tokenStart,
+              token.substring(0, embeddedSourceStart),
+              decorate, decorations);
+          // Decorate the embedded source
+          appendDecorations(
+              basePos + tokenStart + embeddedSourceStart,
+              embeddedSource,
+              langHandlerForExtension(lang, embeddedSource),
+              decorations);
+          // Decorate the right of the embedded section
+          appendDecorations(
+              basePos + tokenStart + embeddedSourceEnd,
+              token.substring(embeddedSourceEnd),
+              decorate, decorations);
+        }
+      }
+      job.decorations = decorations;
+    };
+    return decorate;
+  }
+
+  /** returns a function that produces a list of decorations from source text.
+    *
+    * This code treats ", ', and ` as string delimiters, and \ as a string
+    * escape.  It does not recognize perl's qq() style strings.
+    * It has no special handling for double delimiter escapes as in basic, or
+    * the tripled delimiters used in python, but should work on those regardless
+    * although in those cases a single string literal may be broken up into
+    * multiple adjacent string literals.
+    *
+    * It recognizes C, C++, and shell style comments.
+    *
+    * @param {Object} options a set of optional parameters.
+    * @return {function (Object)} a function that examines the source code
+    *     in the input job and builds the decoration list.
+    */
+  function sourceDecorator(options) {
+    var shortcutStylePatterns = [], fallthroughStylePatterns = [];
+    if (options['tripleQuotedStrings']) {
+      // '''multi-line-string''', 'single-line-string', and double-quoted
+      shortcutStylePatterns.push(
+          [PR_STRING,  /^(?:\'\'\'(?:[^\'\\]|\\[\s\S]|\'{1,2}(?=[^\']))*(?:\'\'\'|$)|\"\"\"(?:[^\"\\]|\\[\s\S]|\"{1,2}(?=[^\"]))*(?:\"\"\"|$)|\'(?:[^\\\']|\\[\s\S])*(?:\'|$)|\"(?:[^\\\"]|\\[\s\S])*(?:\"|$))/,
+           null, '\'"']);
+    } else if (options['multiLineStrings']) {
+      // 'multi-line-string', "multi-line-string"
+      shortcutStylePatterns.push(
+          [PR_STRING,  /^(?:\'(?:[^\\\']|\\[\s\S])*(?:\'|$)|\"(?:[^\\\"]|\\[\s\S])*(?:\"|$)|\`(?:[^\\\`]|\\[\s\S])*(?:\`|$))/,
+           null, '\'"`']);
+    } else {
+      // 'single-line-string', "single-line-string"
+      shortcutStylePatterns.push(
+          [PR_STRING,
+           /^(?:\'(?:[^\\\'\r\n]|\\.)*(?:\'|$)|\"(?:[^\\\"\r\n]|\\.)*(?:\"|$))/,
+           null, '"\'']);
+    }
+    if (options['verbatimStrings']) {
+      // verbatim-string-literal production from the C# grammar.  See issue 93.
+      fallthroughStylePatterns.push(
+          [PR_STRING, /^@\"(?:[^\"]|\"\")*(?:\"|$)/, null]);
+    }
+    var hc = options['hashComments'];
+    if (hc) {
+      if (options['cStyleComments']) {
+        if (hc > 1) {  // multiline hash comments
+          shortcutStylePatterns.push(
+              [PR_COMMENT, /^#(?:##(?:[^#]|#(?!##))*(?:###|$)|.*)/, null, '#']);
+        } else {
+          // Stop C preprocessor declarations at an unclosed open comment
+          shortcutStylePatterns.push(
+              [PR_COMMENT, /^#(?:(?:define|elif|else|endif|error|ifdef|include|ifndef|line|pragma|undef|warning)\b|[^\r\n]*)/,
+               null, '#']);
+        }
+        // #include <stdio.h>
+        fallthroughStylePatterns.push(
+            [PR_STRING,
+             /^<(?:(?:(?:\.\.\/)*|\/?)(?:[\w-]+(?:\/[\w-]+)+)?[\w-]+\.h(?:h|pp|\+\+)?|[a-z]\w*)>/,
+             null]);
+      } else {
+        shortcutStylePatterns.push([PR_COMMENT, /^#[^\r\n]*/, null, '#']);
+      }
+    }
+    if (options['cStyleComments']) {
+      fallthroughStylePatterns.push([PR_COMMENT, /^\/\/[^\r\n]*/, null]);
+      fallthroughStylePatterns.push(
+          [PR_COMMENT, /^\/\*[\s\S]*?(?:\*\/|$)/, null]);
+    }
+    if (options['regexLiterals']) {
+      /**
+       * @const
+       */
+      var REGEX_LITERAL = (
+          // A regular expression literal starts with a slash that is
+          // not followed by * or / so that it is not confused with
+          // comments.
+          '/(?=[^/*])'
+          // and then contains any number of raw characters,
+          + '(?:[^/\\x5B\\x5C]'
+          // escape sequences (\x5C),
+          +    '|\\x5C[\\s\\S]'
+          // or non-nesting character sets (\x5B\x5D);
+          +    '|\\x5B(?:[^\\x5C\\x5D]|\\x5C[\\s\\S])*(?:\\x5D|$))+'
+          // finally closed by a /.
+          + '/');
+      fallthroughStylePatterns.push(
+          ['lang-regex',
+           new RegExp('^' + REGEXP_PRECEDER_PATTERN + '(' + REGEX_LITERAL + ')')
+           ]);
+    }
+
+    var types = options['types'];
+    if (types) {
+      fallthroughStylePatterns.push([PR_TYPE, types]);
+    }
+
+    if (options['strings']) {
+        var strings = ("" + options['strings']).replace(/^ | $/g, '').replace(/-/g, '\\-');
+        fallthroughStylePatterns.push(
+            [PR_STRING,
+            new RegExp('(?:' + strings.replace(/[\s,]+/g, '|') + ')'),
+            , null]
+        );
+    }
+    
+    var keywords = ("" + options['keywords']).replace(/^ | $/g, '');
+    if (keywords.length) {
+      fallthroughStylePatterns.push(
+          [PR_KEYWORD,
+           new RegExp('^(?:' + keywords.replace(/[\s,]+/g, '|') + ')\\b'),
+           null]);
+    }
+
+    shortcutStylePatterns.push([PR_PLAIN,       /^\s+/, null, ' \r\n\t\xA0']);
+    if (options['httpdComments']) {
+        fallthroughStylePatterns.push(
+            [PR_PLAIN,     /^.*\S.*#/i, null]
+        );
+    }
+    
+    fallthroughStylePatterns.push(
+        // TODO(mikesamuel): recognize non-latin letters and numerals in idents
+        [PR_LITERAL,     /^@[a-z_$][a-z_$@0-9]*|\bNULL\b/i, null],
+        [PR_LITERAL,     CONFIG_OPTIONS, null],
+        //[PR_STRING,     CONFIG_ENVS, null],
+        [PR_TAG,     /^\b(AuthzProviderAlias|AuthnProviderAlias|RequireAny|RequireAll|RequireNone|Directory|DirectoryMatch|Location|LocationMatch|VirtualHost|If|Else|ElseIf|Proxy\b|LoadBalancer|Files|FilesMatch|Limit|LimitExcept|IfDefine|IfModule|IfVersion)\b/, null],
+        [PR_TYPE,        /^(?:[@_]?[A-Z]+[a-z][A-Za-z_$@0-9]*|\w+_(t|req|module)\b)/, null],
+        [PR_TAG,     /^apr_[a-z_0-9]+|ap_[a-z_0-9]+/i, null],
+        [PR_PLAIN,       /^[a-z_$][a-z_$@0-9\-]*/i, null],
+        [PR_LITERAL,
+         new RegExp(
+             '^(?:'
+             // A hex number
+             + '0x[a-f0-9]+'
+             // An IPv6 Address
+             + '|[a-f0-9:]+:[a-f0-9:]+:[a-f0-9:]+:[a-f0-9:]+:[a-f0-9:]+:[a-f0-9:]+'
+             // or an octal or decimal number,
+             + '|(?:\\d(?:_\\d+)*\\d*(?:\\.\\d*)?|\\.\\d\\+)'
+             // possibly in scientific notation
+             + '(?:e[+\\-]?\\d+)?'
+             + ')'
+             // with an optional modifier like UL for unsigned long
+             + '[a-z]*', 'i'),
+         null, '0123456789'],
+        // Don't treat escaped quotes in bash as starting strings.  See issue 144.
+        [PR_PLAIN,       /^\\[\s\S]?/, null],
+        [PR_PUNCTUATION, /^.[^\s\w\.$@\'\"\`\/\#\\]*/, null]);
+
+    return createSimpleLexer(shortcutStylePatterns, fallthroughStylePatterns);
+  }
+
+  var decorateSource = sourceDecorator({
+        'keywords': ALL_KEYWORDS,
+        'hashComments': true,
+        'cStyleComments': true,
+        'multiLineStrings': true,
+        'regexLiterals': true
+      });
+
+  /**
+   * Given a DOM subtree, wraps it in a list, and puts each line into its own
+   * list item.
+   *
+   * @param {Node} node modified in place.  Its content is pulled into an
+   *     HTMLOListElement, and each line is moved into a separate list item.
+   *     This requires cloning elements, so the input might not have unique
+   *     IDs after numbering.
+   * @param {boolean} isPreformatted true iff white-space in text nodes should
+   *     be treated as significant.
+   */
+  function numberLines(node, opt_startLineNum, isPreformatted) {
+    var nocode = /(?:^|\s)nocode(?:\s|$)/;
+    var lineBreak = /\r\n?|\n/;
+  
+    var document = node.ownerDocument;
+  
+    var li = document.createElement('li');
+    while (node.firstChild) {
+      li.appendChild(node.firstChild);
+    }
+    // An array of lines.  We split below, so this is initialized to one
+    // un-split line.
+    var listItems = [li];
+  
+    function walk(node) {
+      switch (node.nodeType) {
+        case 1:  // Element
+          if (nocode.test(node.className)) { break; }
+          if ('br' === node.nodeName) {
+            breakAfter(node);
+            // Discard the <BR> since it is now flush against a </LI>.
+            if (node.parentNode) {
+              node.parentNode.removeChild(node);
+            }
+          } else {
+            for (var child = node.firstChild; child; child = child.nextSibling) {
+              walk(child);
+            }
+          }
+          break;
+        case 3: case 4:  // Text
+          if (isPreformatted) {
+            var text = node.nodeValue;
+            var match = text.match(lineBreak);
+            if (match) {
+              var firstLine = text.substring(0, match.index);
+              node.nodeValue = firstLine;
+              var tail = text.substring(match.index + match[0].length);
+              if (tail) {
+                var parent = node.parentNode;
+                parent.insertBefore(
+                    document.createTextNode(tail), node.nextSibling);
+              }
+              breakAfter(node);
+              if (!firstLine) {
+                // Don't leave blank text nodes in the DOM.
+                node.parentNode.removeChild(node);
+              }
+            }
+          }
+          break;
+      }
+    }
+  
+    // Split a line after the given node.
+    function breakAfter(lineEndNode) {
+      // If there's nothing to the right, then we can skip ending the line
+      // here, and move root-wards since splitting just before an end-tag
+      // would require us to create a bunch of empty copies.
+      while (!lineEndNode.nextSibling) {
+        lineEndNode = lineEndNode.parentNode;
+        if (!lineEndNode) { return; }
+      }
+  
+      function breakLeftOf(limit, copy) {
+        // Clone shallowly if this node needs to be on both sides of the break.
+        var rightSide = copy ? limit.cloneNode(false) : limit;
+        var parent = limit.parentNode;
+        if (parent) {
+          // We clone the parent chain.
+          // This helps us resurrect important styling elements that cross lines.
+          // E.g. in <i>Foo<br>Bar</i>
+          // should be rewritten to <li><i>Foo</i></li><li><i>Bar</i></li>.
+          var parentClone = breakLeftOf(parent, 1);
+          // Move the clone and everything to the right of the original
+          // onto the cloned parent.
+          var next = limit.nextSibling;
+          parentClone.appendChild(rightSide);
+          for (var sibling = next; sibling; sibling = next) {
+            next = sibling.nextSibling;
+            parentClone.appendChild(sibling);
+          }
+        }
+        return rightSide;
+      }
+  
+      var copiedListItem = breakLeftOf(lineEndNode.nextSibling, 0);
+  
+      // Walk the parent chain until we reach an unattached LI.
+      for (var parent;
+           // Check nodeType since IE invents document fragments.
+           (parent = copiedListItem.parentNode) && parent.nodeType === 1;) {
+        copiedListItem = parent;
+      }
+      // Put it on the list of lines for later processing.
+      listItems.push(copiedListItem);
+    }
+  
+    // Split lines while there are lines left to split.
+    for (var i = 0;  // Number of lines that have been split so far.
+         i < listItems.length;  // length updated by breakAfter calls.
+         ++i) {
+      walk(listItems[i]);
+    }
+  
+    // Make sure numeric indices show correctly.
+    if (opt_startLineNum === (opt_startLineNum|0)) {
+      listItems[0].setAttribute('value', opt_startLineNum);
+    }
+  
+    var ol = document.createElement('ol');
+    ol.className = 'linenums';
+    var offset = Math.max(0, ((opt_startLineNum - 1 /* zero index */)) | 0) || 0;
+    for (var i = 0, n = listItems.length; i < n; ++i) {
+      li = listItems[i];
+      // Stick a class on the LIs so that stylesheets can
+      // color odd/even rows, or any other row pattern that
+      // is co-prime with 10.
+      li.className = 'L' + ((i + offset) % 1);
+      if (!li.firstChild) {
+        li.appendChild(document.createTextNode('\xA0'));
+      }
+      ol.appendChild(li);
+    }
+  
+    node.appendChild(ol);
+  }
+
+  /**
+   * Breaks {@code job.sourceCode} around style boundaries in
+   * {@code job.decorations} and modifies {@code job.sourceNode} in place.
+   * @param {Object} job like <pre>{
+   *    sourceCode: {string} source as plain text,
+   *    spans: {Array.<number|Node>} alternating span start indices into source
+   *       and the text node or element (e.g. {@code <BR>}) corresponding to that
+   *       span.
+   *    decorations: {Array.<number|string} an array of style classes preceded
+   *       by the position at which they start in job.sourceCode in order
+   * }</pre>
+   * @private
+   */
+  function recombineTagsAndDecorations(job) {
+    var isIE8OrEarlier = /\bMSIE\s(\d+)/.exec(navigator.userAgent);
+    isIE8OrEarlier = isIE8OrEarlier && +isIE8OrEarlier[1] <= 8;
+    var newlineRe = /\n/g;
+  
+    var source = job.sourceCode;
+    var sourceLength = source.length;
+    // Index into source after the last code-unit recombined.
+    var sourceIndex = 0;
+  
+    var spans = job.spans;
+    var nSpans = spans.length;
+    // Index into spans after the last span which ends at or before sourceIndex.
+    var spanIndex = 0;
+  
+    var decorations = job.decorations;
+    var nDecorations = decorations.length;
+    // Index into decorations after the last decoration which ends at or before
+    // sourceIndex.
+    var decorationIndex = 0;
+  
+    // Remove all zero-length decorations.
+    decorations[nDecorations] = sourceLength;
+    var decPos, i;
+    for (i = decPos = 0; i < nDecorations;) {
+      if (decorations[i] !== decorations[i + 2]) {
+        decorations[decPos++] = decorations[i++];
+        decorations[decPos++] = decorations[i++];
+      } else {
+        i += 2;
+      }
+    }
+    nDecorations = decPos;
+  
+    // Simplify decorations.
+    for (i = decPos = 0; i < nDecorations;) {
+      var startPos = decorations[i];
+      // Conflate all adjacent decorations that use the same style.
+      var startDec = decorations[i + 1];
+      var end = i + 2;
+      while (end + 2 <= nDecorations && decorations[end + 1] === startDec) {
+        end += 2;
+      }
+      decorations[decPos++] = startPos;
+      decorations[decPos++] = startDec;
+      i = end;
+    }
+  
+    nDecorations = decorations.length = decPos;
+  
+    var sourceNode = job.sourceNode;
+    var oldDisplay;
+    if (sourceNode) {
+      oldDisplay = sourceNode.style.display;
+      sourceNode.style.display = 'none';
+    }
+    try {
+      var decoration = null;
+      var X = 0;
+      while (spanIndex < nSpans) {
+        X = X + 1;
+        if (X > 5000) { break; }
+        var spanStart = spans[spanIndex];
+        var spanEnd = spans[spanIndex + 2] || sourceLength;
+  
+        var decEnd = decorations[decorationIndex + 2] || sourceLength;
+  
+        var end = Math.min(spanEnd, decEnd);
+  
+        var textNode = spans[spanIndex + 1];
+        var styledText;
+        if (textNode.nodeType !== 1  // Don't muck with <BR>s or <LI>s
+            // Don't introduce spans around empty text nodes.
+            && (styledText = source.substring(sourceIndex, end))) {
+          // This may seem bizarre, and it is.  Emitting LF on IE causes the
+          // code to display with spaces instead of line breaks.
+          // Emitting Windows standard issue linebreaks (CRLF) causes a blank
+          // space to appear at the beginning of every line but the first.
+          // Emitting an old Mac OS 9 line separator makes everything spiffy.
+          if (isIE8OrEarlier) {
+            styledText = styledText.replace(newlineRe, '\r');
+          }
+          textNode.nodeValue = styledText;
+          var document = textNode.ownerDocument;
+          var span = document.createElement('span');
+          span.className = decorations[decorationIndex + 1];
+          var parentNode = textNode.parentNode;
+          parentNode.replaceChild(span, textNode);
+          span.appendChild(textNode);
+          if (sourceIndex < spanEnd) {  // Split off a text node.
+            spans[spanIndex + 1] = textNode
+                // TODO: Possibly optimize by using '' if there's no flicker.
+                = document.createTextNode(source.substring(end, spanEnd));
+            parentNode.insertBefore(textNode, span.nextSibling);
+          }
+        }
+  
+        sourceIndex = end;
+  
+        if (sourceIndex >= spanEnd) {
+          spanIndex += 2;
+        }
+        if (sourceIndex >= decEnd) {
+          decorationIndex += 2;
+        }
+      }
+    } finally {
+      if (sourceNode) {
+        sourceNode.style.display = oldDisplay;
+      }
+    }
+  }
+
+
+  /** Maps language-specific file extensions to handlers. */
+  var langHandlerRegistry = {};
+  /** Register a language handler for the given file extensions.
+    * @param {function (Object)} handler a function from source code to a list
+    *      of decorations.  Takes a single argument job which describes the
+    *      state of the computation.   The single parameter has the form
+    *      {@code {
+    *        sourceCode: {string} as plain text.
+    *        decorations: {Array.<number|string>} an array of style classes
+    *                     preceded by the position at which they start in
+    *                     job.sourceCode in order.
+    *                     The language handler should assigned this field.
+    *        basePos: {int} the position of source in the larger source chunk.
+    *                 All positions in the output decorations array are relative
+    *                 to the larger source chunk.
+    *      } }
+    * @param {Array.<string>} fileExtensions
+    */
+  function registerLangHandler(handler, fileExtensions) {
+    for (var i = fileExtensions.length; --i >= 0;) {
+      var ext = fileExtensions[i];
+      if (!langHandlerRegistry.hasOwnProperty(ext)) {
+        langHandlerRegistry[ext] = handler;
+      } else if (win['console']) {
+        console['warn']('cannot override language handler %s', ext);
+      }
+    }
+  }
+  function langHandlerForExtension(extension, source) {
+    if (!(extension && langHandlerRegistry.hasOwnProperty(extension))) {
+      // Treat it as markup if the first non whitespace character is a < and
+      // the last non-whitespace character is a >.
+      extension = /^\s*</.test(source)
+          ? 'default-markup'
+          : 'default-code';
+    }
+    return langHandlerRegistry[extension];
+  }
+  registerLangHandler(decorateSource, ['default-code']);
+  registerLangHandler(
+      createSimpleLexer(
+          [],
+          [
+           [PR_PLAIN,       /^[^<?]+/],
+           [PR_DECLARATION, /^<!\w[^>]*(?:>|$)/],
+           [PR_COMMENT,     /^<\!--[\s\S]*?(?:-\->|$)/],
+           // Unescaped content in an unknown language
+           ['lang-',        /^<\?([\s\S]+?)(?:\?>|$)/],
+           ['lang-',        /^<%([\s\S]+?)(?:%>|$)/],
+           [PR_PUNCTUATION, /^(?:<[%?]|[%?]>)/],
+           ['lang-',        /^<xmp\b[^>]*>([\s\S]+?)<\/xmp\b[^>]*>/i],
+           // Unescaped content in javascript.  (Or possibly vbscript).
+           ['lang-js',      /^<script\b[^>]*>([\s\S]*?)(<\/script\b[^>]*>)/i],
+           // Contains unescaped stylesheet content
+           ['lang-css',     /^<style\b[^>]*>([\s\S]*?)(<\/style\b[^>]*>)/i],
+           ['lang-in.tag',  /^(<\/?[a-z][^<>]*>)/i]
+          ]),
+      ['default-markup', 'htm', 'html', 'mxml', 'xhtml', 'xml', 'xsl']);
+  registerLangHandler(
+      createSimpleLexer(
+          [
+           [PR_PLAIN,        /^[\s]+/, null, ' \t\r\n'],
+           [PR_ATTRIB_VALUE, /^(?:\"[^\"]*\"?|\'[^\']*\'?)/, null, '\"\'']
+           ],
+          [
+           [PR_TAG,          /^^<\/?[a-z](?:[\w.:-]*\w)?|\/?>$/i],
+           [PR_ATTRIB_NAME,  /^(?!style[\s=]|on)[a-z](?:[\w:-]*\w)?/i],
+           ['lang-uq.val',   /^=\s*([^>\'\"\s]*(?:[^>\'\"\s\/]|\/(?=\s)))/],
+           [PR_PUNCTUATION,  /^[=<>\/]+/],
+           ['lang-js',       /^on\w+\s*=\s*\"([^\"]+)\"/i],
+           ['lang-js',       /^on\w+\s*=\s*\'([^\']+)\'/i],
+           ['lang-js',       /^on\w+\s*=\s*([^\"\'>\s]+)/i],
+           ['lang-css',      /^style\s*=\s*\"([^\"]+)\"/i],
+           ['lang-css',      /^style\s*=\s*\'([^\']+)\'/i],
+           ['lang-css',      /^style\s*=\s*([^\"\'>\s]+)/i]
+           ]),
+      ['in.tag']);
+  registerLangHandler(
+      createSimpleLexer([], [[PR_ATTRIB_VALUE, /^[\s\S]+/]]), ['uq.val']);
+  registerLangHandler(sourceDecorator({
+          'keywords': CPP_KEYWORDS,
+          'hashComments': true,
+          'cStyleComments': true,
+          'types': C_TYPES
+        }), ['c', 'cc', 'cpp', 'cxx', 'cyc', 'm']);
+  registerLangHandler(sourceDecorator({
+          'keywords': PHP_KEYWORDS,
+          'hashComments': false,
+          'cStyleComments': true,
+          'multiLineStrings': true,
+          'regexLiterals': true
+//          'types': C_TYPES,
+        }), ['php', 'phtml', 'inc']);
+  registerLangHandler(sourceDecorator({
+          'keywords': 'null,true,false'
+        }), ['json']);
+  registerLangHandler(sourceDecorator({
+          'keywords': CSHARP_KEYWORDS,
+          'hashComments': true,
+          'cStyleComments': true,
+          'verbatimStrings': true,
+          'types': C_TYPES
+        }), ['cs']);
+  registerLangHandler(sourceDecorator({
+          'keywords': JAVA_KEYWORDS,
+          'cStyleComments': true
+        }), ['java']);
+  registerLangHandler(sourceDecorator({
+          'keywords': SH_KEYWORDS,
+          'hashComments': true,
+          'multiLineStrings': true
+        }), ['bsh', 'csh', 'sh']);
+  registerLangHandler(sourceDecorator({
+          'keywords': PYTHON_KEYWORDS,
+          'hashComments': true,
+          'multiLineStrings': true,
+          'tripleQuotedStrings': true
+        }), ['cv', 'py']);
+  registerLangHandler(sourceDecorator({
+          'keywords': PERL_KEYWORDS,
+          'hashComments': true,
+          'multiLineStrings': true,
+          'regexLiterals': true
+        }), ['perl', 'pl', 'pm']);
+  registerLangHandler(sourceDecorator({
+          'keywords': RUBY_KEYWORDS,
+          'hashComments': true,
+          'multiLineStrings': true,
+          'regexLiterals': true
+        }), ['rb']);
+  registerLangHandler(sourceDecorator({
+          'keywords': JSCRIPT_KEYWORDS,
+          'cStyleComments': true,
+          'regexLiterals': true
+        }), ['js']);
+  registerLangHandler(sourceDecorator({
+          'keywords': COFFEE_KEYWORDS,
+          'hashComments': 3,  // ### style block comments
+          'cStyleComments': true,
+          'multilineStrings': true,
+          'tripleQuotedStrings': true,
+          'regexLiterals': true
+        }), ['coffee']);
+  registerLangHandler(
+      createSimpleLexer([], [[PR_STRING, /^[\s\S]+/]]), ['regex']);
+  registerLangHandler(sourceDecorator({
+          'keywords': CONFIG_KEYWORDS,
+          'literals': CONFIG_OPTIONS,
+          'strings': CONFIG_ENVS,
+          'hashComments': true,
+          'cStyleComments': false,
+          'multiLineStrings': false,
+          'regexLiterals': false,
+          'httpdComments': true
+        }), ['config']);
+
+  function applyDecorator(job) {
+    var opt_langExtension = job.langExtension;
+
+    try {
+      // Extract tags, and convert the source code to plain text.
+      var sourceAndSpans = extractSourceSpans(job.sourceNode, job.pre);
+      /** Plain text. @type {string} */
+      var source = sourceAndSpans.sourceCode;
+      job.sourceCode = source;
+      job.spans = sourceAndSpans.spans;
+      job.basePos = 0;
+
+      // Apply the appropriate language handler
+      langHandlerForExtension(opt_langExtension, source)(job);
+
+      // Integrate the decorations and tags back into the source code,
+      // modifying the sourceNode in place.
+      recombineTagsAndDecorations(job);
+    } catch (e) {
+      if (win['console']) {
+        console['log'](e && e['stack'] ? e['stack'] : e);
+      }
+    }
+  }
+
+  /**
+   * @param sourceCodeHtml {string} The HTML to pretty print.
+   * @param opt_langExtension {string} The language name to use.
+   *     Typically, a filename extension like 'cpp' or 'java'.
+   * @param opt_numberLines {number|boolean} True to number lines,
+   *     or the 1-indexed number of the first line in sourceCodeHtml.
+   */
+  function prettyPrintOne(sourceCodeHtml, opt_langExtension, opt_numberLines) {
+    var container = document.createElement('pre');
+    // This could cause images to load and onload listeners to fire.
+    // E.g. <img onerror="alert(1337)" src="nosuchimage.png">.
+    // We assume that the inner HTML is from a trusted source.
+    container.innerHTML = sourceCodeHtml;
+    if (opt_numberLines) {
+      numberLines(container, opt_numberLines, true);
+    }
+
+    var job = {
+      langExtension: opt_langExtension,
+      numberLines: opt_numberLines,
+      sourceNode: container,
+      pre: 1
+    };
+    applyDecorator(job);
+    return container.innerHTML;
+  }
+
+  function prettyPrint(opt_whenDone) {
+    function byTagName(tn) { return document.getElementsByTagName(tn); }
+    // fetch a list of nodes to rewrite
+    var codeSegments = [byTagName('pre'), byTagName('code'), byTagName('xmp')];
+    var elements = [];
+    for (var i = 0; i < codeSegments.length; ++i) {
+      for (var j = 0, n = codeSegments[i].length; j < n; ++j) {
+        elements.push(codeSegments[i][j]);
+      }
+    }
+    codeSegments = null;
+
+    var clock = Date;
+    if (!clock['now']) {
+      clock = { 'now': function () { return +(new Date); } };
+    }
+
+    // The loop is broken into a series of continuations to make sure that we
+    // don't make the browser unresponsive when rewriting a large page.
+    var k = 0;
+    var prettyPrintingJob;
+
+    var langExtensionRe = /\blang(?:uage)?-([\w.]+)(?!\S)/;
+    var prettyPrintRe = /\bprettyprint\b/;
+    var prettyPrintedRe = /\bprettyprinted\b/;
+    var preformattedTagNameRe = /pre|xmp/i;
+    var codeRe = /^code$/i;
+    var preCodeXmpRe = /^(?:pre|code|xmp)$/i;
+
+    function doWork() {
+      var endTime = (win['PR_SHOULD_USE_CONTINUATION'] ?
+                     clock['now']() + 250 /* ms */ :
+                     Infinity);
+      for (; k < elements.length && clock['now']() < endTime; k++) {
+        var cs = elements[k];
+        var className = cs.className;
+        if (prettyPrintRe.test(className)
+            // Don't redo this if we've already done it.
+            // This allows recalling pretty print to just prettyprint elements
+            // that have been added to the page since last call.
+            && !prettyPrintedRe.test(className)) {
+
+          // make sure this is not nested in an already prettified element
+          var nested = false;
+          for (var p = cs.parentNode; p; p = p.parentNode) {
+            var tn = p.tagName;
+            if (preCodeXmpRe.test(tn)
+                && p.className && prettyPrintRe.test(p.className)) {
+              nested = true;
+              break;
+            }
+          }
+          if (!nested) {
+            // Mark done.  If we fail to prettyprint for whatever reason,
+            // we shouldn't try again.
+            cs.className += ' prettyprinted';
+
+            // If the classes includes a language extensions, use it.
+            // Language extensions can be specified like
+            //     <pre class="prettyprint lang-cpp">
+            // the language extension "cpp" is used to find a language handler
+            // as passed to PR.registerLangHandler.
+            // HTML5 recommends that a language be specified using "language-"
+            // as the prefix instead.  Google Code Prettify supports both.
+            // http://dev.w3.org/html5/spec-author-view/the-code-element.html
+            var langExtension = className.match(langExtensionRe);
+            // Support <pre class="prettyprint"><code class="language-c">
+            var wrapper;
+            if (!langExtension && (wrapper = childContentWrapper(cs))
+                && codeRe.test(wrapper.tagName)) {
+              langExtension = wrapper.className.match(langExtensionRe);
+            }
+
+            if (langExtension) { langExtension = langExtension[1]; }
+
+            var preformatted;
+            if (preformattedTagNameRe.test(cs.tagName)) {
+              preformatted = 1;
+            } else {
+              var currentStyle = cs['currentStyle'];
+              var whitespace = (
+                  currentStyle
+                  ? currentStyle['whiteSpace']
+                  : (document.defaultView
+                     && document.defaultView.getComputedStyle)
+                  ? document.defaultView.getComputedStyle(cs, null)
+                  .getPropertyValue('white-space')
+                  : 0);
+              preformatted = whitespace
+                  && 'pre' === whitespace.substring(0, 3);
+            }
+
+            // Look for a class like linenums or linenums:<n> where <n> is the
+            // 1-indexed number of the first line.
+            var lineNums = cs.className.match(/\blinenums\b(?::(\d+))?/);
+            lineNums = lineNums
+                ? lineNums[1] && lineNums[1].length ? +lineNums[1] : true
+                : false;
+            if (lineNums) { numberLines(cs, lineNums, preformatted); }
+
+            // do the pretty printing
+            prettyPrintingJob = {
+              langExtension: langExtension,
+              sourceNode: cs,
+              numberLines: lineNums,
+              pre: preformatted
+            };
+            applyDecorator(prettyPrintingJob);
+          }
+        }
+      }
+      if (k < elements.length) {
+        // finish up in a continuation
+        setTimeout(doWork, 250);
+      } else if (opt_whenDone) {
+        opt_whenDone();
+      }
+    }
+
+    doWork();
+  }
+
+  /**
+   * Contains functions for creating and registering new language handlers.
+   * @type {Object}
+   */
+  var PR = win['PR'] = {
+        'createSimpleLexer': createSimpleLexer,
+        'registerLangHandler': registerLangHandler,
+        'sourceDecorator': sourceDecorator,
+        'PR_ATTRIB_NAME': PR_ATTRIB_NAME,
+        'PR_ATTRIB_VALUE': PR_ATTRIB_VALUE,
+        'PR_COMMENT': PR_COMMENT,
+        'PR_DECLARATION': PR_DECLARATION,
+        'PR_KEYWORD': PR_KEYWORD,
+        'PR_LITERAL': PR_LITERAL,
+        'PR_NOCODE': PR_NOCODE,
+        'PR_PLAIN': PR_PLAIN,
+        'PR_PUNCTUATION': PR_PUNCTUATION,
+        'PR_SOURCE': PR_SOURCE,
+        'PR_STRING': PR_STRING,
+        'PR_TAG': PR_TAG,
+        'PR_TYPE': PR_TYPE,
+        'prettyPrintOne': win['prettyPrintOne'] = prettyPrintOne,
+        'prettyPrint': win['prettyPrint'] = prettyPrint
+      };
+   
+
+/* Register Lua syntaxes */   
+   PR['registerLangHandler'](
+    PR['createSimpleLexer'](
+        [
+         // Whitespace
+         [PR['PR_PLAIN'],       /^[\t\n\r \xA0]+/, null, '\t\n\r \xA0'],
+         // A double or single quoted, possibly multi-line, string.
+         [PR['PR_STRING'],      /^(?:\"(?:[^\"\\]|\\[\s\S])*(?:\"|$)|\'(?:[^\'\\]|\\[\s\S])*(?:\'|$))/, null, '"\'']
+        ],
+        [
+         // A comment is either a line comment that starts with two dashes, or
+         // two dashes preceding a long bracketed block.
+         [PR['PR_COMMENT'], /^--(?:\[(=*)\[[\s\S]*?(?:\]\1\]|$)|[^\r\n]*)/],
+         [PR['PR_TYPE'], /^nil|false|true/],
+         // A long bracketed block not preceded by -- is a string.
+         [PR['PR_STRING'],  /^\[(=*)\[[\s\S]*?(?:\]\1\]|$)/],
+         [PR['PR_KEYWORD'], /^(?:and|break|do|else|elseif|end|for|function|if|in|local|not|or|repeat|require|return|then|until|while)\b/, null],
+         // A number is a hex integer literal, a decimal real literal, or in
+         // scientific notation.
+         [PR['PR_LITERAL'],
+          /^[+-]?(?:0x[\da-f]+|(?:(?:\.\d+|\d+(?:\.\d*)?)(?:e[+\-]?\d+)?))/i],
+         // An identifier
+         [PR['PR_PLAIN'], /^[a-z_]\w*/i],
+         // A run of punctuation
+         [PR['PR_PUNCTUATION'], /^[^\w\t\n\r \xA0][^\w\t\n\r \xA0\"\'\-\+=]*/]
+        ]),
+    ['lua']);
+
+
+  // Make PR available via the Asynchronous Module Definition (AMD) API.
+  // Per https://github.com/amdjs/amdjs-api/wiki/AMD:
+  // The Asynchronous Module Definition (AMD) API specifies a
+  // mechanism for defining modules such that the module and its
+  // dependencies can be asynchronously loaded.
+  // ...
+  // To allow a clear indicator that a global define function (as
+  // needed for script src browser loading) conforms to the AMD API,
+  // any global define function SHOULD have a property called "amd"
+  // whose value is an object. This helps avoid conflict with any
+  // other existing JavaScript code that could have defined a define()
+  // function that does not conform to the AMD API.
+  if (typeof define === "function" && define['amd']) {
+    define("google-code-prettify", [], function () {
+      return PR; 
+    });
+  }
+})();
diff --git a/docs/manual/style/scripts/prettify.min.js b/docs/manual/style/scripts/prettify.min.js
new file mode 100644
index 0000000..4f0f9f5
--- /dev/null
+++ b/docs/manual/style/scripts/prettify.min.js
@@ -0,0 +1,123 @@
+// see prettify.js for copyright, license and expanded version
+window['PR_SHOULD_USE_CONTINUATION']=true;var prettyPrintOne;var prettyPrint;(function(){var win=window;var FLOW_CONTROL_KEYWORDS=["break,continue,do,else,for,if,return,while"];var C_KEYWORDS=[FLOW_CONTROL_KEYWORDS,"auto,case,char,const,default,"+"double,enum,extern,float,goto,int,long,register,short,signed,sizeof,module,"+"static,struct,switch,typedef,union,unsigned,void,volatile"];var COMMON_KEYWORDS=[C_KEYWORDS,"catch,class,delete,false,import,"+"new,operator,private,protected,public,this,throw,true,try,typeof"];var CPP_KEYWORDS=[COMMON_KEYWORDS,"alignof,align_union,asm,axiom,bool,"+"concept,concept_map,const_cast,constexpr,decltype,"+"dynamic_cast,explicit,export,friend,inline,late_check,"+"mutable,namespace,nullptr,reinterpret_cast,static_assert,static_cast,"+"template,typeid,typename,using,virtual,where,request_req"];var JAVA_KEYWORDS=[COMMON_KEYWORDS,"abstract,boolean,byte,extends,final,finally,implements,import,"+"instanceof,null,native,package,strictfp,super,synchronized,throws,"+"transient"];var CSHARP_KEYWORDS=[JAVA_KEYWORDS,"as,base,by,checked,decimal,delegate,descending,dynamic,event,"+"fixed,foreach,from,group,implicit,in,interface,internal,into,is,let,"+"lock,object,out,override,orderby,params,partial,readonly,ref,sbyte,"+"sealed,stackalloc,string,select,uint,ulong,unchecked,unsafe,ushort,"+"var,virtual,where"];var COFFEE_KEYWORDS="all,and,by,catch,class,else,extends,false,finally,"+"for,if,in,is,isnt,loop,new,no,not,null,of,off,on,or,return,super,then,"+"throw,true,try,unless,until,when,while,yes";var JSCRIPT_KEYWORDS=[COMMON_KEYWORDS,"debugger,eval,export,function,get,null,set,undefined,var,with,"+"Infinity,NaN"];var PERL_KEYWORDS="caller,delete,die,do,dump,else,elsif,eval,exit,foreach,for,"+"goto,if,import,last,local,my,next,no,our,print,printf,package,redo,require,"+"sub,undef,unless,until,use,wantarray,while,BEGIN,END";var PHP_KEYWORDS="abstract,and,array,as,break,case,catch,cfunction,class,"+"clone,const,continue,declare,default,do,else,elseif,enddeclare,endfor,"+"endforeach,endif,endswitch,endwhile,extends,final,for,foreach,function,"+"global,goto,if,implements,interface,instanceof,namespace,new,old_function,"+"or,private,protected,public,static,switch,throw,try,use,var,while,xor,"+"die,echo,empty,exit,eval,include,include_once,isset,list,require,"+"require_once,return,print,unset";var PYTHON_KEYWORDS=[FLOW_CONTROL_KEYWORDS,"and,as,assert,class,def,del,"+"elif,except,exec,finally,from,global,import,in,is,lambda,"+"nonlocal,not,or,pass,print,raise,try,with,yield,"+"False,True,None"];var RUBY_KEYWORDS=[FLOW_CONTROL_KEYWORDS,"alias,and,begin,case,class,"+"def,defined,elsif,end,ensure,false,in,module,next,nil,not,or,redo,"+"rescue,retry,self,super,then,true,undef,unless,until,when,yield,"+"BEGIN,END"];var SH_KEYWORDS=[FLOW_CONTROL_KEYWORDS,"case,done,elif,esac,eval,fi,"+"function,in,local,set,then,until,echo"];var CONFIG_ENVS=["User-Agent,HTTP_USER_AGENT,HTTP_REFERER,HTTP_COOKIE,HTTP_FORWARDED,HTTP_HOST,HTTP_PROXY_CONNECTION,HTTP_ACCEPT,REMOTE_ADDR,REMOTE_HOST,REMOTE_PORT,REMOTE_USER,REMOTE_IDENT,REQUEST_METHOD,SCRIPT_FILENAME,PATH_INFO,QUERY_STRING,AUTH_TYPE,DOCUMENT_ROOT,SERVER_ADMIN,SERVER_NAME,SERVER_ADDR,SERVER_PORT,SERVER_PROTOCOL,SERVER_SOFTWARE,TIME_YEAR,TIME_MON,TIME_DAY,TIME_HOUR,TIME_MIN,TIME_SEC,TIME_WDAY,TIME,API_VERSION,THE_REQUEST,REQUEST_URI,REQUEST_FILENAME,IS_SUBREQ,HTTPS,REQUEST_SCHEME"];var CONFIG_KEYWORDS=["Macro,UndefMacro,Use,AuthLDAPURL,AcceptFilter,AcceptPathInfo,AccessFileName,Action,AddAlt,AddAltByEncoding,AddAltByType,AddCharset,AddDefaultCharset,AddDescription,AddEncoding,AddHandler,AddIcon,AddIconByEncoding,AddIconByType,AddInputFilter,AddLanguage,AddModuleInfo,AddOutputFilter,AddOutputFilterByType,AddType,Alias,AliasMatch,Allow,AllowCONNECT,AllowEncodedSlashes,AllowMethods,AllowOverride,AllowOverrideList,Anonymous,Anonymous_LogEmail,Anonymous_MustGiveEmail,Anonymous_NoUserID,Anonymous_VerifyEmail,AsyncRequestWorkerFactor,AuthBasicAuthoritative,AuthBasicProvider,AuthDBDUserPWQuery,AuthDBDUserRealmQuery,AuthDBMGroupFile,AuthDBMType,AuthDBMUserFile,AuthDigestAlgorithm,AuthDigestDomain,AuthDigestNcCheck,AuthDigestNonceFormat,AuthDigestNonceLifetime,AuthDigestProvider,AuthDigestQop,AuthDigestShmemSize,AuthFormAuthoritative,AuthFormBody,AuthFormDisableNoStore,AuthFormFakeBasicAuth,AuthFormLocation,AuthFormLoginRequiredLocation,AuthFormLoginSuccessLocation,AuthFormLogoutLocation,AuthFormMethod,AuthFormMimetype,AuthFormPassword,AuthFormProvider,AuthFormSitePassphrase,AuthFormSize,AuthFormUsername,AuthGroupFile,AuthLDAPAuthorizePrefix,AuthLDAPBindAuthoritative,AuthLDAPBindDN,AuthLDAPBindPassword,AuthLDAPCharsetConfig,AuthLDAPCompareAsUser,AuthLDAPCompareDNOnServer,AuthLDAPDereferenceAliases,AuthLDAPGroupAttribute,AuthLDAPGroupAttributeIsDN,AuthLDAPInitialBindAsUser,AuthLDAPInitialBindPattern,AuthLDAPMaxSubGroupDepth,AuthLDAPRemoteUserAttribute,AuthLDAPRemoteUserIsDN,AuthLDAPSearchAsUser,AuthLDAPSubGroupAttribute,AuthLDAPSubGroupClass,AuthLDAPUrl,AuthMerging,AuthName,AuthnCacheContext,AuthnCacheEnable,AuthnCacheProvideFor,AuthnCacheSOCache,AuthnCacheTimeout,<AuthnProviderAlias>,AuthType,AuthUserFile,AuthzDBDLoginToReferer,AuthzDBDQuery,AuthzDBDRedirectQuery,AuthzDBMType,<AuthzProviderAlias>,AuthzSendForbiddenOnFailure,BalancerGrowth,BalancerMember,BrowserMatch,BrowserMatchNoCase,BufferedLogs,BufferSize,CacheDefaultExpire,CacheDetailHeader,CacheDirLength,CacheDirLevels,CacheDisable,CacheEnable,CacheFile,CacheHeader,CacheIgnoreCacheControl,CacheIgnoreHeaders,CacheIgnoreNoLastMod,CacheIgnoreQueryString,CacheIgnoreURLSessionIdentifiers,CacheKeyBaseURL,CacheLastModifiedFactor,CacheLock,CacheLockMaxAge,CacheLockPath,CacheMaxExpire,CacheMaxFileSize,CacheMinExpire,CacheMinFileSize,CacheNegotiatedDocs,CacheQuickHandler,CacheReadSize,CacheReadTime,CacheRoot,CacheStaleOnError,CacheStoreExpired,CacheStoreNoStore,CacheStorePrivate,CGIMapExtension,CharsetDefault,CharsetOptions,CharsetSourceEnc,CheckCaseOnly,CheckSpelling,ChrootDir,ContentDigest,CookieDomain,CookieExpires,CookieName,CookieStyle,CookieTracking,CoreDumpDirectory,CustomLog,Dav,DavDepthInfinity,DavGenericLockDB,DavLockDB,DavMinTimeout,DBDExptime,DBDInitSQL,DBDKeep,DBDMax,DBDMin,DBDParams,DBDPersist,DBDPrepareSQL,DBDriver,DefaultIcon,DefaultLanguage,DefaultRuntimeDir,DefaultType,Define,DeflateBufferSize,DeflateCompressionLevel,DeflateFilterNote,DeflateMemLevel,DeflateWindowSize,Deny,<Directory>,DirectoryIndex,DirectoryIndexRedirect,<DirectoryMatch>,DirectorySlash,DocumentRoot,DTracePrivileges,DumpIOInput,DumpIOOutput,<Else>,<ElseIf>,EnableExceptionHook,EnableMMAP,EnableSendfile,Error,ErrorDocument,ErrorLog,ErrorLogFormat,Example,ExpiresActive,ExpiresByType,ExpiresDefault,ExtendedStatus,ExtFilterDefine,ExtFilterOptions,FallbackResource,FileETag,<Files>,<FilesMatch>,FilterChain,FilterDeclare,FilterProtocol,FilterProvider,FilterTrace,ForceLanguagePriority,ForceType,ForensicLog,GprofDir,GracefulShutdownTimeout,Group,Header,HeaderName,HeartbeatAddress,HeartbeatListen,HeartbeatMaxServers,HeartbeatStorage,HeartbeatStorage,HostnameLookups,IdentityCheck,IdentityCheckTimeout,<If>,<IfDefine>,<IfModule>,<IfVersion>,ImapBase,ImapDefault,ImapMenu,Include,IncludeOptional,IndexHeadInsert,IndexIgnore,IndexIgnoreReset,IndexOptions,IndexOrderDefault,IndexStyleSheet,InputSed,ISAPIAppendLogToErrors,ISAPIAppendLogToQuery,ISAPICacheFile,ISAPIFakeAsync,ISAPILogNotSupported,ISAPIReadAheadBuffer,KeepAlive,KeepAliveTimeout,KeptBodySize,LanguagePriority,LDAPCacheEntries,LDAPCacheTTL,LDAPConnectionPoolTTL,LDAPConnectionTimeout,LDAPLibraryDebug,LDAPOpCacheEntries,LDAPOpCacheTTL,LDAPReferralHopLimit,LDAPReferrals,LDAPRetries,LDAPRetryDelay,LDAPSharedCacheFile,LDAPSharedCacheSize,LDAPTimeout,LDAPTrustedClientCert,LDAPTrustedGlobalCert,LDAPTrustedMode,LDAPVerifyServerCert,<Limit>,<LimitExcept>,LimitInternalRecursion,LimitRequestBody,LimitRequestFields,LimitRequestFieldSize,LimitRequestLine,LimitXMLRequestBody,Listen,ListenBackLog,LoadFile,LoadModule,<Location>,<LocationMatch>,LogFormat,LogLevel,LogMessage,LuaCodeCache,LuaHookAccessChecker,LuaHookAuthChecker,LuaAuthzProvider,LuaHookCheckUserID,LuaHookFixups,LuaHookInsertFilter,LuaHookMapToStorage,LuaHookTranslateName,LuaHookTypeChecker,LuaInherit,LuaInputFilter,LuaMapHandler,LuaOutputFilter,LuaPackageCPath,LuaPackagePath,LuaQuickHandler,LuaRoot,LuaScope,MaxConnectionsPerChild,MaxKeepAliveRequests,MaxMemFree,MaxRangeOverlaps,MaxRangeReversals,MaxRanges,MaxRequestWorkers,MaxSpareServers,MaxSpareThreads,MaxThreads,MetaDir,MetaFiles,MetaSuffix,MimeMagicFile,MinSpareServers,MinSpareThreads,MMapFile,ModemStandard,ModMimeUsePathInfo,MultiviewsMatch,Mutex,NameVirtualHost,NoProxy,NWSSLTrustedCerts,NWSSLUpgradeable,Options,Order,OutputSed,PassEnv,PidFile,PrivilegesMode,Protocol,ProtocolEcho,<Proxy>,ProxyAddHeaders,ProxyBadHeader,ProxyBlock,ProxyDomain,ProxyErrorOverride,ProxyExpressDBMFile,ProxyExpressDBMType,ProxyExpressEnable,ProxyFtpDirCharset,ProxyFtpEscapeWildcards,ProxyFtpListOnWildcard,ProxyHTMLBufSize,ProxyHTMLCharsetOut,ProxyHTMLDocType,ProxyHTMLEnable,ProxyHTMLEvents,ProxyHTMLExtended,ProxyHTMLFixups,ProxyHTMLInterp,ProxyHTMLLinks,ProxyHTMLStripComments,ProxyHTMLURLMap,ProxyIOBufferSize,<ProxyMatch>,ProxyMaxForwards,ProxyPass,ProxyPassInterpolateEnv,ProxyPassMatch,ProxyPassReverse,ProxyPassReverseCookieDomain,ProxyPassReverseCookiePath,ProxyPreserveHost,ProxyReceiveBufferSize,ProxyRemote,ProxyRemoteMatch,ProxyRequests,ProxySCGIInternalRedirect,ProxySCGISendfile,ProxySet,ProxySourceAddress,ProxyStatus,ProxyTimeout,ProxyVia,ReadmeName,ReceiveBufferSize,Redirect,RedirectMatch,RedirectPermanent,RedirectTemp,ReflectorHeader,RemoteIPHeader,RemoteIPInternalProxy,RemoteIPInternalProxyList,RemoteIPProxiesHeader,RemoteIPTrustedProxy,RemoteIPTrustedProxyList,RemoveCharset,RemoveEncoding,RemoveHandler,RemoveInputFilter,RemoveLanguage,RemoveOutputFilter,RemoveType,RequestHeader,RequestReadTimeout,Require,<RequireAll>,<RequireAny>,<RequireNone>,RewriteBase,RewriteCond,RewriteEngine,RewriteMap,RewriteOptions,RewriteRule,RLimitCPU,RLimitMEM,RLimitNPROC,Satisfy,ScoreBoardFile,Script,ScriptAlias,ScriptAliasMatch,ScriptInterpreterSource,ScriptLog,ScriptLogBuffer,ScriptLogLength,ScriptSock,SecureListen,SeeRequestTail,SendBufferSize,ServerAdmin,ServerAlias,ServerLimit,ServerName,ServerPath,ServerRoot,ServerSignature,ServerTokens,Session,SessionCookieName,SessionCookieName2,SessionCookieRemove,SessionCryptoCipher,SessionCryptoDriver,SessionCryptoPassphrase,SessionCryptoPassphraseFile,SessionDBDCookieName,SessionDBDCookieName2,SessionDBDCookieRemove,SessionDBDDeleteLabel,SessionDBDInsertLabel,SessionDBDPerUser,SessionDBDSelectLabel,SessionDBDUpdateLabel,SessionEnv,SessionExclude,SessionHeader,SessionInclude,SessionMaxAge,SetEnv,SetEnvIf,SetEnvIfExpr,SetEnvIfNoCase,SetHandler,SetInputFilter,SetOutputFilter,SSIEndTag,SSIErrorMsg,SSIETag,SSILastModified,SSILegacyExprParser,SSIStartTag,SSITimeFormat,SSIUndefinedEcho,SSLCACertificateFile,SSLCACertificatePath,SSLCADNRequestFile,SSLCADNRequestPath,SSLCARevocationCheck,SSLCARevocationFile,SSLCARevocationPath,SSLCertificateChainFile,SSLCertificateFile,SSLCertificateKeyFile,SSLCipherSuite,SSLCryptoDevice,SSLEngine,SSLFIPS,SSLHonorCipherOrder,SSLInsecureRenegotiation,SSLOCSPDefaultResponder,SSLOCSPEnable,SSLOCSPOverrideResponder,SSLOCSPResponderTimeout,SSLOCSPResponseMaxAge,SSLOCSPResponseTimeSkew,SSLOptions,SSLPassPhraseDialog,SSLProtocol,SSLProxyCACertificateFile,SSLProxyCACertificatePath,SSLProxyCARevocationCheck,SSLProxyCARevocationFile,SSLProxyCARevocationPath,SSLProxyCheckPeerCN,SSLProxyCheckPeerExpire,SSLProxyCipherSuite,SSLProxyEngine,SSLProxyMachineCertificateChainFile,SSLProxyMachineCertificateFile,SSLProxyMachineCertificatePath,SSLProxyProtocol,SSLProxyVerify,SSLProxyVerifyDepth,SSLRandomSeed,SSLRenegBufferSize,SSLRequire,SSLRequireSSL,SSLSessionCache,SSLSessionCacheTimeout,SSLSessionTicketKeyFile,SSLStaplingCache,SSLStaplingErrorCacheTimeout,SSLStaplingFakeTryLater,SSLStaplingForceURL,SSLStaplingResponderTimeout,SSLStaplingResponseMaxAge,SSLStaplingResponseTimeSkew,SSLStaplingReturnResponderErrors,SSLStaplingStandardCacheTimeout,SSLStrictSNIVHostCheck,SSLUserName,SSLUseStapling,SSLVerifyClient,SSLVerifyDepth,StartServers,StartThreads,Substitute,Suexec,SuexecUserGroup,ThreadLimit,ThreadsPerChild,ThreadStackSize,TimeOut,TraceEnable,TransferLog,TypesConfig,UnDefine,UnsetEnv,UseCanonicalName,UseCanonicalPhysicalPort,User,UserDir,VHostCGIMode,VHostCGIPrivs,VHostGroup,VHostPrivs,VHostSecure,VHostUser,VirtualDocumentRoot,VirtualDocumentRootIP,<VirtualHost>,VirtualScriptAlias,VirtualScriptAliasIP,WatchdogInterval,XBitHack,xml2EncAlias,xml2EncDefault,xml2StartParse,RewriteLog,RewriteLogLevel"];var CONFIG_OPTIONS=/^[\\+\\-]?(AuthConfig|IncludesNOEXEC|ExecCGI|FollowSymLinks|MultiViews|Includes|Indexes|SymLinksIfOwnerMatch)\b/i;var ALL_KEYWORDS=[CPP_KEYWORDS,CSHARP_KEYWORDS,JSCRIPT_KEYWORDS,PERL_KEYWORDS+
+PYTHON_KEYWORDS,RUBY_KEYWORDS,SH_KEYWORDS,CONFIG_KEYWORDS,PHP_KEYWORDS];var C_TYPES=/^(DIR|FILE|vector|(de|priority_)?queue|list|stack|(const_)?iterator|(multi)?(set|map)|bitset|u?(int|float|char|void|const|static|struct)\d*(_t)?\b)|[a-z_]+_rec|cmd_parms\b/;var PR_STRING='str';var PR_KEYWORD='kwd';var PR_COMMENT='com';var PR_TYPE='typ';var PR_LITERAL='lit';var PR_PUNCTUATION='pun';var PR_PLAIN='pln';var PR_TAG='tag';var PR_DECLARATION='dec';var PR_SOURCE='src';var PR_ATTRIB_NAME='atn';var PR_ATTRIB_VALUE='atv';var PR_NOCODE='nocode';var REGEXP_PRECEDER_PATTERN='(?:^^\\.?|[+-]|[!=]=?=?|\\#|%=?|&&?=?|\\(|\\*=?|[+\\-]=|->|\\/=?|::?|<<?=?|>>?>?=?|,|;|\\?|@|\\[|~|{|\\^\\^?=?|\\|\\|?=?|break|case|continue|delete|do|else|finally|instanceof|return|throw|try|typeof)\\s*';function combinePrefixPatterns(regexs){var capturedGroupIndex=0;var needToFoldCase=false;var ignoreCase=false;for(var i=0,n=regexs.length;i<n;++i){var regex=regexs[i];if(regex.ignoreCase){ignoreCase=true;}else if(/[a-z]/i.test(regex.source.replace(/\\u[0-9a-f]{4}|\\x[0-9a-f]{2}|\\[^ux]/gi,''))){needToFoldCase=true;ignoreCase=false;break;}}
+var escapeCharToCodeUnit={'b':8,'t':9,'n':0xa,'v':0xb,'f':0xc,'r':0xd};function decodeEscape(charsetPart){var cc0=charsetPart.charCodeAt(0);if(cc0!==92){return cc0;}
+var c1=charsetPart.charAt(1);cc0=escapeCharToCodeUnit[c1];if(cc0){return cc0;}else if('0'<=c1&&c1<='7'){return parseInt(charsetPart.substring(1),8);}else if(c1==='u'||c1==='x'){return parseInt(charsetPart.substring(2),16);}else{return charsetPart.charCodeAt(1);}}
+function encodeEscape(charCode){if(charCode<0x20){return(charCode<0x10?'\\x0':'\\x')+charCode.toString(16);}
+var ch=String.fromCharCode(charCode);return(ch==='\\'||ch==='-'||ch===']'||ch==='^')?"\\"+ch:ch;}
+function caseFoldCharset(charSet){var charsetParts=charSet.substring(1,charSet.length-1).match(new RegExp('\\\\u[0-9A-Fa-f]{4}'
++'|\\\\x[0-9A-Fa-f]{2}'
++'|\\\\[0-3][0-7]{0,2}'
++'|\\\\[0-7]{1,2}'
++'|\\\\[\\s\\S]'
++'|-'
++'|[^-\\\\]','g'));var ranges=[];var inverse=charsetParts[0]==='^';var out=['['];if(inverse){out.push('^');}
+for(var i=inverse?1:0,n=charsetParts.length;i<n;++i){var p=charsetParts[i];if(/\\[bdsw]/i.test(p)){out.push(p);}else{var start=decodeEscape(p);var end;if(i+2<n&&'-'===charsetParts[i+1]){end=decodeEscape(charsetParts[i+2]);i+=2;}else{end=start;}
+ranges.push([start,end]);if(!(end<65||start>122)){if(!(end<65||start>90)){ranges.push([Math.max(65,start)|32,Math.min(end,90)|32]);}
+if(!(end<97||start>122)){ranges.push([Math.max(97,start)&~32,Math.min(end,122)&~32]);}}}}
+ranges.sort(function(a,b){return(a[0]-b[0])||(b[1]-a[1]);});var consolidatedRanges=[];var lastRange=[];for(var i=0;i<ranges.length;++i){var range=ranges[i];if(range[0]<=lastRange[1]+1){lastRange[1]=Math.max(lastRange[1],range[1]);}else{consolidatedRanges.push(lastRange=range);}}
+for(var i=0;i<consolidatedRanges.length;++i){var range=consolidatedRanges[i];out.push(encodeEscape(range[0]));if(range[1]>range[0]){if(range[1]+1>range[0]){out.push('-');}
+out.push(encodeEscape(range[1]));}}
+out.push(']');return out.join('');}
+function allowAnywhereFoldCaseAndRenumberGroups(regex){var parts=regex.source.match(new RegExp('(?:'
++'\\[(?:[^\\x5C\\x5D]|\\\\[\\s\\S])*\\]'
++'|\\\\u[A-Fa-f0-9]{4}'
++'|\\\\x[A-Fa-f0-9]{2}'
++'|\\\\[0-9]+'
++'|\\\\[^ux0-9]'
++'|\\(\\?[:!=]'
++'|[\\(\\)\\^]'
++'|[^\\x5B\\x5C\\(\\)\\^]+'
++')','g'));var n=parts.length;var capturedGroups=[];for(var i=0,groupIndex=0;i<n;++i){var p=parts[i];if(p==='('){++groupIndex;}else if('\\'===p.charAt(0)){var decimalValue=+p.substring(1);if(decimalValue){if(decimalValue<=groupIndex){capturedGroups[decimalValue]=-1;}else{parts[i]=encodeEscape(decimalValue);}}}}
+for(var i=1;i<capturedGroups.length;++i){if(-1===capturedGroups[i]){capturedGroups[i]=++capturedGroupIndex;}}
+for(var i=0,groupIndex=0;i<n;++i){var p=parts[i];if(p==='('){++groupIndex;if(!capturedGroups[groupIndex]){parts[i]='(?:';}}else if('\\'===p.charAt(0)){var decimalValue=+p.substring(1);if(decimalValue&&decimalValue<=groupIndex){parts[i]='\\'+capturedGroups[decimalValue];}}}
+for(var i=0;i<n;++i){if('^'===parts[i]&&'^'!==parts[i+1]){parts[i]='';}}
+if(regex.ignoreCase&&needToFoldCase){for(var i=0;i<n;++i){var p=parts[i];var ch0=p.charAt(0);if(p.length>=2&&ch0==='['){parts[i]=caseFoldCharset(p);}else if(ch0!=='\\'){parts[i]=p.replace(/[a-zA-Z]/g,function(ch){var cc=ch.charCodeAt(0);return'['+String.fromCharCode(cc&~32,cc|32)+']';});}}}
+return parts.join('');}
+var rewritten=[];for(var i=0,n=regexs.length;i<n;++i){var regex=regexs[i];if(regex.global||regex.multiline){throw new Error(''+regex);}
+rewritten.push('(?:'+allowAnywhereFoldCaseAndRenumberGroups(regex)+')');}
+return new RegExp(rewritten.join('|'),ignoreCase?'gi':'g');}
+function extractSourceSpans(node,isPreformatted){var nocode=/(?:^|\s)nocode(?:\s|$)/;var chunks=[];var length=0;var spans=[];var k=0;function walk(node){switch(node.nodeType){case 1:if(nocode.test(node.className)){return;}
+for(var child=node.firstChild;child;child=child.nextSibling){walk(child);}
+var nodeName=node.nodeName.toLowerCase();if('br'===nodeName||'li'===nodeName){chunks[k]='\n';spans[k<<1]=length++;spans[(k++<<1)|1]=node;}
+break;case 3:case 4:var text=node.nodeValue;if(text.length){if(!isPreformatted){text=text.replace(/[ \t\r\n]+/g,' ');}else{text=text.replace(/\r\n?/g,'\n');text=text.replace(/^(\r?\n\s*)+/g,'');text=text.replace(/^\s*/g,'');text=text.replace(/(\r?\n\s*)+$/g,'');}
+chunks[k]=text;spans[k<<1]=length;length+=text.length;spans[(k++<<1)|1]=node;}
+break;}}
+walk(node);return{sourceCode:chunks.join('').replace(/\n$/,''),spans:spans};}
+function appendDecorations(basePos,sourceCode,langHandler,out){if(!sourceCode){return;}
+var job={sourceCode:sourceCode,basePos:basePos};langHandler(job);out.push.apply(out,job.decorations);}
+var notWs=/\S/;function childContentWrapper(element){var wrapper=undefined;for(var c=element.firstChild;c;c=c.nextSibling){var type=c.nodeType;wrapper=(type===1)?(wrapper?element:c):(type===3)?(notWs.test(c.nodeValue)?element:wrapper):wrapper;}
+return wrapper===element?undefined:wrapper;}
+function createSimpleLexer(shortcutStylePatterns,fallthroughStylePatterns){var shortcuts={};var tokenizer;(function(){var allPatterns=shortcutStylePatterns.concat(fallthroughStylePatterns);var allRegexs=[];var regexKeys={};for(var i=0,n=allPatterns.length;i<n;++i){var patternParts=allPatterns[i];var shortcutChars=patternParts[3];if(shortcutChars){for(var c=shortcutChars.length;--c>=0;){shortcuts[shortcutChars.charAt(c)]=patternParts;}}
+var regex=patternParts[1];var k=''+regex;if(!regexKeys.hasOwnProperty(k)){allRegexs.push(regex);regexKeys[k]=null;}}
+allRegexs.push(/[\0-\uffff]/);tokenizer=combinePrefixPatterns(allRegexs);})();var nPatterns=fallthroughStylePatterns.length;var decorate=function(job){var sourceCode=job.sourceCode,basePos=job.basePos;var decorations=[basePos,PR_PLAIN];var pos=0;var tokens=sourceCode.match(tokenizer)||[];var styleCache={};for(var ti=0,nTokens=tokens.length;ti<nTokens;++ti){var token=tokens[ti];var style=styleCache[token];var match=void 0;var isEmbedded;if(typeof style==='string'){isEmbedded=false;}else{var patternParts=shortcuts[token.charAt(0)];if(patternParts){match=token.match(patternParts[1]);style=patternParts[0];}else{for(var i=0;i<nPatterns;++i){patternParts=fallthroughStylePatterns[i];match=token.match(patternParts[1]);if(match){style=patternParts[0];break;}}
+if(!match){style=PR_PLAIN;}}
+isEmbedded=style.length>=5&&'lang-'===style.substring(0,5);if(isEmbedded&&!(match&&typeof match[1]==='string')){isEmbedded=false;style=PR_SOURCE;}
+if(!isEmbedded){styleCache[token]=style;}}
+var tokenStart=pos;pos+=token.length;if(!isEmbedded){decorations.push(basePos+tokenStart,style);}else{var embeddedSource=match[1];var embeddedSourceStart=token.indexOf(embeddedSource);var embeddedSourceEnd=embeddedSourceStart+embeddedSource.length;if(match[2]){embeddedSourceEnd=token.length-match[2].length;embeddedSourceStart=embeddedSourceEnd-embeddedSource.length;}
+var lang=style.substring(5);appendDecorations(basePos+tokenStart,token.substring(0,embeddedSourceStart),decorate,decorations);appendDecorations(basePos+tokenStart+embeddedSourceStart,embeddedSource,langHandlerForExtension(lang,embeddedSource),decorations);appendDecorations(basePos+tokenStart+embeddedSourceEnd,token.substring(embeddedSourceEnd),decorate,decorations);}}
+job.decorations=decorations;};return decorate;}
+function sourceDecorator(options){var shortcutStylePatterns=[],fallthroughStylePatterns=[];if(options['tripleQuotedStrings']){shortcutStylePatterns.push([PR_STRING,/^(?:\'\'\'(?:[^\'\\]|\\[\s\S]|\'{1,2}(?=[^\']))*(?:\'\'\'|$)|\"\"\"(?:[^\"\\]|\\[\s\S]|\"{1,2}(?=[^\"]))*(?:\"\"\"|$)|\'(?:[^\\\']|\\[\s\S])*(?:\'|$)|\"(?:[^\\\"]|\\[\s\S])*(?:\"|$))/,null,'\'"']);}else if(options['multiLineStrings']){shortcutStylePatterns.push([PR_STRING,/^(?:\'(?:[^\\\']|\\[\s\S])*(?:\'|$)|\"(?:[^\\\"]|\\[\s\S])*(?:\"|$)|\`(?:[^\\\`]|\\[\s\S])*(?:\`|$))/,null,'\'"`']);}else{shortcutStylePatterns.push([PR_STRING,/^(?:\'(?:[^\\\'\r\n]|\\.)*(?:\'|$)|\"(?:[^\\\"\r\n]|\\.)*(?:\"|$))/,null,'"\'']);}
+if(options['verbatimStrings']){fallthroughStylePatterns.push([PR_STRING,/^@\"(?:[^\"]|\"\")*(?:\"|$)/,null]);}
+var hc=options['hashComments'];if(hc){if(options['cStyleComments']){if(hc>1){shortcutStylePatterns.push([PR_COMMENT,/^#(?:##(?:[^#]|#(?!##))*(?:###|$)|.*)/,null,'#']);}else{shortcutStylePatterns.push([PR_COMMENT,/^#(?:(?:define|elif|else|endif|error|ifdef|include|ifndef|line|pragma|undef|warning)\b|[^\r\n]*)/,null,'#']);}
+fallthroughStylePatterns.push([PR_STRING,/^<(?:(?:(?:\.\.\/)*|\/?)(?:[\w-]+(?:\/[\w-]+)+)?[\w-]+\.h(?:h|pp|\+\+)?|[a-z]\w*)>/,null]);}else{shortcutStylePatterns.push([PR_COMMENT,/^#[^\r\n]*/,null,'#']);}}
+if(options['cStyleComments']){fallthroughStylePatterns.push([PR_COMMENT,/^\/\/[^\r\n]*/,null]);fallthroughStylePatterns.push([PR_COMMENT,/^\/\*[\s\S]*?(?:\*\/|$)/,null]);}
+if(options['regexLiterals']){var REGEX_LITERAL=('/(?=[^/*])'
++'(?:[^/\\x5B\\x5C]'
++'|\\x5C[\\s\\S]'
++'|\\x5B(?:[^\\x5C\\x5D]|\\x5C[\\s\\S])*(?:\\x5D|$))+'
++'/');fallthroughStylePatterns.push(['lang-regex',new RegExp('^'+REGEXP_PRECEDER_PATTERN+'('+REGEX_LITERAL+')')]);}
+var types=options['types'];if(types){fallthroughStylePatterns.push([PR_TYPE,types]);}
+if(options['strings']){var strings=(""+options['strings']).replace(/^ | $/g,'').replace(/-/g,'\\-');fallthroughStylePatterns.push([PR_STRING,new RegExp('(?:'+strings.replace(/[\s,]+/g,'|')+')'),,null]);}
+var keywords=(""+options['keywords']).replace(/^ | $/g,'');if(keywords.length){fallthroughStylePatterns.push([PR_KEYWORD,new RegExp('^(?:'+keywords.replace(/[\s,]+/g,'|')+')\\b'),null]);}
+shortcutStylePatterns.push([PR_PLAIN,/^\s+/,null,' \r\n\t\xA0']);if(options['httpdComments']){fallthroughStylePatterns.push([PR_PLAIN,/^.*\S.*#/i,null]);}
+fallthroughStylePatterns.push([PR_LITERAL,/^@[a-z_$][a-z_$@0-9]*|\bNULL\b/i,null],[PR_LITERAL,CONFIG_OPTIONS,null],[PR_TAG,/^\b(AuthzProviderAlias|AuthnProviderAlias|RequireAny|RequireAll|RequireNone|Directory|DirectoryMatch|Location|LocationMatch|VirtualHost|If|Else|ElseIf|Proxy\b|LoadBalancer|Files|FilesMatch|Limit|LimitExcept|IfDefine|IfModule|IfVersion)\b/,null],[PR_TYPE,/^(?:[@_]?[A-Z]+[a-z][A-Za-z_$@0-9]*|\w+_(t|req|module)\b)/,null],[PR_TAG,/^apr_[a-z_0-9]+|ap_[a-z_0-9]+/i,null],[PR_PLAIN,/^[a-z_$][a-z_$@0-9\-]*/i,null],[PR_LITERAL,new RegExp('^(?:'
++'0x[a-f0-9]+'
++'|[a-f0-9:]+:[a-f0-9:]+:[a-f0-9:]+:[a-f0-9:]+:[a-f0-9:]+:[a-f0-9:]+'
++'|(?:\\d(?:_\\d+)*\\d*(?:\\.\\d*)?|\\.\\d\\+)'
++'(?:e[+\\-]?\\d+)?'
++')'
++'[a-z]*','i'),null,'0123456789'],[PR_PLAIN,/^\\[\s\S]?/,null],[PR_PUNCTUATION,/^.[^\s\w\.$@\'\"\`\/\#\\]*/,null]);return createSimpleLexer(shortcutStylePatterns,fallthroughStylePatterns);}
+var decorateSource=sourceDecorator({'keywords':ALL_KEYWORDS,'hashComments':true,'cStyleComments':true,'multiLineStrings':true,'regexLiterals':true});function numberLines(node,opt_startLineNum,isPreformatted){var nocode=/(?:^|\s)nocode(?:\s|$)/;var lineBreak=/\r\n?|\n/;var document=node.ownerDocument;var li=document.createElement('li');while(node.firstChild){li.appendChild(node.firstChild);}
+var listItems=[li];function walk(node){switch(node.nodeType){case 1:if(nocode.test(node.className)){break;}
+if('br'===node.nodeName){breakAfter(node);if(node.parentNode){node.parentNode.removeChild(node);}}else{for(var child=node.firstChild;child;child=child.nextSibling){walk(child);}}
+break;case 3:case 4:if(isPreformatted){var text=node.nodeValue;var match=text.match(lineBreak);if(match){var firstLine=text.substring(0,match.index);node.nodeValue=firstLine;var tail=text.substring(match.index+match[0].length);if(tail){var parent=node.parentNode;parent.insertBefore(document.createTextNode(tail),node.nextSibling);}
+breakAfter(node);if(!firstLine){node.parentNode.removeChild(node);}}}
+break;}}
+function breakAfter(lineEndNode){while(!lineEndNode.nextSibling){lineEndNode=lineEndNode.parentNode;if(!lineEndNode){return;}}
+function breakLeftOf(limit,copy){var rightSide=copy?limit.cloneNode(false):limit;var parent=limit.parentNode;if(parent){var parentClone=breakLeftOf(parent,1);var next=limit.nextSibling;parentClone.appendChild(rightSide);for(var sibling=next;sibling;sibling=next){next=sibling.nextSibling;parentClone.appendChild(sibling);}}
+return rightSide;}
+var copiedListItem=breakLeftOf(lineEndNode.nextSibling,0);for(var parent;(parent=copiedListItem.parentNode)&&parent.nodeType===1;){copiedListItem=parent;}
+listItems.push(copiedListItem);}
+for(var i=0;i<listItems.length;++i){walk(listItems[i]);}
+if(opt_startLineNum===(opt_startLineNum|0)){listItems[0].setAttribute('value',opt_startLineNum);}
+var ol=document.createElement('ol');ol.className='linenums';var offset=Math.max(0,((opt_startLineNum-1))|0)||0;for(var i=0,n=listItems.length;i<n;++i){li=listItems[i];li.className='L'+((i+offset)%1);if(!li.firstChild){li.appendChild(document.createTextNode('\xA0'));}
+ol.appendChild(li);}
+node.appendChild(ol);}
+function recombineTagsAndDecorations(job){var isIE8OrEarlier=/\bMSIE\s(\d+)/.exec(navigator.userAgent);isIE8OrEarlier=isIE8OrEarlier&&+isIE8OrEarlier[1]<=8;var newlineRe=/\n/g;var source=job.sourceCode;var sourceLength=source.length;var sourceIndex=0;var spans=job.spans;var nSpans=spans.length;var spanIndex=0;var decorations=job.decorations;var nDecorations=decorations.length;var decorationIndex=0;decorations[nDecorations]=sourceLength;var decPos,i;for(i=decPos=0;i<nDecorations;){if(decorations[i]!==decorations[i+2]){decorations[decPos++]=decorations[i++];decorations[decPos++]=decorations[i++];}else{i+=2;}}
+nDecorations=decPos;for(i=decPos=0;i<nDecorations;){var startPos=decorations[i];var startDec=decorations[i+1];var end=i+2;while(end+2<=nDecorations&&decorations[end+1]===startDec){end+=2;}
+decorations[decPos++]=startPos;decorations[decPos++]=startDec;i=end;}
+nDecorations=decorations.length=decPos;var sourceNode=job.sourceNode;var oldDisplay;if(sourceNode){oldDisplay=sourceNode.style.display;sourceNode.style.display='none';}
+try{var decoration=null;var X=0;while(spanIndex<nSpans){X=X+1;if(X>5000){break;}
+var spanStart=spans[spanIndex];var spanEnd=spans[spanIndex+2]||sourceLength;var decEnd=decorations[decorationIndex+2]||sourceLength;var end=Math.min(spanEnd,decEnd);var textNode=spans[spanIndex+1];var styledText;if(textNode.nodeType!==1&&(styledText=source.substring(sourceIndex,end))){if(isIE8OrEarlier){styledText=styledText.replace(newlineRe,'\r');}
+textNode.nodeValue=styledText;var document=textNode.ownerDocument;var span=document.createElement('span');span.className=decorations[decorationIndex+1];var parentNode=textNode.parentNode;parentNode.replaceChild(span,textNode);span.appendChild(textNode);if(sourceIndex<spanEnd){spans[spanIndex+1]=textNode=document.createTextNode(source.substring(end,spanEnd));parentNode.insertBefore(textNode,span.nextSibling);}}
+sourceIndex=end;if(sourceIndex>=spanEnd){spanIndex+=2;}
+if(sourceIndex>=decEnd){decorationIndex+=2;}}}finally{if(sourceNode){sourceNode.style.display=oldDisplay;}}}
+var langHandlerRegistry={};function registerLangHandler(handler,fileExtensions){for(var i=fileExtensions.length;--i>=0;){var ext=fileExtensions[i];if(!langHandlerRegistry.hasOwnProperty(ext)){langHandlerRegistry[ext]=handler;}else if(win['console']){console['warn']('cannot override language handler %s',ext);}}}
+function langHandlerForExtension(extension,source){if(!(extension&&langHandlerRegistry.hasOwnProperty(extension))){extension=/^\s*</.test(source)?'default-markup':'default-code';}
+return langHandlerRegistry[extension];}
+registerLangHandler(decorateSource,['default-code']);registerLangHandler(createSimpleLexer([],[[PR_PLAIN,/^[^<?]+/],[PR_DECLARATION,/^<!\w[^>]*(?:>|$)/],[PR_COMMENT,/^<\!--[\s\S]*?(?:-\->|$)/],['lang-',/^<\?([\s\S]+?)(?:\?>|$)/],['lang-',/^<%([\s\S]+?)(?:%>|$)/],[PR_PUNCTUATION,/^(?:<[%?]|[%?]>)/],['lang-',/^<xmp\b[^>]*>([\s\S]+?)<\/xmp\b[^>]*>/i],['lang-js',/^<script\b[^>]*>([\s\S]*?)(<\/script\b[^>]*>)/i],['lang-css',/^<style\b[^>]*>([\s\S]*?)(<\/style\b[^>]*>)/i],['lang-in.tag',/^(<\/?[a-z][^<>]*>)/i]]),['default-markup','htm','html','mxml','xhtml','xml','xsl']);registerLangHandler(createSimpleLexer([[PR_PLAIN,/^[\s]+/,null,' \t\r\n'],[PR_ATTRIB_VALUE,/^(?:\"[^\"]*\"?|\'[^\']*\'?)/,null,'\"\'']],[[PR_TAG,/^^<\/?[a-z](?:[\w.:-]*\w)?|\/?>$/i],[PR_ATTRIB_NAME,/^(?!style[\s=]|on)[a-z](?:[\w:-]*\w)?/i],['lang-uq.val',/^=\s*([^>\'\"\s]*(?:[^>\'\"\s\/]|\/(?=\s)))/],[PR_PUNCTUATION,/^[=<>\/]+/],['lang-js',/^on\w+\s*=\s*\"([^\"]+)\"/i],['lang-js',/^on\w+\s*=\s*\'([^\']+)\'/i],['lang-js',/^on\w+\s*=\s*([^\"\'>\s]+)/i],['lang-css',/^style\s*=\s*\"([^\"]+)\"/i],['lang-css',/^style\s*=\s*\'([^\']+)\'/i],['lang-css',/^style\s*=\s*([^\"\'>\s]+)/i]]),['in.tag']);registerLangHandler(createSimpleLexer([],[[PR_ATTRIB_VALUE,/^[\s\S]+/]]),['uq.val']);registerLangHandler(sourceDecorator({'keywords':CPP_KEYWORDS,'hashComments':true,'cStyleComments':true,'types':C_TYPES}),['c','cc','cpp','cxx','cyc','m']);registerLangHandler(sourceDecorator({'keywords':PHP_KEYWORDS,'hashComments':false,'cStyleComments':true,'multiLineStrings':true,'regexLiterals':true}),['php','phtml','inc']);registerLangHandler(sourceDecorator({'keywords':'null,true,false'}),['json']);registerLangHandler(sourceDecorator({'keywords':CSHARP_KEYWORDS,'hashComments':true,'cStyleComments':true,'verbatimStrings':true,'types':C_TYPES}),['cs']);registerLangHandler(sourceDecorator({'keywords':JAVA_KEYWORDS,'cStyleComments':true}),['java']);registerLangHandler(sourceDecorator({'keywords':SH_KEYWORDS,'hashComments':true,'multiLineStrings':true}),['bsh','csh','sh']);registerLangHandler(sourceDecorator({'keywords':PYTHON_KEYWORDS,'hashComments':true,'multiLineStrings':true,'tripleQuotedStrings':true}),['cv','py']);registerLangHandler(sourceDecorator({'keywords':PERL_KEYWORDS,'hashComments':true,'multiLineStrings':true,'regexLiterals':true}),['perl','pl','pm']);registerLangHandler(sourceDecorator({'keywords':RUBY_KEYWORDS,'hashComments':true,'multiLineStrings':true,'regexLiterals':true}),['rb']);registerLangHandler(sourceDecorator({'keywords':JSCRIPT_KEYWORDS,'cStyleComments':true,'regexLiterals':true}),['js']);registerLangHandler(sourceDecorator({'keywords':COFFEE_KEYWORDS,'hashComments':3,'cStyleComments':true,'multilineStrings':true,'tripleQuotedStrings':true,'regexLiterals':true}),['coffee']);registerLangHandler(createSimpleLexer([],[[PR_STRING,/^[\s\S]+/]]),['regex']);registerLangHandler(sourceDecorator({'keywords':CONFIG_KEYWORDS,'literals':CONFIG_OPTIONS,'strings':CONFIG_ENVS,'hashComments':true,'cStyleComments':false,'multiLineStrings':false,'regexLiterals':false,'httpdComments':true}),['config']);function applyDecorator(job){var opt_langExtension=job.langExtension;try{var sourceAndSpans=extractSourceSpans(job.sourceNode,job.pre);var source=sourceAndSpans.sourceCode;job.sourceCode=source;job.spans=sourceAndSpans.spans;job.basePos=0;langHandlerForExtension(opt_langExtension,source)(job);recombineTagsAndDecorations(job);}catch(e){if(win['console']){console['log'](e&&e['stack']?e['stack']:e);}}}
+function prettyPrintOne(sourceCodeHtml,opt_langExtension,opt_numberLines){var container=document.createElement('pre');container.innerHTML=sourceCodeHtml;if(opt_numberLines){numberLines(container,opt_numberLines,true);}
+var job={langExtension:opt_langExtension,numberLines:opt_numberLines,sourceNode:container,pre:1};applyDecorator(job);return container.innerHTML;}
+function prettyPrint(opt_whenDone){function byTagName(tn){return document.getElementsByTagName(tn);}
+var codeSegments=[byTagName('pre'),byTagName('code'),byTagName('xmp')];var elements=[];for(var i=0;i<codeSegments.length;++i){for(var j=0,n=codeSegments[i].length;j<n;++j){elements.push(codeSegments[i][j]);}}
+codeSegments=null;var clock=Date;if(!clock['now']){clock={'now':function(){return+(new Date);}};}
+var k=0;var prettyPrintingJob;var langExtensionRe=/\blang(?:uage)?-([\w.]+)(?!\S)/;var prettyPrintRe=/\bprettyprint\b/;var prettyPrintedRe=/\bprettyprinted\b/;var preformattedTagNameRe=/pre|xmp/i;var codeRe=/^code$/i;var preCodeXmpRe=/^(?:pre|code|xmp)$/i;function doWork(){var endTime=(win['PR_SHOULD_USE_CONTINUATION']?clock['now']()+250:Infinity);for(;k<elements.length&&clock['now']()<endTime;k++){var cs=elements[k];var className=cs.className;if(prettyPrintRe.test(className)&&!prettyPrintedRe.test(className)){var nested=false;for(var p=cs.parentNode;p;p=p.parentNode){var tn=p.tagName;if(preCodeXmpRe.test(tn)&&p.className&&prettyPrintRe.test(p.className)){nested=true;break;}}
+if(!nested){cs.className+=' prettyprinted';var langExtension=className.match(langExtensionRe);var wrapper;if(!langExtension&&(wrapper=childContentWrapper(cs))&&codeRe.test(wrapper.tagName)){langExtension=wrapper.className.match(langExtensionRe);}
+if(langExtension){langExtension=langExtension[1];}
+var preformatted;if(preformattedTagNameRe.test(cs.tagName)){preformatted=1;}else{var currentStyle=cs['currentStyle'];var whitespace=(currentStyle?currentStyle['whiteSpace']:(document.defaultView&&document.defaultView.getComputedStyle)?document.defaultView.getComputedStyle(cs,null).getPropertyValue('white-space'):0);preformatted=whitespace&&'pre'===whitespace.substring(0,3);}
+var lineNums=cs.className.match(/\blinenums\b(?::(\d+))?/);lineNums=lineNums?lineNums[1]&&lineNums[1].length?+lineNums[1]:true:false;if(lineNums){numberLines(cs,lineNums,preformatted);}
+prettyPrintingJob={langExtension:langExtension,sourceNode:cs,numberLines:lineNums,pre:preformatted};applyDecorator(prettyPrintingJob);}}}
+if(k<elements.length){setTimeout(doWork,250);}else if(opt_whenDone){opt_whenDone();}}
+doWork();}
+var PR=win['PR']={'createSimpleLexer':createSimpleLexer,'registerLangHandler':registerLangHandler,'sourceDecorator':sourceDecorator,'PR_ATTRIB_NAME':PR_ATTRIB_NAME,'PR_ATTRIB_VALUE':PR_ATTRIB_VALUE,'PR_COMMENT':PR_COMMENT,'PR_DECLARATION':PR_DECLARATION,'PR_KEYWORD':PR_KEYWORD,'PR_LITERAL':PR_LITERAL,'PR_NOCODE':PR_NOCODE,'PR_PLAIN':PR_PLAIN,'PR_PUNCTUATION':PR_PUNCTUATION,'PR_SOURCE':PR_SOURCE,'PR_STRING':PR_STRING,'PR_TAG':PR_TAG,'PR_TYPE':PR_TYPE,'prettyPrintOne':win['prettyPrintOne']=prettyPrintOne,'prettyPrint':win['prettyPrint']=prettyPrint};PR['registerLangHandler'](PR['createSimpleLexer']([[PR['PR_PLAIN'],/^[\t\n\r \xA0]+/,null,'\t\n\r \xA0'],[PR['PR_STRING'],/^(?:\"(?:[^\"\\]|\\[\s\S])*(?:\"|$)|\'(?:[^\'\\]|\\[\s\S])*(?:\'|$))/,null,'"\'']],[[PR['PR_COMMENT'],/^--(?:\[(=*)\[[\s\S]*?(?:\]\1\]|$)|[^\r\n]*)/],[PR['PR_TYPE'],/^nil|false|true/],[PR['PR_STRING'],/^\[(=*)\[[\s\S]*?(?:\]\1\]|$)/],[PR['PR_KEYWORD'],/^(?:and|break|do|else|elseif|end|for|function|if|in|local|not|or|repeat|require|return|then|until|while)\b/,null],[PR['PR_LITERAL'],/^[+-]?(?:0x[\da-f]+|(?:(?:\.\d+|\d+(?:\.\d*)?)(?:e[+\-]?\d+)?))/i],[PR['PR_PLAIN'],/^[a-z_]\w*/i],[PR['PR_PUNCTUATION'],/^[^\w\t\n\r \xA0][^\w\t\n\r \xA0\"\'\-\+=]*/]]),['lua']);if(typeof define==="function"&&define['amd']){define("google-code-prettify",[],function(){return PR;});}})();
\ No newline at end of file
diff --git a/docs/manual/style/sitemap.dtd b/docs/manual/style/sitemap.dtd
new file mode 100644
index 0000000..829f326
--- /dev/null
+++ b/docs/manual/style/sitemap.dtd
@@ -0,0 +1,42 @@
+<?xml version='1.0' encoding='UTF-8' ?>
+
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements.  See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License.  You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+
+<!ENTITY % common SYSTEM "common.dtd">
+%common;
+
+<!-- <sitemap> is the root element -->
+<!ELEMENT sitemap (title, summary?, seealso*, category*)>
+
+<!ATTLIST sitemap metafile CDATA  #REQUIRED
+                  upgrade  CDATA  #IMPLIED
+>
+
+<!-- <indexpage> is another root element -->
+<!ELEMENT indexpage (parentdocument, title, category*)>
+
+<!ATTLIST indexpage metafile CDATA  #REQUIRED
+                    upgrade  CDATA  #IMPLIED
+>
+
+<!ELEMENT category (title, page*)>
+<!ATTLIST category id ID #IMPLIED>
+
+<!ELEMENT page (#PCDATA)>
+<!ATTLIST page href CDATA #IMPLIED
+               separate (yes | no) "no" >
diff --git a/docs/manual/style/version.ent b/docs/manual/style/version.ent
new file mode 100644
index 0000000..5ae5960
--- /dev/null
+++ b/docs/manual/style/version.ent
@@ -0,0 +1,24 @@
+<?xml version='1.0' encoding='UTF-8' ?>
+
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements.  See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License.  You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+
+<!ENTITY httpd.major "2">
+<!ENTITY httpd.minor "4">
+<!ENTITY httpd.patch "18">
+
+<!ENTITY httpd.docs "2.4">
diff --git a/docs/manual/suexec.html b/docs/manual/suexec.html
new file mode 100644
index 0000000..c4cc65b
--- /dev/null
+++ b/docs/manual/suexec.html
@@ -0,0 +1,21 @@
+# GENERATED FROM XML -- DO NOT EDIT
+
+URI: suexec.html.en
+Content-Language: en
+Content-type: text/html; charset=ISO-8859-1
+
+URI: suexec.html.fr
+Content-Language: fr
+Content-type: text/html; charset=ISO-8859-1
+
+URI: suexec.html.ja.utf8
+Content-Language: ja
+Content-type: text/html; charset=UTF-8
+
+URI: suexec.html.ko.euc-kr
+Content-Language: ko
+Content-type: text/html; charset=EUC-KR
+
+URI: suexec.html.tr.utf8
+Content-Language: tr
+Content-type: text/html; charset=UTF-8
diff --git a/docs/manual/suexec.html.en b/docs/manual/suexec.html.en
new file mode 100644
index 0000000..ef38896
--- /dev/null
+++ b/docs/manual/suexec.html.en
@@ -0,0 +1,643 @@
+<?xml version="1.0" encoding="ISO-8859-1"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head>
+<meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type" />
+<!--
+        XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+              This file is generated from xml source: DO NOT EDIT
+        XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+      -->
+<title>suEXEC Support - Apache HTTP Server Version 2.4</title>
+<link href="./style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" />
+<link href="./style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" />
+<link href="./style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" /><link rel="stylesheet" type="text/css" href="./style/css/prettify.css" />
+<script src="./style/scripts/prettify.min.js" type="text/javascript">
+</script>
+
+<link href="./images/favicon.ico" rel="shortcut icon" /></head>
+<body id="manual-page"><div id="page-header">
+<p class="menu"><a href="./mod/">Modules</a> | <a href="./mod/directives.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="./glossary.html">Glossary</a> | <a href="./sitemap.html">Sitemap</a></p>
+<p class="apache">Apache HTTP Server Version 2.4</p>
+<img alt="" src="./images/feather.gif" /></div>
+<div class="up"><a href="./"><img title="&lt;-" alt="&lt;-" src="./images/left.gif" /></a></div>
+<div id="path">
+<a href="http://www.apache.org/">Apache</a> &gt; <a href="http://httpd.apache.org/">HTTP Server</a> &gt; <a href="http://httpd.apache.org/docs/">Documentation</a> &gt; <a href="./">Version 2.4</a></div><div id="page-content"><div id="preamble"><h1>suEXEC Support</h1>
+<div class="toplang">
+<p><span>Available Languages: </span><a href="./en/suexec.html" title="English">&nbsp;en&nbsp;</a> |
+<a href="./fr/suexec.html" hreflang="fr" rel="alternate" title="Fran�ais">&nbsp;fr&nbsp;</a> |
+<a href="./ja/suexec.html" hreflang="ja" rel="alternate" title="Japanese">&nbsp;ja&nbsp;</a> |
+<a href="./ko/suexec.html" hreflang="ko" rel="alternate" title="Korean">&nbsp;ko&nbsp;</a> |
+<a href="./tr/suexec.html" hreflang="tr" rel="alternate" title="T�rk�e">&nbsp;tr&nbsp;</a></p>
+</div>
+
+    <p>The <strong>suEXEC</strong> feature provides users of the Apache
+    HTTP Server the ability
+    to run <strong>CGI</strong> and <strong>SSI</strong> programs
+    under user IDs different from the user ID of the calling
+    web server. Normally, when a CGI or SSI program executes, it
+    runs as the same user who is running the web server.</p>
+
+    <p>Used properly, this feature can reduce
+    considerably the security risks involved with allowing users to
+    develop and run private CGI or SSI programs. However, if suEXEC
+    is improperly configured, it can cause any number of problems
+    and possibly create new holes in your computer's security. If
+    you aren't familiar with managing <em>setuid root</em> programs
+    and the security issues they present, we highly recommend that
+    you not consider using suEXEC.</p>
+  </div>
+<div id="quickview"><ul id="toc"><li><img alt="" src="./images/down.gif" /> <a href="#before">Before we begin</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#model">suEXEC Security Model</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#install">Configuring &amp; Installing
+    suEXEC</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#enable">Enabling &amp; Disabling
+    suEXEC</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#usage">Using suEXEC</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#debug">Debugging suEXEC</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#jabberwock">Beware the Jabberwock:
+    Warnings &amp; Examples</a></li>
+</ul><ul class="seealso"><li><a href="#comments_section">Comments</a></li></ul></div>
+<div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="before" id="before">Before we begin</a></h2>
+
+    <p>Before jumping head-first into this document,
+    you should be aware that certain assumptions are made about you and
+    the environment in which you will be using suexec.</p>
+
+    <p>First, it is assumed that you are using a UNIX
+    derivative operating system that is capable of
+    <strong>setuid</strong> and <strong>setgid</strong> operations.
+    All command examples are given in this regard. Other platforms,
+    if they are capable of supporting suEXEC, may differ in their
+    configuration.</p>
+
+    <p>Second, it is assumed you are familiar with
+    some basic concepts of your computer's security and its
+    administration. This involves an understanding of
+    <strong>setuid/setgid</strong> operations and the various
+    effects they may have on your system and its level of
+    security.</p>
+
+    <p>Third, it is assumed that you are using an
+    <strong>unmodified</strong> version of suEXEC code. All code
+    for suEXEC has been carefully scrutinized and tested by the
+    developers as well as numerous beta testers. Every precaution
+    has been taken to ensure a simple yet solidly safe base of
+    code. Altering this code can cause unexpected problems and new
+    security risks. It is <strong>highly</strong> recommended you
+    not alter the suEXEC code unless you are well versed in the
+    particulars of security programming and are willing to share
+    your work with the Apache HTTP Server development team for consideration.</p>
+
+    <p>Fourth, and last, it has been the decision of
+    the Apache HTTP Server development team to <strong>NOT</strong> make suEXEC part of
+    the default installation of Apache httpd. To this end, suEXEC
+    configuration requires of the administrator careful attention
+    to details. After due consideration has been given to the
+    various settings for suEXEC, the administrator may install
+    suEXEC through normal installation methods. The values for
+    these settings need to be carefully determined and specified by
+    the administrator to properly maintain system security during
+    the use of suEXEC functionality. It is through this detailed
+    process that we hope to limit suEXEC
+    installation only to those who are careful and determined
+    enough to use it.</p>
+
+    <p>Still with us? Yes? Good. Let's move on!</p>
+</div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="model" id="model">suEXEC Security Model</a></h2>
+
+    <p>Before we begin configuring and installing
+    suEXEC, we will first discuss the security model you are about
+    to implement. By doing so, you may better understand what
+    exactly is going on inside suEXEC and what precautions are
+    taken to ensure your system's security.</p>
+
+    <p><strong>suEXEC</strong> is based on a setuid
+    "wrapper" program that is called by the main Apache HTTP Server.
+    This wrapper is called when an HTTP request is made for a CGI
+    or SSI program that the administrator has designated to run as
+    a userid other than that of the main server. When such a
+    request is made, Apache httpd provides the suEXEC wrapper with the
+    program's name and the user and group IDs under which the
+    program is to execute.</p>
+
+    <p>The wrapper then employs the following process
+    to determine success or failure -- if any one of these
+    conditions fail, the program logs the failure and exits with an
+    error, otherwise it will continue:</p>
+
+    <ol>
+      <li>
+        <strong>Is the user executing this wrapper a valid user of
+        this system?</strong>
+
+        <p class="indent">
+          This is to ensure that the user executing the wrapper is
+          truly a user of the system.
+        </p>
+     </li>
+
+     <li>
+        <strong>Was the wrapper called with the proper number of
+        arguments?</strong>
+
+        <p class="indent">
+          The wrapper will only execute if it is given the proper
+          number of arguments. The proper argument format is known
+          to the Apache HTTP Server. If the wrapper is not receiving
+          the proper number of arguments, it is either being
+          hacked, or there is something wrong with the suEXEC
+          portion of your Apache httpd binary.
+        </p>
+      </li>
+
+      <li>
+        <strong>Is this valid user allowed to run the
+        wrapper?</strong>
+
+        <p class="indent">
+          Is this user the user allowed to run this wrapper? Only
+          one user (the Apache user) is allowed to execute this
+          program.
+        </p>
+      </li>
+
+      <li>
+        <strong>Does the target CGI or SSI program have an unsafe
+        hierarchical reference?</strong>
+
+        <p class="indent">
+          Does the target CGI or SSI program's path contain a leading
+          '/' or have a '..' backreference? These are not allowed; the
+          target CGI/SSI program must reside within suEXEC's document
+          root (see <code>--with-suexec-docroot=<em>DIR</em></code>
+          below).
+        </p>
+      </li>
+
+      <li>
+        <strong>Is the target user name valid?</strong>
+
+        <p class="indent">
+          Does the target user exist?
+        </p>
+      </li>
+
+      <li>
+        <strong>Is the target group name valid?</strong>
+
+        <p class="indent">
+          Does the target group exist?
+        </p>
+      </li>
+
+      <li>
+        <strong>Is the target user <em>NOT</em> superuser?</strong>
+
+
+        <p class="indent">
+          suEXEC does not allow <code><em>root</em></code>
+          to execute CGI/SSI programs.
+        </p>
+      </li>
+
+      <li>
+        <strong>Is the target userid <em>ABOVE</em> the minimum ID
+        number?</strong>
+
+        <p class="indent">
+          The minimum user ID number is specified during
+          configuration. This allows you to set the lowest possible
+          userid that will be allowed to execute CGI/SSI programs.
+          This is useful to block out "system" accounts.
+        </p>
+      </li>
+
+      <li>
+        <strong>Is the target group <em>NOT</em> the superuser
+        group?</strong>
+
+        <p class="indent">
+          Presently, suEXEC does not allow the <code><em>root</em></code>
+          group to execute CGI/SSI programs.
+        </p>
+      </li>
+
+      <li>
+        <strong>Is the target groupid <em>ABOVE</em> the minimum ID
+        number?</strong>
+
+        <p class="indent">
+          The minimum group ID number is specified during
+          configuration. This allows you to set the lowest possible
+          groupid that will be allowed to execute CGI/SSI programs.
+          This is useful to block out "system" groups.
+        </p>
+      </li>
+
+      <li>
+        <strong>Can the wrapper successfully become the target user
+        and group?</strong>
+
+        <p class="indent">
+          Here is where the program becomes the target user and
+          group via setuid and setgid calls. The group access list
+          is also initialized with all of the groups of which the
+          user is a member.
+        </p>
+      </li>
+
+      <li>
+        <strong>Can we change directory to the one in which the target
+        CGI/SSI program resides?</strong>
+
+        <p class="indent">
+          If it doesn't exist, it can't very well contain files. If we
+          can't change directory to it, it might as well not exist.
+        </p>
+      </li>
+
+      <li>
+        <strong>Is the directory within the httpd webspace?</strong>
+
+        <p class="indent">
+          If the request is for a regular portion of the server, is
+          the requested directory within suEXEC's document root? If
+          the request is for a <code class="directive"><a href="./mod/mod_userdir.html#userdir">UserDir</a></code>, is the requested directory
+          within the directory configured as suEXEC's userdir (see
+          <a href="#install">suEXEC's configuration options</a>)?
+        </p>
+      </li>
+
+      <li>
+        <strong>Is the directory <em>NOT</em> writable by anyone
+        else?</strong>
+
+        <p class="indent">
+          We don't want to open up the directory to others; only
+          the owner user may be able to alter this directories
+          contents.
+        </p>
+      </li>
+
+      <li>
+        <strong>Does the target CGI/SSI program exist?</strong>
+
+        <p class="indent">
+          If it doesn't exists, it can't very well be executed.
+        </p>
+      </li>
+
+      <li>
+        <strong>Is the target CGI/SSI program <em>NOT</em> writable
+        by anyone else?</strong>
+
+        <p class="indent">
+          We don't want to give anyone other than the owner the
+          ability to change the CGI/SSI program.
+        </p>
+      </li>
+
+      <li>
+        <strong>Is the target CGI/SSI program <em>NOT</em> setuid or
+        setgid?</strong>
+
+        <p class="indent">
+          We do not want to execute programs that will then change
+          our UID/GID again.
+        </p>
+      </li>
+
+      <li>
+        <strong>Is the target user/group the same as the program's
+        user/group?</strong>
+
+        <p class="indent">
+          Is the user the owner of the file?
+        </p>
+      </li>
+
+      <li>
+        <strong>Can we successfully clean the process environment
+        to ensure safe operations?</strong>
+
+        <p class="indent">
+          suEXEC cleans the process' environment by establishing a
+          safe execution PATH (defined during configuration), as
+          well as only passing through those variables whose names
+          are listed in the safe environment list (also created
+          during configuration).
+        </p>
+      </li>
+
+      <li>
+        <strong>Can we successfully become the target CGI/SSI program
+        and execute?</strong>
+
+        <p class="indent">
+          Here is where suEXEC ends and the target CGI/SSI program begins.
+        </p>
+      </li>
+    </ol>
+
+    <p>This is the standard operation of the
+    suEXEC wrapper's security model. It is somewhat stringent and
+    can impose new limitations and guidelines for CGI/SSI design,
+    but it was developed carefully step-by-step with security in
+    mind.</p>
+
+    <p>For more information as to how this security
+    model can limit your possibilities in regards to server
+    configuration, as well as what security risks can be avoided
+    with a proper suEXEC setup, see the <a href="#jabberwock">"Beware the Jabberwock"</a> section of this
+    document.</p>
+</div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="install" id="install">Configuring &amp; Installing
+    suEXEC</a></h2>
+
+    <p>Here's where we begin the fun.</p>
+
+    <p><strong>suEXEC configuration
+    options</strong><br />
+    </p>
+
+    <dl>
+      <dt><code>--enable-suexec</code></dt>
+
+      <dd>This option enables the suEXEC feature which is never
+      installed or activated by default. At least one
+      <code>--with-suexec-xxxxx</code> option has to be provided
+      together with the <code>--enable-suexec</code> option to let
+      APACI accept your request for using the suEXEC feature.</dd>
+
+      <dt><code>--with-suexec-bin=<em>PATH</em></code></dt>
+
+      <dd>The path to the <code>suexec</code> binary must be hard-coded
+      in the server for security reasons. Use this option to override
+      the default path. <em>e.g.</em>
+      <code>--with-suexec-bin=/usr/sbin/suexec</code></dd>
+
+      <dt><code>--with-suexec-caller=<em>UID</em></code></dt>
+
+      <dd>The <a href="mod/mpm_common.html#user">username</a> under which
+      httpd normally runs. This is the only user allowed to
+      execute the suEXEC wrapper.</dd>
+
+      <dt><code>--with-suexec-userdir=<em>DIR</em></code></dt>
+
+      <dd>Define to be the subdirectory under users' home
+      directories where suEXEC access should be allowed. All
+      executables under this directory will be executable by suEXEC
+      as the user so they should be "safe" programs. If you are
+      using a "simple" <code class="directive"><a href="./mod/mod_userdir.html#userdir">UserDir</a></code>
+      directive (ie. one without a "*" in it) this should be set to the same
+      value. suEXEC will not work properly in cases where the <code class="directive"><a href="./mod/mod_userdir.html#userdir">UserDir</a></code> directive points to
+      a location that is not the same as the user's home directory
+      as referenced in the <code>passwd</code> file. Default value is
+      "<code>public_html</code>".<br />
+      If you have virtual hosts with a different <code class="directive"><a href="./mod/mod_userdir.html#userdir">UserDir</a></code> for each,
+      you will need to define them to all reside in one parent
+      directory; then name that parent directory here. <strong>If
+      this is not defined properly, "~userdir" cgi requests will
+      not work!</strong></dd>
+
+      <dt><code>--with-suexec-docroot=<em>DIR</em></code></dt>
+
+      <dd>Define as the DocumentRoot set for httpd. This will be
+      the only hierarchy (aside from <code class="directive"><a href="./mod/mod_userdir.html#userdir">UserDir</a></code>s) that can be used for suEXEC behavior. The
+      default directory is the <code>--datadir</code> value with the suffix
+      "<code>/htdocs</code>", <em>e.g.</em> if you configure with
+      "<code>--datadir=/home/apache</code>" the directory
+      "<code>/home/apache/htdocs</code>" is used as document root for the
+      suEXEC wrapper.</dd>
+
+      <dt><code>--with-suexec-uidmin=<em>UID</em></code></dt>
+
+      <dd>Define this as the lowest UID allowed to be a target user
+      for suEXEC. For most systems, 500 or 100 is common. Default
+      value is 100.</dd>
+
+      <dt><code>--with-suexec-gidmin=<em>GID</em></code></dt>
+
+      <dd>Define this as the lowest GID allowed to be a target
+      group for suEXEC. For most systems, 100 is common and
+      therefore used as default value.</dd>
+
+      <dt><code>--with-suexec-logfile=<em>FILE</em></code></dt>
+
+      <dd>This defines the filename to which all suEXEC
+      transactions and errors are logged (useful for auditing and
+      debugging purposes). By default the logfile is named
+      "<code>suexec_log</code>" and located in your standard logfile
+      directory (<code>--logfiledir</code>).</dd>
+
+      <dt><code>--with-suexec-safepath=<em>PATH</em></code></dt>
+
+      <dd>Define a safe PATH environment to pass to CGI
+      executables. Default value is
+      "<code>/usr/local/bin:/usr/bin:/bin</code>".</dd>
+    </dl>
+
+    <h3>Compiling and installing the suEXEC wrapper</h3>
+      
+
+      <p>If you have enabled the suEXEC feature with the
+      <code>--enable-suexec</code> option the <code>suexec</code> binary
+      (together with httpd itself) is automatically built if you execute
+      the <code>make</code> command.</p>
+
+      <p>After all components have been built you can execute the
+      command <code>make install</code> to install them. The binary image
+      <code>suexec</code> is installed in the directory defined by the
+      <code>--sbindir</code> option. The default location is
+      "/usr/local/apache2/bin/suexec".</p>
+
+      <p>Please note that you need <strong><em>root
+      privileges</em></strong> for the installation step. In order
+      for the wrapper to set the user ID, it must be installed as
+      owner <code><em>root</em></code> and must have the setuserid
+      execution bit set for file modes.</p>
+    
+
+    <h3>Setting paranoid permissions</h3>
+      
+
+      <p>Although the suEXEC wrapper will check to ensure that its
+      caller is the correct user as specified with the
+      <code>--with-suexec-caller</code> <code class="program"><a href="./programs/configure.html">configure</a></code>
+      option, there is
+      always the possibility that a system or library call suEXEC uses
+      before this check may be exploitable on your system. To counter
+      this, and because it is best-practise in general, you should use
+      filesystem permissions to ensure that only the group httpd
+      runs as may execute suEXEC.</p>
+
+      <p>If for example, your web server is configured to run as:</p>
+
+      <pre class="prettyprint lang-config">User www
+Group webgroup</pre>
+
+
+      <p>and <code class="program"><a href="./programs/suexec.html">suexec</a></code> is installed at
+      "/usr/local/apache2/bin/suexec", you should run:</p>
+
+      <div class="example"><p><code>
+          chgrp webgroup /usr/local/apache2/bin/suexec<br />
+          chmod 4750 /usr/local/apache2/bin/suexec<br />
+      </code></p></div>
+
+      <p>This will ensure that only the group httpd runs as can even
+      execute the suEXEC wrapper.</p>
+    
+</div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="enable" id="enable">Enabling &amp; Disabling
+    suEXEC</a></h2>
+
+    <p>Upon startup of httpd, it looks for the file
+    <code class="program"><a href="./programs/suexec.html">suexec</a></code> in the directory defined by the
+    <code>--sbindir</code> option (default is
+    "/usr/local/apache/sbin/suexec"). If httpd finds a properly
+    configured suEXEC wrapper, it will print the following message
+    to the error log:</p>
+
+<div class="example"><p><code>
+    [notice] suEXEC mechanism enabled (wrapper: <var>/path/to/suexec</var>)
+</code></p></div>
+
+    <p>If you don't see this message at server startup, the server is
+    most likely not finding the wrapper program where it expects
+    it, or the executable is not installed <em>setuid root</em>.</p>
+
+     <p>If you want to enable the suEXEC mechanism for the first time
+    and an Apache HTTP Server is already running you must kill and
+    restart httpd. Restarting it with a simple HUP or USR1 signal
+    will not be enough. </p>
+     <p>If you want to disable suEXEC you should kill and restart
+    httpd after you have removed the <code class="program"><a href="./programs/suexec.html">suexec</a></code> file.</p>
+</div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="usage" id="usage">Using suEXEC</a></h2>
+
+    <p>Requests for CGI programs will call the suEXEC wrapper only if
+    they are for a virtual host containing a <code class="directive"><a href="./mod/mod_suexec.html#suexecusergroup">SuexecUserGroup</a></code> directive or if
+    they are processed by <code class="module"><a href="./mod/mod_userdir.html">mod_userdir</a></code>.</p>
+
+    <p><strong>Virtual Hosts:</strong><br /> One way to use the suEXEC
+    wrapper is through the <code class="directive"><a href="./mod/mod_suexec.html#suexecusergroup">SuexecUserGroup</a></code> directive in
+    <code class="directive"><a href="./mod/core.html#virtualhost">VirtualHost</a></code> definitions.  By
+    setting this directive to values different from the main server
+    user ID, all requests for CGI resources will be executed as the
+    <em>User</em> and <em>Group</em> defined for that <code class="directive"><a href="./mod/core.html#virtualhost">&lt;VirtualHost&gt;</a></code>. If this
+    directive is not specified for a <code class="directive"><a href="./mod/core.html#virtualhost">&lt;VirtualHost&gt;</a></code> then the main server userid
+    is assumed.</p>
+
+    <p><strong>User directories:</strong><br /> Requests that are
+     processed by <code class="module"><a href="./mod/mod_userdir.html">mod_userdir</a></code> will call the suEXEC
+     wrapper to execute CGI programs under the userid of the requested
+     user directory.  The only requirement needed for this feature to
+     work is for CGI execution to be enabled for the user and that the
+     script must meet the scrutiny of the <a href="#model">security
+     checks</a> above.  See also the
+     <code>--with-suexec-userdir</code> <a href="#install">compile
+     time option</a>.</p> </div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="debug" id="debug">Debugging suEXEC</a></h2>
+
+    <p>The suEXEC wrapper will write log information
+    to the file defined with the <code>--with-suexec-logfile</code>
+    option as indicated above. If you feel you have configured and
+    installed the wrapper properly, have a look at this log and the
+    error_log for the server to see where you may have gone astray.</p>
+
+</div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="jabberwock" id="jabberwock">Beware the Jabberwock:
+    Warnings &amp; Examples</a></h2>
+
+    <p><strong>NOTE!</strong> This section may not be
+    complete. For the latest revision of this section of the
+    documentation, see the <a href="http://httpd.apache.org/docs/2.4/suexec.html">Online
+    Documentation</a> version.</p>
+
+    <p>There are a few points of interest regarding
+    the wrapper that can cause limitations on server setup. Please
+    review these before submitting any "bugs" regarding suEXEC.</p>
+
+    <ul>
+      <li><strong>suEXEC Points Of Interest</strong></li>
+
+      <li>
+        Hierarchy limitations
+
+        <p class="indent">
+          For security and efficiency reasons, all suEXEC requests
+          must remain within either a top-level document root for
+          virtual host requests, or one top-level personal document
+          root for userdir requests. For example, if you have four
+          VirtualHosts configured, you would need to structure all
+          of your VHosts' document roots off of one main httpd
+          document hierarchy to take advantage of suEXEC for
+          VirtualHosts. (Example forthcoming.)
+        </p>
+      </li>
+
+      <li>
+        suEXEC's PATH environment variable
+
+        <p class="indent">
+          This can be a dangerous thing to change. Make certain
+          every path you include in this define is a
+          <strong>trusted</strong> directory. You don't want to
+          open people up to having someone from across the world
+          running a trojan horse on them.
+        </p>
+      </li>
+
+      <li>
+        Altering the suEXEC code
+
+        <p class="indent">
+          Again, this can cause <strong>Big Trouble</strong> if you
+          try this without knowing what you are doing. Stay away
+          from it if at all possible.
+        </p>
+      </li>
+    </ul>
+
+</div></div>
+<div class="bottomlang">
+<p><span>Available Languages: </span><a href="./en/suexec.html" title="English">&nbsp;en&nbsp;</a> |
+<a href="./fr/suexec.html" hreflang="fr" rel="alternate" title="Fran�ais">&nbsp;fr&nbsp;</a> |
+<a href="./ja/suexec.html" hreflang="ja" rel="alternate" title="Japanese">&nbsp;ja&nbsp;</a> |
+<a href="./ko/suexec.html" hreflang="ko" rel="alternate" title="Korean">&nbsp;ko&nbsp;</a> |
+<a href="./tr/suexec.html" hreflang="tr" rel="alternate" title="T�rk�e">&nbsp;tr&nbsp;</a></p>
+</div><div class="top"><a href="#page-header"><img src="./images/up.gif" alt="top" /></a></div><div class="section"><h2><a id="comments_section" name="comments_section">Comments</a></h2><div class="warning"><strong>Notice:</strong><br />This is not a Q&amp;A section. Comments placed here should be pointed towards suggestions on improving the documentation or server, and may be removed again by our moderators if they are either implemented or considered invalid/off-topic. Questions on how to manage the Apache HTTP Server should be directed at either our IRC channel, #httpd, on Freenode, or sent to our <a href="http://httpd.apache.org/lists.html">mailing lists</a>.</div>
+<script type="text/javascript"><!--//--><![CDATA[//><!--
+var comments_shortname = 'httpd';
+var comments_identifier = 'http://httpd.apache.org/docs/2.4/suexec.html';
+(function(w, d) {
+    if (w.location.hostname.toLowerCase() == "httpd.apache.org") {
+        d.write('<div id="comments_thread"><\/div>');
+        var s = d.createElement('script');
+        s.type = 'text/javascript';
+        s.async = true;
+        s.src = 'https://comments.apache.org/show_comments.lua?site=' + comments_shortname + '&page=' + comments_identifier;
+        (d.getElementsByTagName('head')[0] || d.getElementsByTagName('body')[0]).appendChild(s);
+    }
+    else { 
+        d.write('<div id="comments_thread">Comments are disabled for this page at the moment.<\/div>');
+    }
+})(window, document);
+//--><!]]></script></div><div id="footer">
+<p class="apache">Copyright 2015 The Apache Software Foundation.<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p>
+<p class="menu"><a href="./mod/">Modules</a> | <a href="./mod/directives.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="./glossary.html">Glossary</a> | <a href="./sitemap.html">Sitemap</a></p></div><script type="text/javascript"><!--//--><![CDATA[//><!--
+if (typeof(prettyPrint) !== 'undefined') {
+    prettyPrint();
+}
+//--><!]]></script>
+</body></html>
\ No newline at end of file
diff --git a/docs/manual/suexec.html.fr b/docs/manual/suexec.html.fr
new file mode 100644
index 0000000..8e26ed6
--- /dev/null
+++ b/docs/manual/suexec.html.fr
@@ -0,0 +1,689 @@
+<?xml version="1.0" encoding="ISO-8859-1"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" lang="fr" xml:lang="fr"><head>
+<meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type" />
+<!--
+        XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+              This file is generated from xml source: DO NOT EDIT
+        XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+      -->
+<title>Support suEXEC - Serveur Apache HTTP Version 2.4</title>
+<link href="./style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" />
+<link href="./style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" />
+<link href="./style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" /><link rel="stylesheet" type="text/css" href="./style/css/prettify.css" />
+<script src="./style/scripts/prettify.min.js" type="text/javascript">
+</script>
+
+<link href="./images/favicon.ico" rel="shortcut icon" /></head>
+<body id="manual-page"><div id="page-header">
+<p class="menu"><a href="./mod/">Modules</a> | <a href="./mod/directives.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="./glossary.html">Glossaire</a> | <a href="./sitemap.html">Plan du site</a></p>
+<p class="apache">Serveur Apache HTTP Version 2.4</p>
+<img alt="" src="./images/feather.gif" /></div>
+<div class="up"><a href="./"><img title="&lt;-" alt="&lt;-" src="./images/left.gif" /></a></div>
+<div id="path">
+<a href="http://www.apache.org/">Apache</a> &gt; <a href="http://httpd.apache.org/">Serveur HTTP</a> &gt; <a href="http://httpd.apache.org/docs/">Documentation</a> &gt; <a href="./">Version 2.4</a></div><div id="page-content"><div id="preamble"><h1>Support suEXEC</h1>
+<div class="toplang">
+<p><span>Langues Disponibles: </span><a href="./en/suexec.html" hreflang="en" rel="alternate" title="English">&nbsp;en&nbsp;</a> |
+<a href="./fr/suexec.html" title="Fran�ais">&nbsp;fr&nbsp;</a> |
+<a href="./ja/suexec.html" hreflang="ja" rel="alternate" title="Japanese">&nbsp;ja&nbsp;</a> |
+<a href="./ko/suexec.html" hreflang="ko" rel="alternate" title="Korean">&nbsp;ko&nbsp;</a> |
+<a href="./tr/suexec.html" hreflang="tr" rel="alternate" title="T�rk�e">&nbsp;tr&nbsp;</a></p>
+</div>
+
+    <p>La fonctionnalit� <strong>suEXEC</strong> permet
+    l'ex�cution des programmes <strong>CGI</strong> et
+    <strong>SSI</strong> sous un utilisateur autre que celui sous
+    lequel s'ex�cute le serveur web qui appelle ces programmes.
+    Normalement, lorsqu'un programme CGI ou SSI est lanc�, il
+    s'ex�cute sous le m�me utilisateur que celui du serveur web qui
+    l'appelle.</p>
+
+    <p>Utilis�e de mani�re appropri�e, cette fonctionnalit� peut
+    r�duire consid�rablement les risques de s�curit� encourus
+    lorsqu'on autorise les utilisateurs � d�velopper et faire
+    s'ex�cuter des programmes CGI ou SSI de leur cru. Cependant, mal
+    configur�, suEXEC peut causer de nombreux probl�mes et m�me cr�er
+    de nouvelles failles dans la s�curit� de votre ordinateur. Si
+    vous n'�tes pas familier avec la gestion des programmes
+    <em>setuid root</em> et les risques de s�curit� qu'ils comportent,
+    nous vous recommandons vivement de ne pas tenter
+    d'utiliser suEXEC.</p>
+  </div>
+<div id="quickview"><ul id="toc"><li><img alt="" src="./images/down.gif" /> <a href="#before">Avant de commencer</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#model">Mod�le de s�curit� de suEXEC</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#install">Configurer et installer suEXEC</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#enable">Activation et d�sactivation
+de suEXEC</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#usage">Utilisation de suEXEC</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#debug">D�bogage de suEXEC</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#jabberwock">Avis � la population !
+    Avertissements et exemples</a></li>
+</ul><ul class="seealso"><li><a href="#comments_section">Commentaires</a></li></ul></div>
+<div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="before" id="before">Avant de commencer</a></h2>
+
+    <p>Avant de foncer t�te baiss�e dans la lecture de ce document,
+    vous devez tenir compte de certaines hypoth�ses concernant vous-m�me
+    et l'environnement dans lequel vous allez utiliser suexec.</p>
+
+    <p>Premi�rement, vous devez utiliser un syst�me d'exploitation
+    UNIX ou d�riv�, capable d'effectuer des op�rations
+    <strong>setuid</strong> et <strong>setgid</strong>. Tous les
+    exemples de commande sont donn�s en cons�quence. D'autres
+    plates-formes, m�me si elles supportent suEXEC, peuvent
+    avoir une configuration diff�rente.</p>
+
+    <p>Deuxi�mement, vous devez �tre familier avec les concepts de base
+    relatifs � la s�curit� de votre ordinateur et son administration.
+    Ceci implique la compr�hension des op�rations
+    <strong>setuid/setgid</strong> et des diff�rents effets qu'elles
+    peuvent produire sur votre syst�me et son niveau de s�curit�.</p>
+
+    <p>Troisi�mement, vous devez utiliser une version
+    <strong>non modifi�e</strong> du code de suEXEC. L'ensemble du
+    code de suEXEC a �t� scrut� et test� avec soin par les d�veloppeurs
+    et de nombreux b�ta testeurs. Toutes les pr�cautions ont �t� prises
+    pour s'assurer d'une base s�re de code non seulement simple, mais
+    aussi solide. La modification de ce code peut causer des probl�mes
+    inattendus et de nouveaux risques de s�curit�. Il est
+    <strong>vivement</strong> recommand� de ne pas modifier le code de
+    suEXEC, � moins que vous ne soyez un programmeur sp�cialiste des
+    particularit�s li�es � la s�curit�, et souhaitez partager votre
+    travail avec l'�quipe de d�veloppement du serveur HTTP Apache afin
+    de pouvoir en discuter.</p>
+
+    <p>Quatri�mement et derni�rement, l'�quipe de d�veloppement du
+    serveur HTTP Apache a d�cid� de ne
+    <strong>PAS</strong> inclure suEXEC dans l'installation par d�faut
+    d'Apache httpd. Pour pouvoir mettre en oeuvre suEXEC, l'administrateur
+    doit porter la plus grande attention aux d�tails. Apr�s avoir bien
+    r�fl�chi aux diff�rents points de la configuration de suEXEC,
+    l'administrateur peut l'installer selon les m�thodes classiques.
+    Les valeurs des param�tres de configuration doivent �tre
+    d�termin�es et sp�cifi�es avec soin par l'administrateur, afin de
+    maintenir la s�curit� du syst�me de mani�re appropri�e lors de
+    l'utilisation de la fonctionnalit� suEXEC. C'est par le biais de
+    ce processus minutieux que nous esp�rons r�server
+    l'installation de suEXEC aux administrateurs prudents et
+    suffisamment d�termin�s � vouloir l'utiliser.</p>
+
+    <p>Vous �tes encore avec nous ? Oui ? Bien.
+    Alors nous pouvons continuer !</p>
+</div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="model" id="model">Mod�le de s�curit� de suEXEC</a></h2>
+
+    <p>Avant d'installer et configurer suEXEC, nous allons tout d'abord
+    d�crire le mod�le de s�curit� que vous �tes sur le point
+    d'impl�menter. Vous devriez ainsi mieux comprendre ce qui se passe
+    vraiment � l'int�rieur de suEXEC et quelles pr�cautions ont �t�
+    prises pour pr�server la s�curit� de votre syst�me.</p>
+
+    <p><strong>suEXEC</strong> est bas� sur un programme "conteneur"
+    (wrapper) setuid qui est appel� par le serveur HTTP Apache principal.
+    Ce conteneur est appel� quand une requ�te HTTP concerne
+    un programme CGI ou SSI que l'administrateur
+    a d�cid� de faire s'ex�cuter
+    sous un utilisateur autre que celui du serveur principal.
+    Lorsqu'il re�oit une telle requ�te, Apache httpd fournit au conteneur
+    suEXEC le nom du programme, ainsi que les identifiants utilisateur
+    et groupe sous lesquels le programme doit s'ex�cuter.</p>
+
+    <p>Le conteneur effectue ensuite les v�rifications suivantes afin
+    de d�terminer la r�ussite ou l'�chec du processus -- si une seule
+    de ces conditions n'est pas v�rifi�e, le programme journalise
+    l'erreur et se termine en retournant un code d'erreur, sinon il
+    continue :</p>
+
+    <ol>
+      <li>
+        <strong>L'utilisateur qui ex�cute le conteneur est-il un
+	utilisateur valide de ce syst�me ?</strong>
+
+        <p class="indent">
+          Ceci permet de s'assurer que l'utilisateur qui ex�cute le
+	  conteneur est vraiment un utilisateur appartenant au syst�me.
+        </p>
+     </li>
+
+     <li>
+        <strong>Le conteneur a-t-il �t� appel� avec un nombre
+	d'arguments correct ?</strong>
+
+        <p class="indent">
+          Le conteneur ne s'ex�cutera que si on lui fournit un nombre
+	  d'arguments correct. Le serveur HTTP apache sait quel est le
+	  bon format des arguments. Si le conteneur ne re�oit pas un
+	  nombre d'arguments correct, soit il a �t� modifi�,
+	  soit quelque chose ne va pas dans la portion suEXEC de
+	  votre binaire Apache httpd.
+        </p>
+      </li>
+
+      <li>
+        <strong>Cet utilisateur valide est-il autoris� � ex�cuter le
+	conteneur ?</strong>
+
+        <p class="indent">
+          Cet utilisateur est-il celui autoris� � ex�cuter le
+	  conteneur ? Un seul utilisateur (celui d'Apache) est
+	  autoris� � ex�cuter ce programme.
+        </p>
+      </li>
+
+      <li>
+        <strong>Le chemin du programme CGI ou SSI cible est-il
+	non s�r ?</strong>
+
+        <p class="indent">
+          Le chemin du programme CGI ou SSI cible d�bute-t-il par un
+	  '/' ou contient-il une r�f�rence arri�re '..' ? Ceci est
+	  interdit ; le programme CGI ou SSI cible doit se trouver dans
+	  la hi�rarchie de la racine des documents de suEXEC (voir
+	  <code>--with-suexec-docroot=<em>DIR</em></code> ci-dessous).
+        </p>
+      </li>
+
+      <li>
+        <strong>Le nom utilisateur cible est-il valide ?</strong>
+
+        <p class="indent">
+          L'utilisateur cible existe-t-il ?
+        </p>
+      </li>
+
+      <li>
+        <strong>Le nom du groupe cible est-il valide ?</strong>
+
+        <p class="indent">
+          Le groupe cible existe-t-il ?
+        </p>
+      </li>
+
+      <li>
+        <strong>L'utilisateur cible n'est-il <em>PAS</em>
+	superutilisateur ?</strong>
+
+
+        <p class="indent">
+          suEXEc ne permet pas �
+	  <code><em>root</em></code> d'ex�cuter des programmes CGI/SSI.
+        </p>
+      </li>
+
+      <li>
+        <strong>Le num�ro de l'identifiant de l'utilisateur cible
+	est-il <em>SUPERIEUR</em> au num�ro d'identifiant
+	minimum ?</strong>
+
+        <p class="indent">
+          Le num�ro d'identifiant utilisateur minimum est d�fini �
+	  l'ex�cution du script configure. Ceci vous permet de d�finir
+	  le num�ro d'identifiant utilisateur le plus bas qui sera
+	  autoris� � �x�cuter des programmes CGI/SSI. En particulier,
+	  cela permet d'�carter les comptes syst�me.
+        </p>
+      </li>
+
+      <li>
+        <strong>Le groupe cible n'est-il <em>PAS</em> le groupe
+	superutilisateur ?</strong>
+
+        <p class="indent">
+          Actuellement, suEXEC ne permet pas au groupe
+	  <code><em>root</em></code> d'ex�cuter des programmes CGI/SSI.
+        </p>
+      </li>
+
+      <li>
+        <strong> Le num�ro d'identifiant du groupe cible est-il
+	<em>SUPERIEUR</em> au num�ro d'identifiant minimum ?</strong>
+
+        <p class="indent">
+          Le num�ro d'identifiant de groupe minimum est sp�cifi� lors
+	  de l'ex�cution du script configure. Ceci vous permet de
+	  d�finir l'identifiant de groupe le plus bas possible qui sera
+	  autoris� � ex�cuter des programmes CGI/SSI, et est
+	  particuli�rement utile pour �carter les groupes "syst�me".
+        </p>
+      </li>
+
+      <li>
+        <strong>Le conteneur peut-il obtenir avec succ�s l'identit�
+	des utilisateur et groupe cibles ?</strong>
+
+        <p class="indent">
+          C'est ici que le programme obtient l'identit� des utilisateur
+	  et groupe cibles via des appels � setuid et setgid. De m�me,
+	  la liste des acc�s groupe est initialis�e avec tous les
+	  groupes auxquels l'utilisateur cible appartient.
+        </p>
+      </li>
+
+      <li>
+        <strong>Peut-on se positionner dans le r�pertoire dans dequel
+	sont situ�s les programmes CGI/SSI ?</strong>
+
+        <p class="indent">
+          S'il n'existe pas, il ne peut pas contenir de fichier. Et si
+	  l'on ne peut pas s'y positionner, il n'existe probablement
+	  pas.
+        </p>
+      </li>
+
+      <li>
+        <strong>Le r�pertoire est-il dans l'espace web
+	de httpd ?</strong>
+
+        <p class="indent">
+          Si la requ�te concerne une portion de la racine du serveur,
+	  le r�pertoire demand� est-il dans la hi�rarchie de la racine
+	  des documents de suEXEC ? Si la requ�te concerne un
+	 <code class="directive"><a href="./mod/mod_userdir.html#userdir">UserDir</a></code>, le r�pertoire demand� est-il dans
+	  la hi�rarchie du r�pertoire d�fini comme le r�pertoire
+	  utilisateur de suEXEC (voir les
+	  <a href="#install">options de configuration de suEXEC</a>) ?
+        </p>
+      </li>
+
+      <li>
+        <strong>L'�criture dans le r�pertoire est-elle interdite pour
+	un utilisateur autre que le propri�taire </strong>
+
+        <p class="indent">
+          Le r�pertoire ne doit pas �tre ouvert aux autres
+	  utilisateurs ; seul l'utilisateur propri�taire doit pouvoir
+	  modifier le contenu du r�pertoire.
+        </p>
+      </li>
+
+      <li>
+        <strong>Le programme CGI/SSI cible existe-t-il ?</strong>
+
+        <p class="indent">
+          S'il n'existe pas, il ne peut pas �tre ex�cut�.
+        </p>
+      </li>
+
+      <li>
+        <strong>Les utilisateurs autres que le propri�taire n'ont-ils
+	<em>PAS</em> de droits en �criture sur le programme
+	CGI/SSI ?</strong>
+
+        <p class="indent">
+          Les utilisateurs autres que le propri�taire ne doivent pas
+	  pouvoir modifier le programme CGI/SSI.
+        </p>
+      </li>
+
+      <li>
+        <strong>Le programme CGI/SSI n'est-il <em>PAS</em> setuid ou
+	setgid ?</strong>
+
+        <p class="indent">
+          Les programmes cibles ne doivent pas pouvoir modifier �
+	  nouveau les identifiants utilisateur/groupe.
+        </p>
+      </li>
+
+      <li>
+        <strong>Le couple utilisateur/groupe cible est-il le m�me que
+	celui du programme ?</strong>
+
+        <p class="indent">
+          L'utilisateur est-il le propri�taire du fichier ?
+        </p>
+      </li>
+
+      <li>
+        <strong>Peut-on nettoyer avec succ�s l'environnement des
+	processus afin de garantir la s�ret� des op�rations ?</strong>
+
+        <p class="indent">
+          suExec nettoie l'environnement des processus en �tablissant
+	  un chemin d'ex�cution s�r (d�fini lors de la configuration),
+	  et en ne passant que les variables dont les noms font partie
+	  de la liste de l'environnement s�r (cr��e de m�me lors de la
+	  configuration).
+        </p>
+      </li>
+
+      <li>
+        <strong>Le conteneur peut-il avec succ�s se substituer au
+	programme CGI/SSI cible et s'ex�cuter ?</strong>
+
+        <p class="indent">
+          C'est l� o� l'ex�cution de suEXEC s'arr�te et o� commence
+	  celle du programme CGI/ssi cible.
+        </p>
+      </li>
+    </ol>
+
+    <p>Ce sont les op�rations standards effectu�es par le mod�le de
+    s�curit� du conteneur suEXEC. Il peut para�tre strict et est
+    susceptible d'imposer de nouvelles limitations et orientations
+    dans la conception des programmes CGI/SSI, mais il a �t� d�velopp�
+    avec le plus grand soin, �tape par �tape, en se focalisant sur
+    la s�curit�.</p>
+
+    <p>Pour plus d'informations sur la mesure dans laquelle ce mod�le
+    de s�curit� peut limiter vos possibilit�s au regard de la
+    configuration du serveur, ainsi que les risques de s�curit� qui
+    peuvent �tre �vit�s gr�ce � une configuration appropri�e de suEXEC,
+    se r�f�rer � la section <a href="#jabberwock">"Avis � la population !"</a> de ce document.</p>
+</div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="install" id="install">Configurer et installer suEXEC</a></h2>
+
+    <p>C'est ici que nous entrons dans le vif du sujet.</p>
+
+    <p><strong>Options de configuration de suEXEC</strong><br />
+    </p>
+
+    <dl>
+      <dt><code>--enable-suexec</code></dt>
+
+      <dd>Cette option active la fonctionnalit� suEXEC qui n'est
+      jamais install�e ou activ�e par d�faut. Au moins une option
+      <code>--with-suexec-xxxxx</code> doit accompagner l'option
+      <code>--enable-suexec</code> pour qu'APACI (l'utilitaire de
+      configuration de la compilation d'Apache) accepte votre demande
+      d'utilisation de la fonctionnalit� suEXEC.</dd>
+
+      <dt><code>--with-suexec-bin=<em>PATH</em></code></dt>
+
+      <dd>Le chemin du binaire <code>suexec</code> doit �tre cod� en
+      dur dans le serveur pour des raisons de s�curit�. Cette option
+      vous permet de modifier le chemin par d�faut.
+      <em>Par exemple</em>
+      <code>--with-suexec-bin=/usr/sbin/suexec</code></dd>
+
+      <dt><code>--with-suexec-caller=<em>UID</em></code></dt>
+
+      <dd>L'<a href="mod/mpm_common.html#user">utilisateur</a> sous
+      lequel httpd s'ex�cute habituellement. C'est le seul utilisateur
+      autoris� � ex�cuter le wrapper suEXEC.</dd>
+
+      <dt><code>--with-suexec-userdir=<em>DIR</em></code></dt>
+
+      <dd>Cette option d�finit le sous-r�pertoire de la hi�rarchie des
+      r�pertoires utilisateurs dans lequel l'utilisation
+      de suEXEC sera autoris�e. Tous les ex�cutables situ�s dans ce
+      r�pertoire seront ex�cutables par suEXEC sous l'utilisateur
+      cible ; ces programmes doivent donc �tre s�rs. Si vous utilisez
+      une directive <code class="directive"><a href="./mod/mod_userdir.html#userdir">UserDir</a></code>
+      "simple" (c'est � dire ne contenant pas de
+      "*"), l'option --with-suexec-userdir
+      devra contenir la m�me valeur. SuEXEC ne fonctionnera pas
+      correctement si la directive <code class="directive"><a href="./mod/mod_userdir.html#userdir">UserDir</a></code> contient une valeur
+      diff�rente du r�pertoire home de l'utilisateur tel qu'il est
+      d�fini dans le fichier <code>passwd</code>. la valeur par d�faut
+      est "<code>public_html</code>".<br />
+      Si vous avez plusieurs h�tes virtuels avec une directive
+      <code class="directive"><a href="./mod/mod_userdir.html#userdir">UserDir</a></code> diff�rente
+      pour chacun d'entre eux, vous devrez faire en sorte que chaque
+      UserDir poss�de un r�pertoire parent commun ; donnez alors �
+      l'option --with-suexec-userdir le nom
+      de ce r�pertoire commun. <strong>Si tout ceci n'est pas d�fini
+      correctement, les requ�tes CGI "~userdir" ne fonctionneront
+      pas !</strong></dd>
+
+      <dt><code>--with-suexec-docroot=<em>DIR</em></code></dt>
+
+      <dd>Cette option fonctionne comme la directive DocumentRoot pour
+      httpd. Il s'agit de la seule hi�rarchie (en dehors des directives
+      <code class="directive"><a href="./mod/mod_userdir.html#userdir">UserDir</a></code>) dans laquelle la fonctionnalit� suEXEC
+      pourra �tre utilis�e. La valeur par d�faut est la valeur de
+      <code>--datadir</code> accompagn�e du suffixe
+      "<code>/htdocs</code>" ;
+      <em>Par exemple</em>, si vous ex�cutez configure avec
+      "<code>--datadir=/home/apache</code>", la valeur
+      "<code>/home/apache/htdocs</code>" sera utilis�e par d�faut comme
+      racine des documents pour le conteneur suEXEC.</dd>
+
+      <dt><code>--with-suexec-uidmin=<em>UID</em></code></dt>
+
+      <dd>Cette option d�finit l'identifiant utilisateur le plus bas
+      avec lequel un utilisateur pourra �tre la cible de
+      suEXEC. 500 ou 100 sont des valeurs courantes sur la plupart des
+      syst�mes. la valeur par d�faut est 100.</dd>
+
+      <dt><code>--with-suexec-gidmin=<em>GID</em></code></dt>
+
+      <dd>Cette option d�finit l'identifiant de groupe le plus bas
+      avec lequel un utilisateur pourra �tre la cible de
+      suEXEC. 100 est une valeur courante sur la plupart des
+      syst�mes et est par cons�quent la valeur par d�faut.</dd>
+
+      <dt><code>--with-suexec-logfile=<em>FILE</em></code></dt>
+
+      <dd>Cette option permet de d�finir le fichier dans lequel
+      toutes les transactions et erreurs de suEXEC seront journalis�es
+      (� des fins d'analyse ou de d�bogage). Par d�faut, le fichier
+      journal se nomme "<code>suexec_log</code>" et se trouve dans votre
+      r�pertoire standard des fichiers journaux d�fini par
+      <code>--logfiledir</code></dd>
+
+      <dt><code>--with-suexec-safepath=<em>PATH</em></code></dt>
+
+      <dd>Cette option permet de d�finir une variable d'environnement
+      PATH s�re � passer aux ex�cutables CGI. La valeur par d�faut
+      est "<code>/usr/local/bin:/usr/bin:/bin</code>".</dd>
+    </dl>
+
+    <h3>Compilation et installation du conteneur suEXEC</h3>
+      
+
+    <p>Si vous avez activ� la fonctionnalit� suEXEC � l'aide de
+     l'option <code>--enable-suexec</code>, le binaire
+     <code>suexec</code> sera automatiquement construit (en m�me temps
+     que httpd) lorsque vous ex�cuterez la commande
+     <code>make</code>.</p>
+
+     <p>Lorsque tous les composants auront �t� construits, vous pourrez
+     ex�cuter la commande <code>make install</code> afin de les
+     installer. Le binaire <code>suexec</code> sera install� dans le
+     r�pertoire d�fini � l'aide de l'option <code>--sbindir</code>. La
+     localisation par d�faut est "/usr/local/apache2/bin/suexec".</p>
+     <p>Veuillez noter que vous aurez besoin des
+     <strong><em>privil�ges root</em></strong> pour passer l'�tape de
+     l'installation. Pour que le conteneur puisse changer
+     l'identifiant utilisateur, il doit avoir comme propri�taire
+     <code><em>root</em></code>, et les droits du fichier doivent
+     inclure le bit d'ex�cution setuserid.</p>
+   
+
+   <h3>&gt;Mise en place de permissions pour
+    parano�aque</h3>
+	
+    <p>Bien que le conteneur suEXEC v�rifie que l'utilisateur qui
+    l'appelle correspond bien � l'utilisateur sp�cifi� � l'aide de
+    l'option <code>--with-suexec-caller</code> du programme
+    <code class="program"><a href="./programs/configure.html">configure</a></code>, il subsiste toujours le risque qu'un
+    appel syst�me ou une biblioth�que fasse appel � suEXEC avant que
+    cette v�rification ne soit exploitable sur votre syst�me. Pour
+    tenir compte de ceci, et parce que c'est en g�n�ral la meilleure
+    pratique, vous devez utiliser les permissions du syst�me de
+    fichiers afin de vous assurer que seul le groupe sous lequel
+    s'ex�cute httpd puisse faire appel � suEXEC.</p>
+
+    <p>Si, par exemple, votre serveur web est configur� pour
+    s'ex�cuter en tant que :</p>
+
+<pre class="prettyprint lang-config">User www
+Group webgroup</pre>
+
+
+    <p>et <code class="program"><a href="./programs/suexec.html">suexec</a></code> se trouve �
+    "/usr/local/apache2/bin/suexec", vous devez ex�cuter les
+    commandes</p>
+
+<div class="example"><p><code>
+    chgrp webgroup /usr/local/apache2/bin/suexec<br />
+    chmod 4750 /usr/local/apache2/bin/suexec<br />
+</code></p></div>
+
+    <p>Ceci permet de s'assurer que seul le groupe sous lequel httpd
+    s'ex�cute (ici webgroup) puisse faire appel au conteneur
+    suEXEC.</p>
+  
+</div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="enable" id="enable">Activation et d�sactivation
+de suEXEC</a></h2>
+
+    <p>Au d�marrage, httpd v�rifie la pr�sence du fichier
+    <code class="program"><a href="./programs/suexec.html">suexec</a></code> dans le r�pertoire d�fini par
+    l'option <code>--sbindir</code> du script configure (le
+    r�pertoire par d�faut est "/usr/local/apache/sbin/suexec"). Si
+    httpd trouve un conteneur suEXEC correctement configur�, il
+    enregistrera le message suivant dans le journal des erreurs :</p>
+
+<div class="example"><p><code>
+    [notice] suEXEC mechanism enabled (wrapper: <var>/path/to/suexec</var>)
+</code></p></div>
+
+    <p>Si ce message n'est pas g�n�r� au d�marrage du serveur, ce
+    dernier ne trouve probablement pas le programme conteneur �
+    l'endroit o� il est sens� �tre, ou l'ex�cutable suexec n'est pas
+    install� en <em>setuid root</em>.</p>
+
+     <p>Si le serveur HTTP Apache est d�j� en cours d'ex�cution, et si
+     vous activez le m�canisme suEXEC pour la premi�re fois, vous
+     devez arr�ter et red�marrer httpd. Un red�marrage
+     � l'aide d'un simple signal HUP ou USR1 suffira. </p>
+     <p>Pour d�sactiver suEXEC, vous devez supprimer le fichier
+     <code class="program"><a href="./programs/suexec.html">suexec</a></code>, puis arr�ter et red�marrer
+     httpd.</p>
+</div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="usage" id="usage">Utilisation de suEXEC</a></h2>
+
+    <p>Les requ�tes pour des programmes CGI ne feront appel au
+    conteneur suEXEC que si elles concernent un h�te virtuel
+    contenant une directive <code class="directive"><a href="./mod/mod_suexec.html#suexecusergroup">SuexecUserGroup</a></code>, ou si elles sont
+    trait�es par <code class="module"><a href="./mod/mod_userdir.html">mod_userdir</a></code>.</p>
+
+    <p><strong>H�tes virtuels :</strong><br /> Une des m�thodes
+    d'utilisation du conteneur suEXEC consiste � ins�rer une
+    directive <code class="directive"><a href="./mod/mod_suexec.html#suexecusergroup">SuexecUserGroup</a></code> dans une section
+    <code class="directive"><a href="./mod/core.html#virtualhost">VirtualHost</a></code>. En d�finissant
+    des valeurs diff�rentes de celles du serveur principal, toutes les
+    requ�tes pour des ressources CGI seront ex�cut�es sous
+    les <em>User</em> et <em>Group</em> d�finis pour cette section
+    <code class="directive"><a href="./mod/core.html#virtualhost">&lt;VirtualHost&gt;</a></code>. Si cette
+    directive est absente de la section <code class="directive"><a href="./mod/core.html#virtualhost">&lt;VirtualHost&gt;</a></code>, l'utilisateur du
+    serveur principal sera pris par d�faut</p>
+
+    <p><strong>R�pertoires des utilisateurs :</strong><br /> Avec
+    cette m�thode, les
+    requ�tes trait�es par <code class="module"><a href="./mod/mod_userdir.html">mod_userdir</a></code> appelleront le
+    conteneur suEXEC pour ex�cuter le programme CGI sous l'identifiant
+    utilisateur du r�pertoire utilisateur concern�. Seuls pr�requis
+    pour pouvoir acc�der � cette fonctionnalit� : l'ex�cution des CGI
+    doit �tre activ�e pour l'utilisateur concern�, et le script doit
+    passer avec succ�s le test des <a href="#model">v�rifications de
+    s�curit�</a> d�crit plus haut. Voir aussi l'
+    <a href="#install">option de compilation</a>
+    <code>--with-suexec-userdir</code>.</p> </div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="debug" id="debug">D�bogage de suEXEC</a></h2>
+
+    <p>Le conteneur suEXEC va �crire ses informations de journalisation
+    dans le fichier d�fini par l'option de compilation
+    <code>--with-suexec-logfile</code> comme indiqu� plus haut. Si vous
+    pensez avoir configur� et install� correctement le conteneur,
+    consultez ce journal, ainsi que le journal des erreurs du serveur
+    afin de d�terminer l'endroit o� vous avez fait fausse route.</p>
+
+</div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="jabberwock" id="jabberwock">Avis � la population !
+    Avertissements et exemples</a></h2>
+
+    <p><strong>NOTE !</strong> Cette section est peut-�tre incompl�te.
+    Pour en consulter la derni�re r�vision, voir la version de la <a href="http://httpd.apache.org/docs/2.4/suexec.html">Documentation en ligne</a>.</p>
+
+    <p>Quelques points importants du conteneur peuvent
+    imposer des contraintes du point de vue de la configuration du
+    serveur. Veuillez en prendre connaissance avant de soumettre un
+    rapport de bogue � propos de suEXEC.</p>
+
+    <ul>
+      <li><strong>Points importants de suEXEC</strong></li>
+
+      <li>
+        Limitations concernant la hi�rarchie.
+
+        <p class="indent">
+          Pour des raisons de s�curit� et d'efficacit�, toutes les
+	  requ�tes suEXEC ne doivent concerner que des ressources
+	  situ�es dans la racine des documents d�finie pour les
+	  requ�tes concernant un h�te virtuel, ou des ressources
+	  situ�es dans la racine des documents d�finies pour les
+	  requ�tes concernant un r�pertoire utilisateur. Par exemple,
+	  si vous avez configur� quatre h�tes virtuels, vous devrez
+	  d�finir la structure des racines de documents de vos h�tes
+	  virtuels en dehors d'une hi�rarchie de documents principale
+	  de httpd, afin de tirer parti de suEXEC dans le contexte des
+	  h�tes virtuels (Exemple � venir).
+        </p>
+      </li>
+
+      <li>
+        La variable d'environnement PATH de suEXEC
+
+        <p class="indent">
+          Modifier cette variable peut s'av�rer dangereux. Assurez-vous
+	  que tout chemin que vous ajoutez � cette variable est un
+	  r�pertoire <strong>de confiance</strong>. Vous n'avez
+	  probablement pas l'intention d'ouvrir votre serveur de fa�on
+	  � ce que l'on puisse y ex�cuter un cheval de Troie.
+        </p>
+      </li>
+
+      <li>
+        Modification de suEXEC
+
+        <p class="indent">
+          Encore une fois, ceci peut vous causer de
+	  <strong>graves ennuis</strong> si vous vous y essayez sans
+	  savoir ce que vous faites. Evitez de vous y risquer dans la
+	  mesure du possible.
+        </p>
+      </li>
+    </ul>
+
+</div></div>
+<div class="bottomlang">
+<p><span>Langues Disponibles: </span><a href="./en/suexec.html" hreflang="en" rel="alternate" title="English">&nbsp;en&nbsp;</a> |
+<a href="./fr/suexec.html" title="Fran�ais">&nbsp;fr&nbsp;</a> |
+<a href="./ja/suexec.html" hreflang="ja" rel="alternate" title="Japanese">&nbsp;ja&nbsp;</a> |
+<a href="./ko/suexec.html" hreflang="ko" rel="alternate" title="Korean">&nbsp;ko&nbsp;</a> |
+<a href="./tr/suexec.html" hreflang="tr" rel="alternate" title="T�rk�e">&nbsp;tr&nbsp;</a></p>
+</div><div class="top"><a href="#page-header"><img src="./images/up.gif" alt="top" /></a></div><div class="section"><h2><a id="comments_section" name="comments_section">Commentaires</a></h2><div class="warning"><strong>Notice:</strong><br />This is not a Q&amp;A section. Comments placed here should be pointed towards suggestions on improving the documentation or server, and may be removed again by our moderators if they are either implemented or considered invalid/off-topic. Questions on how to manage the Apache HTTP Server should be directed at either our IRC channel, #httpd, on Freenode, or sent to our <a href="http://httpd.apache.org/lists.html">mailing lists</a>.</div>
+<script type="text/javascript"><!--//--><![CDATA[//><!--
+var comments_shortname = 'httpd';
+var comments_identifier = 'http://httpd.apache.org/docs/2.4/suexec.html';
+(function(w, d) {
+    if (w.location.hostname.toLowerCase() == "httpd.apache.org") {
+        d.write('<div id="comments_thread"><\/div>');
+        var s = d.createElement('script');
+        s.type = 'text/javascript';
+        s.async = true;
+        s.src = 'https://comments.apache.org/show_comments.lua?site=' + comments_shortname + '&page=' + comments_identifier;
+        (d.getElementsByTagName('head')[0] || d.getElementsByTagName('body')[0]).appendChild(s);
+    }
+    else { 
+        d.write('<div id="comments_thread">Comments are disabled for this page at the moment.<\/div>');
+    }
+})(window, document);
+//--><!]]></script></div><div id="footer">
+<p class="apache">Copyright 2015 The Apache Software Foundation.<br />Autoris� sous <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p>
+<p class="menu"><a href="./mod/">Modules</a> | <a href="./mod/directives.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="./glossary.html">Glossaire</a> | <a href="./sitemap.html">Plan du site</a></p></div><script type="text/javascript"><!--//--><![CDATA[//><!--
+if (typeof(prettyPrint) !== 'undefined') {
+    prettyPrint();
+}
+//--><!]]></script>
+</body></html>
\ No newline at end of file
diff --git a/docs/manual/suexec.html.ja.utf8 b/docs/manual/suexec.html.ja.utf8
new file mode 100644
index 0000000..2300b47
--- /dev/null
+++ b/docs/manual/suexec.html.ja.utf8
@@ -0,0 +1,643 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" lang="ja" xml:lang="ja"><head>
+<meta content="text/html; charset=UTF-8" http-equiv="Content-Type" />
+<!--
+        XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+              This file is generated from xml source: DO NOT EDIT
+        XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+      -->
+<title>suEXEC サポート - Apache HTTP サーバ バージョン 2.4</title>
+<link href="./style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" />
+<link href="./style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" />
+<link href="./style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" /><link rel="stylesheet" type="text/css" href="./style/css/prettify.css" />
+<script src="./style/scripts/prettify.min.js" type="text/javascript">
+</script>
+
+<link href="./images/favicon.ico" rel="shortcut icon" /></head>
+<body id="manual-page"><div id="page-header">
+<p class="menu"><a href="./mod/">モジュール</a> | <a href="./mod/directives.html">ディレクティブ</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="./glossary.html">用語</a> | <a href="./sitemap.html">サイトマップ</a></p>
+<p class="apache">Apache HTTP サーバ バージョン 2.4</p>
+<img alt="" src="./images/feather.gif" /></div>
+<div class="up"><a href="./"><img title="&lt;-" alt="&lt;-" src="./images/left.gif" /></a></div>
+<div id="path">
+<a href="http://www.apache.org/">Apache</a> &gt; <a href="http://httpd.apache.org/">HTTP サーバ</a> &gt; <a href="http://httpd.apache.org/docs/">ドキュメンテーション</a> &gt; <a href="./">バージョン 2.4</a></div><div id="page-content"><div id="preamble"><h1>suEXEC サポート</h1>
+<div class="toplang">
+<p><span>翻訳済み言語: </span><a href="./en/suexec.html" hreflang="en" rel="alternate" title="English">&nbsp;en&nbsp;</a> |
+<a href="./fr/suexec.html" hreflang="fr" rel="alternate" title="Français">&nbsp;fr&nbsp;</a> |
+<a href="./ja/suexec.html" title="Japanese">&nbsp;ja&nbsp;</a> |
+<a href="./ko/suexec.html" hreflang="ko" rel="alternate" title="Korean">&nbsp;ko&nbsp;</a> |
+<a href="./tr/suexec.html" hreflang="tr" rel="alternate" title="Türkçe">&nbsp;tr&nbsp;</a></p>
+</div>
+<div class="outofdate">この日本語訳はすでに古くなっている
+            可能性があります。
+            最近更新された内容を見るには英語版をご覧下さい。
+        </div>
+
+    <p><strong>suEXEC</strong>
+    機能により、Apache ユーザは Web サーバを実行しているユーザ ID とは
+    異なるユーザ ID で <strong>CGI</strong> プログラムや <strong>SSI</strong> 
+    プログラムを実行することができます。CGI プログラムまたは SSI
+    プログラムを実行する場合、通常は web サーバと同じユーザで実行されます。
+    </p>
+
+    <p>適切に使用すると、この機能によりユーザが個別の CGI
+    や SSI プログラムを開発し実行することで生じるセキュリティ上の危険を、
+    かなり減らすことができます。しかし、suEXEC の設定が不適切だと、
+    多くの問題が生じ、あなたのコンピュータに新しいセキュリティホールを
+    作ってしまう可能性があります。あなたが <em>setuid root</em>
+    されたプログラムと、それらから生じるセキュリティ上の問題の管理に
+    詳しくないようなら、suEXEC の使用を検討しないように強く推奨します。
+    </p>
+  </div>
+<div id="quickview"><ul id="toc"><li><img alt="" src="./images/down.gif" /> <a href="#before">始める前に</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#model">suEXEC セキュリティモデル</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#install">suEXEC
+    の設定とインストール</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#enable">suEXEC
+    の有効化と無効化</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#usage">suEXEC の使用</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#debug">suEXEC のデバッグ</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#jabberwock">とかげに注意: 警告と事例</a></li>
+</ul><ul class="seealso"><li><a href="#comments_section">コメント</a></li></ul></div>
+<div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="before" id="before">始める前に</a></h2>
+
+    <p>この文書の先頭に飛ぶ前に、Apache
+    グループとこの文書での仮定を知っておくべきでしょう。
+    </p>
+
+    <p>第 1 に、あなたが <strong>setuid</strong> と
+    <strong>setgid</strong> 操作が可能な UNIX
+    由来のオペレーティングシステムを使っていることを想定しています。
+    これは、すべてのコマンド例にあてはまります。
+    その他のプラットホームでは、もし suEXEC
+    がサポートされていたとしても設定は異なるかもしれません。</p>
+
+    <p>第 2 に、あなたが使用中のコンピュータの
+    セキュリティに関する基本的な概念と、それらの管理について詳しいことを
+    想定しています。これは、<strong>setuid/setgid</strong>
+    操作、あなたのシステム上でのその操作による様々な効果、
+    セキュリティレベルについてあなたが理解しているということを含みます。
+    </p>
+
+    <p>第 3 に、<strong>改造されていない</strong> suEXEC
+    コードの使用を想定しています。suEXEC のコードは、
+    多くのベータテスタだけでなく、開発者によっても注意深く精査され
+    テストされています。それらの注意により、簡潔で信頼できる安全な
+    コードの基盤が保証されます。このコードを改変することで、
+    予期されない問題や新しいセキュリティ上の危険が生じることがあります。
+    セキュリティプログラミングの詳細に通じていて、
+    今後の検討のために成果を Apache
+    グループと共有しようと思うのでなければ、suEXEC
+    コードは変えないことを <strong>強く</strong>推奨します。</p>
+
+    <p>第 4 に、これが最後ですが、suEXEC を Apache
+    のデフォルトインストールには<strong>含めない</strong>ことが
+    Apache グループで決定されています。これは、suEXEC
+    の設定には管理者の詳細にわたる慎重な注意が必要だからです。
+    suEXEC の様々な設定について検討が終われば、管理者は suEXEC
+    を通常のインストール方法でインストールすることができます。
+    これらの設定値は、suEXEC
+    機能の使用中にシステムセキュリティを適切に保つために、
+    管理者によって慎重に決定され指定されることが必要です。
+    この詳細な手順により、Apache グループは、suEXEC
+    のインストールについて、注意深く十分に検討してそれを使用することを
+    決定した場合に限っていただきたいと考えています。
+    </p>
+
+    <p>それでも進みますか? よろしい。では、先へ進みましょう!</p>
+  </div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="model" id="model">suEXEC セキュリティモデル</a></h2>
+
+    <p>suEXEC の設定とインストールを始める前に、
+    まず実装しようとしているセキュリティモデルについて論じておきます。
+    それには、suEXEC の内部で行なわれていること、
+    システムのセキュリティを保証するために警告されることを
+    よく理解しておいた方がよいでしょう。</p>
+
+    <p><strong>suEXEC</strong> は、Apache web
+    サーバから呼び出される setuid された "wrapper"
+    プログラムが基本となっています。設計した CGI、または SSI
+    プログラムへの HTTP リクエストがあると、この wrapper
+    が呼び出されます。このようなリクエストがあると、Apache
+    はそのプログラムが実行される際のプログラム名とユーザ ID とグループ
+    ID を指定して suEXEC wrapper を実行します。
+    </p>
+
+    <p>それから、wrapper は成功または失敗を決定するため
+    以下の処理を行ないます。これらの状態のうち一つでも失敗した場合、
+    プログラムは失敗をログに記録してエラーで終了します。
+    そうでなければ、後の処理が続けられます。</p>
+
+    <ol>
+      <li>
+        <strong>wrapper
+        を実行しているユーザはこのシステムの正当なユーザか?</strong>
+
+        <p class="indent">
+          これは、wrapper を実行しているユーザが
+          本当にシステムの利用者であることを保証するためです。
+        </p>
+      </li>
+
+
+     <li>
+        <strong>wrapper が適切な数の引数で呼び出されたか?</strong>
+
+
+        <p class="indent">
+          wrapper は適切な数の引数が与えられた場合にのみ実行されます。
+          適切な引数のフォーマットは Apache Web サーバに解釈されます。
+          適切な数の引数を受け取らなければ、攻撃をされたか
+          あなたの Apache バイナリの suEXEC の部分が
+          どこかおかしい可能性があります。
+        </p>
+      </li>
+
+      <li>
+        <strong>この正当なユーザは wrapper
+        の実行を許可されているか?</strong>
+
+        <p class="indent">
+          このユーザは wrapper 実行を許可されたユーザですか?
+          ただ一人のユーザ (Apache ユーザ) だけが、
+          このプログラムの実行を許可されます。
+        </p>
+      </li>
+
+      <li>
+        <strong>対象の CGI, SSI プログラムが安全でない階層の参照をしているか?
+        </strong>
+
+        <p class="indent">
+          対象の CGI, SSI プログラムが '/' から始まる、または
+          '..' による参照を行なっていますか? これらは許可されません。
+          対象のプログラムは suEXEC のドキュメントルート
+          (下記の <code>--with-suexec-docroot=<em>DIR</em></code> を参照)
+          内に存在しなければなりません。
+        </p>
+      </li>
+
+      <li>
+        <strong>対象となるユーザ名は正当なものか?</strong>
+
+        <p class="indent">
+          対象となるユーザ名は存在していますか?
+        </p>
+      </li>
+
+      <li>
+        <strong>対象となるグループ名は正当なものか?</strong>
+
+        <p class="indent">
+          対象となるグループ名は存在していますか?
+        </p>
+      </li>
+
+      <li>
+        <strong>目的のユーザはスーパーユーザでは<em>ない</em>か?
+        </strong>
+
+        <p class="indent">
+          今のところ、suEXEC は <code><em>root</em></code> による CGI/SSI
+          プログラムの実行を許可していません。
+        </p>
+      </li>
+
+      <li>
+        <strong>対象となるユーザ ID は、最小の ID
+        番号よりも<em>大きい</em>か?  </strong>
+
+        <p class="indent">
+          最小ユーザ ID 番号は設定時に指定されます。これは、
+          CGI/SSI プログラム実行を許可されるユーザ ID
+          のとりうる最小値です。これは
+          "system" 用のアカウントを閉め出すのに有効です。
+        </p>
+      </li>
+
+      <li>
+        <strong>対象となるグループはスーパーユーザのグループでは
+        <em>ない</em>か?</strong>
+
+        <p class="indent">
+         今のところ、suEXEC は 'root' グループによる CGI/SSI
+         プログラムの実行を許可していません。
+        </p>
+      </li>
+
+      <li>
+        <strong>対象となるグループ ID は最小の ID
+          番号よりも<em>大きい</em>か?</strong>
+
+        <p class="indent">
+          最小グループ ID 番号は設定時に指定されます。これは、
+          CGI/SSI プログラム実行を許可されるグループ
+          ID のとりうる最小値です。
+          これは "system" 用のグループを閉め出すのに有効です。
+        </p>
+      </li>
+
+      <li>
+        <strong>wrapper が正常に対象となるユーザとグループになれるか?
+        </strong>
+
+        <p class="indent">
+          ここで、setuid と setgid
+          の起動によりプログラムは対象となるユーザとグループになります。
+          グループアクセスリストは、
+          ユーザが属しているすべてのグループで初期化されます。
+        </p>
+      </li>
+
+      <li>
+        <strong>CGI/SSI プログラムが置かれているディレクトリに移動
+        (change directory) できるか?</strong>
+
+        <p class="indent">
+          ディレクトリが存在しないなら、そのファイルも存在しないかもしれません。
+          ディレクトリに移動できないのであれば、おそらく存在もしないでしょう。
+        </p>
+      </li>
+
+      <li>
+        <strong>ディレクトリが Apache のドキュメントツリー内にあるか?
+        </strong>
+
+        <p class="indent">
+          リクエストがサーバ内のものであれば、
+          要求されたディレクトリが suEXEC のドキュメントルート配下にありますか?
+          リクエストが UserDir のものであれば、要求されたディレクトリが suEXEC 
+          のユーザのドキュメントルート配下にありますか?
+          (<a href="#install">suEXEC 設定オプション</a> 参照)
+        </p>
+      </li>
+
+      <li>
+        <strong>ディレクトリを他のユーザが書き込めるようになって
+        <em>いない</em>か?</strong>
+
+        <p class="indent">
+          ディレクトリを他ユーザに開放しないようにします。
+          所有ユーザだけがこのディレクトリの内容を改変できるようにします。
+        </p>
+      </li>
+
+
+      <li>
+        <strong>対象となる CGI/SSI プログラムは存在するか?</strong>
+
+        <p class="indent">
+          存在しなければ実行できません。
+        </p>
+      </li>
+
+      <li>
+        <strong>対象となる CGI/SSI プログラムファイルが他アカウントから
+        書き込めるようになって<em>いない</em>か?</strong>
+
+        <p class="indent">
+          所有者以外には CGI/SSI プログラムを変更する権限は与えられません。
+        </p>
+      </li>
+
+
+      <li>
+        <strong>対象となる CGI/SSI プログラムが setuid または setgid 
+        されて<em>いない</em>か?</strong>
+
+        <p class="indent">
+          UID/GID を再度変更してのプログラム実行はしません
+        </p>
+      </li>
+
+
+      <li>
+        <strong>対象となるユーザ/グループがプログラムの
+        ユーザ/グループと同じか?</strong>
+
+        <p class="indent">
+          ユーザがそのファイルの所有者ですか?
+        </p>
+      </li>
+
+      <li>
+        <strong>安全な動作を保証するための環境変数クリアが可能か?
+        </strong>
+
+        <p class="indent">
+          suEXEC は、安全な環境変数のリスト
+          (これらは設定時に作成されます) 内の変数として渡される安全な
+          PATH 変数 (設定時に指定されます) を設定することで、
+          プロセスの環境変数をクリアします。
+        </p>
+      </li>
+
+
+      <li>
+        <strong>対象となる CGI/SSI プログラムを exec して実行できるか?</strong>
+
+
+        <p class="indent">
+          ここで suEXEC が終了し、対象となるプログラムが開始されます。
+        </p>
+      </li>
+    </ol>
+
+    <p>ここまでが suEXEC の wrapper
+    におけるセキュリティモデルの標準的な動作です。もう少し厳重に
+    CGI/SSI 設計についての新しい制限や規定を取り入れることもできますが、
+    suEXEC はセキュリティに注意して慎重に少しずつ開発されてきました。
+    </p>
+
+    <p>このセキュリティモデルを用いて
+    サーバ設定時にどのように許すことを制限するか、また、suEXEC
+    を適切に設定するとどのようなセキュリティ上の危険を避けられるかに
+    関するより詳しい情報については、<a href="#jabberwock">"とかげに注意"
+    (Beware the Jabberwock)</a> の章を参照してください。
+    </p>
+  </div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="install" id="install">suEXEC
+    の設定とインストール</a></h2>
+
+    <p>ここから楽しくなります。</p>
+
+    <p><strong>suEXEC
+    設定オプション</strong><br />
+    </p>
+
+    <dl>
+      <dt><code>--enable-suexec</code></dt>
+
+      <dd>このオプションは、デフォルトではインストールされず、
+      有効にはならない suEXEC 機能を有効にします。
+      suEXEC を使うように APACI に要求するには、<code>--enable-suexec</code>
+      オプションにあわせて少なくとも一つは <code>--with-suexec-xxxxx</code>
+      オプションが指定されなければなりません。</dd>
+
+      <dt><code>--with-suexec-bin=<em>PATH</em></code></dt>
+
+      <dd>セキュリティ上の理由により、<code>suexec</code> バイナリのパスはサーバに
+      ハードコードされている必要があります。デフォルトのパスを
+      変えたいときはこのオプションを使ってください。<em>例えば</em>、
+      <code>--with-suexec-bin=/usr/sbin/suexec</code> のように。</dd>
+
+      <dt><code>--with-suexec-caller=<em>UID</em></code></dt>
+
+      <dd>Apache を通常動作させる<a href="mod/mpm_common.html#user">ユーザ名</a>を指定します。
+      このユーザだけが suexec の実行を許可されたユーザになります。</dd>
+
+      <dt><code>--with-suexec-userdir=<em>DIR</em></code></dt>
+
+      <dd>suEXEC がアクセスを許されるユーザホームディレクトリ配下の
+      サブディレクトリを指定します。
+      このディレクトリ以下の全実行ファイルは、"安全な"プログラムになるよう、
+      suEXEC がそのユーザとして実行できるようにします。
+      "単純な" UserDir ディレクティブを使っている場合 
+      (すなわち "*" を含まないもの)、これと同じ値を設定すべきです。
+      Userdir ディレクティブがそのユーザのパスワードファイル内の
+      ホームディレクトリと同じ場所を指していなければ、
+      suEXEC は適切に動作しません。デフォルトは "public_html" です。
+      <br />
+      各 UserDir が異なった仮想ホストを設定している場合、
+      それらを全て一つの親ディレクトリに含めて、
+      その親ディレクトリの名前をここで指定する必要があります。
+      <strong>このように指定されなければ "~userdir" cgi
+      へのリクエストが動作しません。</strong></dd>
+
+      <dt><code>--with-suexec-docroot=<em>DIR</em></code></dt>
+
+      <dd>Apache のドキュメントルートを設定します。これが suEXEC
+      の動作で使用する唯一のディレクトリ階層になります (UserDir
+      の指定は別)。デフォルトでは <code>--datedir</code> に "/htdocs"
+      というサフィックスをつけたものです。
+      "<code>--datadir=/home/apache</code>" として設定すると、
+      suEXEC wrapper にとって "/home/apache/htdocs"
+      がドキュメントルートとして使われます。</dd>
+
+      <dt><code>--with-suexec-uidmin=<em>UID</em></code></dt>
+
+      <dd>suEXEC の対象ユーザとして許される UID の最小値を指定します。
+      大抵のシステムでは 500 か 100 が一般的です。
+      デフォルト値は 100 です。</dd>
+
+      <dt><code>--with-suexec-gidmin=<em>GID</em></code></dt>
+
+      <dd>suEXEC の対象グループとして許される GID
+      の最小値を指定します。大抵のシステムでは 100 が一般的なので、
+      デフォルト値としても 100 が使われています。</dd>
+
+      <dt><code>--with-suexec-logfile=<em>FILE</em></code></dt>
+
+      <dd>suEXEC の処理とエラーが記録されるファイル名を指定します。
+      (監査やデバッグ目的に有用)
+      デフォルトではログファイルは "suexec_log" という名前で、
+      標準のログファイルディレクトリ (<code>--logfiledir</code>) に置かれます。
+      </dd>
+
+      <dt><code>--with-suexec-safepath=<em>PATH</em></code></dt>
+
+      <dd>CGI 実行ファイルに渡される安全な PATH 環境変数です。
+      デフォルト値は "/usr/local/bin:/usr/bin:/bin" です。
+      </dd>
+    </dl>
+
+    <p><strong>suEXEC wrapper
+    のコンパイルとインストール</strong><br />
+    <code>--enable-suexec</code> オプションで suEXEC 機能を有効にすると、
+    "make" コマンドを実行した時に <code>suexec</code> のバイナリ (Apache 自体も)
+    が自動的に作成されます。
+    <br />
+    すべての構成要素が作成されると、それらのインストールには
+    <code>make install</code> コマンドが実行できます。バイナリイメージの <code>suexec</code>
+    は <code>--sbindir</code> オプションで指定されたディレクトリにインストールされます。
+    デフォルトの場所は "/usr/local/apache/bin/suexec" です。<br />
+    インストール時には <strong><em>root</em></strong>
+    権限が必要なので注意してください。wrapper がユーザ ID
+    を設定するために、所有者 <code><em>root</em></code>
+    でのセットユーザ ID
+    ビットをそのファイルのモードに設定しなければなりません。
+    </p>
+
+    <p><strong>安全なパーミッションを設定する</strong><br />
+    suEXEC ラッパーは、<code>--with-suexec-caller</code> <code class="program"><a href="./programs/configure.html">configure</a></code> 
+    オプションで指定した正しいユーザで起動されていることを確認しますが、
+    システム上でこのチェックが行なわれる前に、
+    suEXEC が呼ぶシステムやライブラリが脆弱である可能性は残ります。対抗策として、
+    一般に良い習慣ともされいますが、
+    ファイルシステムパーミッションを使って
+    Apache の実行時のグループのみが suEXEC を実行できるように
+    するのが良いでしょう。</p>
+
+    <p>たとえば、次のようにサーバが設定されていたとします。</p>
+
+<div class="example"><p><code>
+    User www<br />
+    Group webgroup<br />
+</code></p></div>
+
+    <p><code class="program"><a href="./programs/suexec.html">suexec</a></code> が "/usr/local/apache2/bin/suexec" 
+    にインストールされていた場合、次のように設定する必要があります。</p>
+
+<div class="example"><p><code>
+    chgrp webgroup /usr/local/apache2/bin/suexec<br />
+    chmod 4750 /usr/local/apache2/bin/suexec<br />
+</code></p></div>
+
+    <p>これで Apache が実行されるグループのみが 
+    suEXEC ラッパーを実行できるということを
+    確証します。</p>
+  </div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="enable" id="enable">suEXEC
+    の有効化と無効化</a></h2>
+
+    <p>起動時に、Apache は <code>--sbindir</code>
+    オプションで設定されたディレクトリで
+    <code>suexec</code> を探します
+    (デフォルトは "/usr/local/apache/sbin/suexec") 。
+    適切に設定された suEXEC がみつかると、
+    エラーログに以下のメッセージが出力されます。</p>
+
+<div class="example"><p><code>
+    [notice] suEXEC mechanism enabled (wrapper: <var>/path/to/suexec</var>)
+</code></p></div>
+
+    <p>サーバ起動時にこのメッセージが出ない場合、
+    大抵はサーバが想定した場所で wrapper プログラムが見つからなかったか、
+    <em>setuid root</em> としてインストールされていないかです。</p>
+
+    <p>suEXEC の仕組みを使用するのが初めてで、Apache が既に動作中であれば、
+    Apache を kill して、再起動しなければなりません。HUP シグナルや
+    USR1 シグナルによる単純な再起動では不十分です。</p>
+    <p>suEXEC を無効にする場合は、<code>suexec</code> ファイルを削除してから
+    Apache を kill して再起動します。
+    </p>
+  </div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="usage" id="usage">suEXEC の使用</a></h2>
+
+    <p>CGI プログラムへのリクエストが suEXEC ラッパーを呼ぶのは、
+    <code class="directive"><a href="./mod/mod_suexec.html#suexecusergroup">SuexecUserGroup</a></code> ディレクティブを
+    含むバーチャルホストへのリクエストか、<code class="module"><a href="./mod/mod_userdir.html">mod_userdir</a></code> により
+    処理されたリクエストの場合に限ります。</p>
+
+    <p><strong>仮想ホスト:</strong><br />
+    suEXEC wrapper の使い方として、
+    <code class="directive"><a href="./mod/core.html#virtualhost">VirtualHost</a></code> 設定での
+    <code class="directive"><a href="./mod/mod_suexec.html#suexecusergroup">SuexecUserGroup</a></code>
+    ディレクティブを通したものがあります。
+    このディレクティブをメインサーバのユーザ ID
+    と異なるものにすると、CGI リソースへのすべてのリクエストは、その
+    <code class="directive"><a href="./mod/core.html#virtualhost">&lt;VirtualHost&gt;</a></code> で指定された <em>User</em> と
+    <em>Group</em> として実行されます。<code class="directive"><a href="./mod/core.html#virtualhost">&lt;VirtualHost&gt;</a></code>
+    でこのディレクティブが指定されていない場合、
+    メインサーバのユーザ ID が想定されます。</p>
+
+    <p><strong>ユーザディレクトリ:</strong><br />
+    <code class="module"><a href="./mod/mod_userdir.html">mod_userdir</a></code> により処理されたリクエストは
+    リクエストされたユーザディレクトリのユーザ ID で CGI プログラムを
+    実行するために suEXEC ラッパーを呼びます。
+    この機能を動作させるために必要なことは、CGI
+    をそのユーザで実行できること、そのスクリプトが上記の<a href="#model">セキュリティ検査</a>をパスできることです。
+    <a href="#install">コンパイル
+     時のオプション</a> <code>--with-suexec-userdir</code> も参照してください。</p>
+  </div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="debug" id="debug">suEXEC のデバッグ</a></h2>
+
+    <p>suEXEC wrapper は、上記で述べた <code>--with-suexec-logfile</code>
+    オプションで指定されたファイルにログ情報を記録します。
+    wrapper を適切に設定、インストールできていると思う場合、
+    どこで迷っているか見ようとするならこのログとサーバの
+    エラーログを見るとよいでしょう。</p>
+  </div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="jabberwock" id="jabberwock">とかげに注意: 警告と事例</a></h2>
+
+    <p><strong>注意!</strong>
+    この章は完全ではありません。この章の最新改訂版については、
+    Apache グループの<a href="http://httpd.apache.org/docs/2.4/suexec.html">
+    オンラインドキュメント</a>版を参照してください。
+    </p>
+
+    <p>サーバの設定に制限をもうける wrapper について、
+    いくつか興味深い点があります。suEXEC に関する "バグ"
+    を報告する前にこれらを確認してください。</p>
+
+    <ul>
+      <li><strong>suEXEC の興味深い点</strong></li>
+
+      <li>階層構造の制限
+
+
+        <p class="indent">
+          セキュリティと効率の理由から、<code>suEXEC</code> の全てのリクエストは
+          仮想ホストへのリクエストにおける最上位のドキュメントルート内か、
+          ユーザディレクトリへのリクエストにおける個々のユーザの最上位の
+          ドキュメントルート内に残らなければなりません。
+          例えば、四つの仮想ホストを設定している場合、
+          仮想ホストの suEXEC に有利なように、メインの Apache
+          ドキュメント階層の外側に全ての仮想ホストのドキュメントルートを
+          構築する必要があります。(例は後日記載)
+        </p>
+      </li>
+
+      <li>suEXEC の PATH 環境変数
+
+
+        <p class="indent">
+          これを変更するのは危険です。この指定に含まれる各パスが
+          <strong>信頼できる</strong>
+          ディレクトリであることを確認してください。
+          世界からのアクセスにより、誰かがホスト上でトロイの木馬
+          を実行できるようにはしたくないでしょう。
+        </p>
+      </li>
+
+      <li>suEXEC コードの改造
+
+
+        <p class="indent">
+          繰り返しますが、何をやろうとしているか把握せずにこれをやると
+          <strong>大きな問題</strong>を引き起こしかねません。
+          可能な限り避けてください。
+        </p>
+      </li>
+    </ul>
+</div></div>
+<div class="bottomlang">
+<p><span>翻訳済み言語: </span><a href="./en/suexec.html" hreflang="en" rel="alternate" title="English">&nbsp;en&nbsp;</a> |
+<a href="./fr/suexec.html" hreflang="fr" rel="alternate" title="Français">&nbsp;fr&nbsp;</a> |
+<a href="./ja/suexec.html" title="Japanese">&nbsp;ja&nbsp;</a> |
+<a href="./ko/suexec.html" hreflang="ko" rel="alternate" title="Korean">&nbsp;ko&nbsp;</a> |
+<a href="./tr/suexec.html" hreflang="tr" rel="alternate" title="Türkçe">&nbsp;tr&nbsp;</a></p>
+</div><div class="top"><a href="#page-header"><img src="./images/up.gif" alt="top" /></a></div><div class="section"><h2><a id="comments_section" name="comments_section">コメント</a></h2><div class="warning"><strong>Notice:</strong><br />This is not a Q&amp;A section. Comments placed here should be pointed towards suggestions on improving the documentation or server, and may be removed again by our moderators if they are either implemented or considered invalid/off-topic. Questions on how to manage the Apache HTTP Server should be directed at either our IRC channel, #httpd, on Freenode, or sent to our <a href="http://httpd.apache.org/lists.html">mailing lists</a>.</div>
+<script type="text/javascript"><!--//--><![CDATA[//><!--
+var comments_shortname = 'httpd';
+var comments_identifier = 'http://httpd.apache.org/docs/2.4/suexec.html';
+(function(w, d) {
+    if (w.location.hostname.toLowerCase() == "httpd.apache.org") {
+        d.write('<div id="comments_thread"><\/div>');
+        var s = d.createElement('script');
+        s.type = 'text/javascript';
+        s.async = true;
+        s.src = 'https://comments.apache.org/show_comments.lua?site=' + comments_shortname + '&page=' + comments_identifier;
+        (d.getElementsByTagName('head')[0] || d.getElementsByTagName('body')[0]).appendChild(s);
+    }
+    else { 
+        d.write('<div id="comments_thread">Comments are disabled for this page at the moment.<\/div>');
+    }
+})(window, document);
+//--><!]]></script></div><div id="footer">
+<p class="apache">Copyright 2015 The Apache Software Foundation.<br />この文書は <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a> のライセンスで提供されています。.</p>
+<p class="menu"><a href="./mod/">モジュール</a> | <a href="./mod/directives.html">ディレクティブ</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="./glossary.html">用語</a> | <a href="./sitemap.html">サイトマップ</a></p></div><script type="text/javascript"><!--//--><![CDATA[//><!--
+if (typeof(prettyPrint) !== 'undefined') {
+    prettyPrint();
+}
+//--><!]]></script>
+</body></html>
\ No newline at end of file
diff --git a/docs/manual/suexec.html.ko.euc-kr b/docs/manual/suexec.html.ko.euc-kr
new file mode 100644
index 0000000..93931d5
--- /dev/null
+++ b/docs/manual/suexec.html.ko.euc-kr
@@ -0,0 +1,564 @@
+<?xml version="1.0" encoding="EUC-KR"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" lang="ko" xml:lang="ko"><head>
+<meta content="text/html; charset=EUC-KR" http-equiv="Content-Type" />
+<!--
+        XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+              This file is generated from xml source: DO NOT EDIT
+        XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+      -->
+<title>suEXEC ���� - Apache HTTP Server Version 2.4</title>
+<link href="./style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" />
+<link href="./style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" />
+<link href="./style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" /><link rel="stylesheet" type="text/css" href="./style/css/prettify.css" />
+<script src="./style/scripts/prettify.min.js" type="text/javascript">
+</script>
+
+<link href="./images/favicon.ico" rel="shortcut icon" /></head>
+<body id="manual-page"><div id="page-header">
+<p class="menu"><a href="./mod/">���</a> | <a href="./mod/directives.html">���þ��</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="./glossary.html">���</a> | <a href="./sitemap.html">����Ʈ��</a></p>
+<p class="apache">Apache HTTP Server Version 2.4</p>
+<img alt="" src="./images/feather.gif" /></div>
+<div class="up"><a href="./"><img title="&lt;-" alt="&lt;-" src="./images/left.gif" /></a></div>
+<div id="path">
+<a href="http://www.apache.org/">Apache</a> &gt; <a href="http://httpd.apache.org/">HTTP Server</a> &gt; <a href="http://httpd.apache.org/docs/">Documentation</a> &gt; <a href="./">Version 2.4</a></div><div id="page-content"><div id="preamble"><h1>suEXEC ����</h1>
+<div class="toplang">
+<p><span>������ ���: </span><a href="./en/suexec.html" hreflang="en" rel="alternate" title="English">&nbsp;en&nbsp;</a> |
+<a href="./fr/suexec.html" hreflang="fr" rel="alternate" title="Fran&#231;ais">&nbsp;fr&nbsp;</a> |
+<a href="./ja/suexec.html" hreflang="ja" rel="alternate" title="Japanese">&nbsp;ja&nbsp;</a> |
+<a href="./ko/suexec.html" title="Korean">&nbsp;ko&nbsp;</a> |
+<a href="./tr/suexec.html" hreflang="tr" rel="alternate" title="T&#252;rk&#231;e">&nbsp;tr&nbsp;</a></p>
+</div>
+<div class="outofdate">�� ������ �ֽ��� ������ �ƴմϴ�.
+            �ֱٿ� ����� ������ ���� ������ �����ϼ���.</div>
+
+    <p><strong>suEXEC</strong> ����� ����ġ�� <strong>CGI</strong>��
+    <strong>SSI</strong> ���α׷��� �������� ������ ����� ID��
+    �ƴ� �ٸ� ����� ID�� �����ϵ��� �Ѵ�. ���� CGI�� SSI ���α׷���
+    �����ϸ� �������� ������ ����ڿ� ���� ����ڷ� �����Ѵ�.</p>
+
+    <p>�� ����� ������ ����ϸ� ����ڰ� ���� CGI�� SSI ���α׷���
+    �����ϰ� �����Ҷ� �߻��� �� �ִ� ���������� ����� ����
+    �� �ִ�. �׷��� suEXEC�� �������ϰ� �����Ǹ� ���� ������
+    ��ǻ�Ϳ� ���ο� ���� ������ ���� �� �ִ�. ���� <em>setuid root</em>
+    ���α׷��� �̷� ���α׷��� ���� ������ �����ϴٸ� suEXEC��
+    ��������ʱ� �������� �ٶ���.</p>
+  </div>
+<div id="quickview"><ul id="toc"><li><img alt="" src="./images/down.gif" /> <a href="#before">�����ϱ� ����</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#model">suEXEC ���ȸ�</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#install">suEXEC ������ ��ġ</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#enable">suEXEC �� ���</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#usage">suEXEC ����ϱ�</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#debug">suEXEC ������ϱ�</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#jabberwock">�ٽ� �ѹ� �����϶�: ���� ����</a></li>
+</ul><ul class="seealso"><li><a href="#comments_section">Comments</a></li></ul></div>
+<div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="before" id="before">�����ϱ� ����</a></h2>
+
+    <p>�����ϱ� ���� �켱 ����ġ�׷�� �� ������ ������ ������.</p>
+
+    <p>���� <strong>setuid</strong>�� <strong>setgid</strong>
+    ����� ������ ���н��� �ü���� ����Ѵٰ� �����Ѵ�. ���
+    ��ɾ� ���鵵 ���� ������ �Ѵ�. suEXEC�� �����ϴ� �ٸ� �÷�����
+    ����ϴٸ� ������ �ٸ� �� �ִ�.</p>
+
+    <p>�ι�°, ����� ��ǻ�� ������ �⺻ ����� ������ �ͼ��ϴٰ�
+    �����Ѵ�. ���⿡�� <strong>setuid/setgid</strong> ��ɰ�
+    �̵��� �ý��۰� ���ȿ� ��ġ�� ���� ���⿡ ���� ���ذ� ���Եȴ�.</p>
+
+    <p>����°, suEXEC �ڵ��� <strong>������������</strong>
+    ������ ����Ѵٰ� �����Ѵ�. �����ڿ� ���� ��Ÿ�׽��͵���
+    suEXEC�� ���õ� ��� �ڵ带 ���ɽ����� �����ϰ� �˻��ߴ�.
+    �ڵ带 �����ϰ� �ϰ� Ȯ���� ������ �����ϱ����� ��� ���Ǹ�
+    ��￴��. �� �ڵ带 �����ϸ� ����ġ���� ������ ���ο� ����
+    ������ �߻��� �� �ִ�. ���� ���α׷��ֿ� ���� �ſ� �� �˰�
+    �ڵ带 ���캸������ ����ġ�׷�� �۾��� ������ �ǻ簡 ���ٸ�
+    suEXEC �ڵ带 ���������ʱ� <strong>������</strong> ���Ѵ�.</p>
+
+    <p>�׹�°���� ����������, ����ġ�׷��� suEXEC�� ����ġ
+    �⺻��ġ�� �������� <strong>�ʱ��</strong> �����ߴ�. �ᱹ
+    �����ڰ� ���Ǹ� ��￩�� suEXEC�� �����ؾ� �Ѵ�. suEXEC��
+    ���� ������ �� ������� �����ڴ� �Ϲ����� ��ġ����� suEXEC��
+    ��ġ�� �� �ִ�. suEXEC ����� ����ϴ� �ý����� ������ å������
+    �����ڴ� �� ���������� �����ְ� ���캸�� �����ؾ� �Ѵ�.
+    �̷� ���� ������ suEXEC�� ����Ҹ�ŭ �����ְ� ��ȣ�� 
+    ������� suEXEC�� ����ϵ��� ����ġ�׷��� ���ϱ� �����̴�.</p>
+
+    <p>������ ����ϱ� ���ϴ°�? �׷���? ����. ���� ��������!</p>
+</div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="model" id="model">suEXEC ���ȸ�</a></h2>
+
+    <p>suEXEC�� �����ϰ� ��ġ�ϱ� ���� �츮�� ���ȸ��� ����
+    �����Ѵ�. �̸� ���� ��Ȯ�� suEXEC �ȿ����� ���� ���� �Ͼ��
+    �ý����� ������ ���� ������ �����ؾ� ���� �� �� ������ ��
+    �ִ�.</p>
+
+    <p><strong>suEXEC</strong>�� ����ġ �������� �θ��� setuid
+    "wrapper" ���α׷��� ������� �Ѵ�. �� wrapper�� �����ڰ�
+    �ּ����� �ٸ� userid�� �����ϵ��� ������ CGI�� SSI ���α׷���
+    HTTP ��û�� ���� �Ҹ���. �̷� ��û�� ���� ����ġ�� suEXEC
+    wrapper���� ���α׷���� ���α׷��� ������ ����ڿ� �׷�
+    ID�� �����Ѵ�.</p>
+
+    <p>�׷��� wrapper�� ���� ������ ���� ������ ���и� �����Ѵ�.
+    �� ������ �ϳ��� �����ϸ� ���α׷��� ���з� ��ϵǰ� ������
+    ���� �����Ѵ�. �������� ������ ������ ����Ѵ�:</p>
+
+    <ol>
+      <li>
+        <strong>wrapper�� �����ϴ� ����ڰ� �ý����� ��������
+        �������</strong> 
+
+        <p class="indent">
+          wrapper�� �����ϴ� ����ڰ� ������ �ý����� ���������
+          Ȯ���Ѵ�.
+        </p>
+     </li>
+
+     <li>
+        <strong>������ ���� �ƱԸ�Ʈ�� wrapper�� �����ϴ°�?</strong>
+
+        <p class="indent">
+          wrapper�� ������ ���� �ƱԸ�Ʈ�� �־�߸� ����ȴ�.
+          ����ġ �������� �� ������ �ȴ�. wrapper�� ������ ����
+          �ƱԸ�Ʈ�� �������ϸ� ��ŷ�Ǿ��ų� ����ġ�� suEXEC��
+          ���� ������ �ִ� ���̴�.
+        </p>
+      </li>
+
+      <li>
+        <strong>�� ����ڰ� wrapper�� �����ϵ��� ���Ǿ���?</strong> 
+
+        <p class="indent">
+          �� ����ڰ� wrapper�� �����ϵ��� ���Ǿ���? ����
+          �� �����(����ġ �����)���� �� ���α׷��� ������
+          �� �ִ�.
+        </p>
+      </li>
+
+      <li>
+        <strong>������ CGI�� SSI ���α׷��� ������������ ����������
+        �����°�?</strong>
+
+        <p class="indent">
+          ������ CGI�� SSI ���α׷��� '/'�� �����ϰų� ������
+          '..'�� �����°�? �̵��� ����� �� ����. ������ CGI/SSI
+          ���α׷��� suEXEC ���� root (�Ʒ�
+          <code>--with-suexec-docroot=<em>DIR</em></code> ����)
+          ���� �־�� �Ѵ�.
+        </p>
+      </li>
+
+      <li>
+        <strong>������ ����ڸ��� ��ȿ�Ѱ�?</strong> 
+
+        <p class="indent">
+          ������ ����ڰ� �����ϴ°�?
+        </p>
+      </li>
+
+      <li>
+        <strong>������ �׷���� ��ȿ�Ѱ�?</strong> 
+
+        <p class="indent">
+          ������ �׷��� �����ϴ°�?
+        </p>
+      </li>
+
+      <li>
+        <strong>������ ����ڰ� superuser�� <em>�ƴѰ�</em>?</strong>
+        
+
+        <p class="indent">
+          ���� suEXEC�� <code><em>root</em></code>�� CGI/SSI
+          ���α׷��� ������ �� ������ �Ѵ�.
+        </p>
+      </li>
+
+      <li>
+        <strong>������ userid�� �ּ� ID ���ں��� <em>ū��</em>?</strong>
+
+        <p class="indent">
+          �������� �ּ� ����� ID ���ڸ� �����Ѵ�. �׷��� CGI/SSI
+          ���α׷��� ������ �� �ִ� userid�� �ּ�ġ�� ������
+          �� �ִ�. "�ý��ۿ�" ������ �����Ҷ� �����ϴ�.
+        </p>
+      </li>
+
+      <li>
+        <strong>������ �׷��� superuser �׷��� <em>�ƴѰ�</em>?</strong> 
+
+        <p class="indent">
+          ���� suEXEC�� <code><em>root</em></code> �׷��� CGI/SSI
+          ���α׷��� ������ �� ������ �Ѵ�.
+        </p>
+      </li>
+
+      <li>
+        <strong>������ groupid�� �ּ� ID ���ں��� <em>ū��</em>?</strong> 
+
+        <p class="indent">
+          �������� �ּ� �׷� ID ���ڸ� �����Ѵ�. �׷��� CGI/SSI
+          ���α׷��� ������ �� �ִ� groupid�� �ּ�ġ�� ������
+          �� �ִ�. "�ý��ۿ�" �׷��� �����Ҷ� �����ϴ�.
+        </p>
+      </li>
+
+      <li>
+        <strong>wrapper�� ���������� ������ ����ڿ� �׷���
+        �� �� �ִ°�?</strong>
+
+        <p class="indent">
+          �� �ܰ迡�� ���α׷��� setuid�� setgid ȣ���� �Ͽ�
+          ������ ����ڿ� �׷��� �ȴ�. ��, �׷� ���ٸ����
+          ����ڰ� �ش�� ��� �׷����� �ʱ�ȭ�ȴ�.
+        </p>
+      </li>
+
+      <li>
+        <strong>CGI/SSI ���α׷��� �ִ� ���丮�� ���丮��
+        ������ �� �ִ°�?</strong>
+
+        <p class="indent">
+          ���丮�� �������� �ʴٸ� ������ ���� �� ����. �̰�����
+          ���丮�� ������ �� ���ٸ� ���丮�� �������� ����
+          ���̴�.
+        </p>
+      </li>
+
+      <li>
+        <strong>���丮�� ����ġ ������ �ȿ� �ִ°�?</strong>
+
+        <p class="indent">
+          ������ �Ϲ����� �κ��� ��û�� ��� ��û�ϴ� ���丮��
+          suEXEC ���� root �Ʒ� �ִ°�? UserDir�� ��û�� ���
+          ��û�ϴ� ���丮�� suEXEC userdir�� ������ (<a href="#install">suEXEC ���� �ɼ�</a> ����) ���丮
+          �Ʒ��� �ִ°�?
+        </p>
+      </li>
+
+      <li>
+        <strong>�ٸ� ������ ���丮�� ��������� <em>���°�</em>?</strong>
+
+        <p class="indent">
+          ���丮�� �ٸ� ������� ����α� �������ʴ´�. ����
+          �����ڸ��� ���丮 ������ ������ �� �ִ�.
+        </p>
+      </li>
+
+      <li>
+        <strong>������ CGI/SSI ���α׷��� �����ϴ°�?</strong> 
+
+        <p class="indent">
+          ���������ʴٸ� ������ ���� ����.
+        </p>
+      </li>
+
+      <li>
+        <strong>�ٸ� ������ ������ CGI/SSI ���α׷��� ���������
+        <em>���°�</em>?</strong>
+
+        <p class="indent">
+          �����ڿ� ������ CGI/SSI ���α׷��� �����ϱ� �������ʴ´�.
+        </p>
+      </li>
+
+      <li>
+        <strong>������ CGI/SSI ���α׷��� setuid�� setgid��
+        <em>�ƴѰ�</em>?</strong>
+
+        <p class="indent">
+          �츮�� ���α׷��� �ٽ� UID/GID�� �����ϱ� �������ʴ´�.
+        </p>
+      </li>
+
+      <li>
+        <strong>������ �����/�׷��� ���α׷��� �����/�׷�� ������?</strong>
+
+        <p class="indent">
+          ����ڰ� ������ �������ΰ�?
+        </p>
+      </li>
+
+      <li>
+        <strong>������ ������ ���� ���μ����� ȯ�溯���� û����
+        �� �ִ°�?</strong>
+
+        <p class="indent">
+          suEXEC�� (�������� ������) ������ ���� PATH�� ���,
+          (�̰͵� �������� ����) ������ ȯ�溯�� ��Ͽ� ���ŵ�
+          ������ ����� ���μ����� ȯ�溯���� �����.
+        </p>
+      </li>
+
+      <li>
+        <strong>���������� ������ CGI/SSI ���α׷��� ������
+        �� �ִ°�?</strong> 
+
+        <p class="indent">
+          ���⼭ suEXEC�� ������ ������ CGI/SSI ���α׷��� �����Ѵ�.
+        </p>
+      </li>
+    </ol>
+
+    <p>�̰��� suEXEC wrapper ���ȸ��� ǥ�� �����̴�. �ټ�
+    �����ϰ� CGI/SSI ���迡 ���ο� ������ ������, ������ ���ο�
+    �ΰ� �Ѵܰ辿 ���ɽ����� ���������.</p>
+
+    <p>�� ���� ���� ���� ������ � ������ �ִ����� ������
+    suEXEC �������� � ���� ������ ���� �� �ִ����� ���� ��
+    ������ <a href="#jabberwock">"�ٽ� �ѹ� �����϶�"</a> ����
+    �����϶�.</p>
+</div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="install" id="install">suEXEC ������ ��ġ</a></h2>
+
+    <p>���� ����ִ� ������ �����Ѵ�.</p>
+
+    <p><strong>suEXEC ���� �ɼ�</strong><br />
+    </p>
+
+    <dl>
+      <dt><code>--enable-suexec</code></dt>
+
+      <dd>�� �ɼ��� �⺻������ ��ġ�ǰų� Ȱ��ȭ�����ʴ� suEXEC
+      ����� Ȱ��ȭ�Ѵ�. APACI�� suEXEC�� �޾Ƶ��̷���
+      <code>--enable-suexec</code> �ɼǿܿ�
+      <code>--with-suexec-xxxxx</code> �ɼ��� �ּ��� �Ѱ�
+      �ʿ��ϴ�.</dd>
+
+      <dt><code>--with-suexec-bin=<em>PATH</em></code></dt>
+
+      <dd><code>suexec</code> ���̳ʸ� ��δ� ���Ȼ� ������
+      ������ ��ϵǾ� �Ѵ�. ��� �⺻���� �����Ϸ��� �� �ɼ���
+      ����Ѵ�. <em>���� ���</em>
+      <code>--with-suexec-bin=/usr/sbin/suexec</code></dd>
+
+      <dt><code>--with-suexec-caller=<em>UID</em></code></dt>
+
+      <dd>���� ����ġ�� �����ϴ� <a href="mod/mpm_common.html#user">����ڸ�</a>. ���α׷���
+      ������ �� �ִ� ������ ����ڴ�.</dd>
+
+      <dt><code>--with-suexec-userdir=<em>DIR</em></code></dt>
+
+      <dd>suEXEC ������ ���Ǵ� ����� Ȩ���丮�� �������丮��
+      �����Ѵ�. �� ���丮�� �ִ� ��� ���������� �������
+      suEXEC�� ����Ƿ�, ��� ���α׷��� "�����ؾ�" �Ѵ�. (����
+      ���, ���� "*"�� ����) "������" UserDir ���þ ����Ѵٸ�
+      ���� ���� �����ؾ� �Ѵ�. UserDir ���þ passwd ���Ͽ�
+      ���� ����� Ȩ���丮�� �ٸ��� suEXEC�� ����������
+      �۵����� �ʴ´�. �⺻���� "public_html"�̴�.<br />
+      ����ȣ��Ʈ���� ���� �ٸ� UserDir�� ����Ѵٸ� ��� ��
+      �θ� ���丮 �ȿ� �ֵ��� �����ؾ� �ϰ�, �� �θ� ���丮����
+      ���� ���´�. <strong>�̷��� �������� ������, "~userdir"
+      cgi ��û�� �۵����� �ʴ´�!</strong></dd>
+
+      <dt><code>--with-suexec-docroot=<em>DIR</em></code></dt>
+
+      <dd>����ġ�� DocumentRoot�� �����Ѵ�. �̴� suEXEC�� �����
+      �� �ִ� (UserDirs�� ������) ������ �����̴�. �⺻ ���丮��
+      <code>--datadir</code> ���� "/htdocs"�� ���� ���̴�.
+      <em>���� ���</em> "<code>--datadir=/home/apache</code>"��
+      �����ߴٸ� suEXEC wrapper�� document root��
+      "/home/apache/htdocs" ���丮�� ����Ѵ�.</dd>
+
+      <dt><code>--with-suexec-uidmin=<em>UID</em></code></dt>
+
+      <dd>suEXEC���� ���������� ������� �ּ� UID�� �����Ѵ�.
+      ��κ��� �ý��ۿ��� 500�̳� 100�� �����ϴ�. �⺻����
+      100�̴�.</dd>
+
+      <dt><code>--with-suexec-gidmin=<em>GID</em></code></dt>
+
+      <dd>suEXEC���� ���������� �׷��� �ּ� GID�� �����Ѵ�.
+      ��κ��� �ý��ۿ��� 100�� �����ϹǷ� �� ���� �⺻���̴�.</dd>
+
+      <dt><code>--with-suexec-logfile=<em>FILE</em></code></dt>
+
+      <dd>��� suEXEC �۵��� ������ (���ó� ����� ������ ������)
+      ����� �α����ϸ��� �����Ѵ�. �⺻������ �α������� �̸���
+      "suexec_log"�̰� ǥ�� �α����� ���丮��
+      (<code>--logfiledir</code>) ��ġ�Ѵ�.</dd>
+
+      <dt><code>--with-suexec-safepath=<em>PATH</em></code></dt>
+
+      <dd>CGI �������Ͽ� �Ѱ��� ������ PATH ȯ�溯���� �����Ѵ�.
+      �⺻���� "/usr/local/bin:/usr/bin:/bin"�̴�.</dd>
+    </dl>
+
+    <p><strong>suEXEC wrapper�� �������ϰ� ��ġ�ϱ�</strong><br />
+    <code>--enable-suexec</code> �ɼ����� suEXEC ����� �����ϰ���
+    ��� <code>make</code> ��ɾ �����ϸ� <code>suexec</code>
+    ���������� (����ġ�� �Բ�) �ڵ����� ���������.<br />
+    ������ �������� �� <code>make install</code> ��ɾ
+    �����Ͽ� ��ġ�� �� �ִ�. ���̳ʸ����� <code>suexec</code>��
+    <code>--sbindir</code> �ɼ����� ������ ���丮�� ��ġ�ȴ�.
+    �⺻ ��ġ�� "/usr/local/apache2/sbin/suexec"�̴�.<br />
+    ��ġ ������ <strong><em>root ����</em></strong>�� �ʿ�����
+    �����϶�. wrapper�� ����� ID�� �����ϱ����ؼ��� �����ڰ�
+    <code><em>root</em></code>�̰� ���ϸ��� setuserid �����Ʈ��
+    �����Ǿ� �Ѵ�.</p>
+
+    <p><strong>���������� ���Ѽ���</strong><br />
+    suEXEC wrapper�� �ڽ��� ������ ����ڰ� ���� �ɼ�
+    <code>--with-suexec-caller</code>�� ������ �ùٸ� ���������
+    Ȯ���� ������, �� �˻� ������ suEXEC�� ����ϴ� �ý���ȣ��
+    Ȥ�� ���̺귯�� �Լ��� ���۵Ǿ��� �� �ִ�. �̸� ����ϸ�
+    �Ϲ������� ���� �����̹Ƿ� ���� ����ġ�� �����ϴ� �׷츸��
+    suEXEC�� ������ �� �ֵ��� ���Ͻý��� ������ �����ؾ� �Ѵ�.</p>
+
+    <p>���� ���, �������� ������ ���� �����ϰ�:</p>
+
+<div class="example"><p><code>
+    User www<br />
+    Group webgroup<br />
+</code></p></div>
+
+    <p><code>suexec</code>�� "/usr/local/apache2/sbin/suexec"��
+    ��ġ�Ͽ��ٸ�, ������ �����ؾ� �Ѵ�:</p>
+
+<div class="example"><p><code>
+    chgrp webgroup /usr/local/apache2/bin/suexec<br />
+    chmod 4750 /usr/local/apache2/bin/suexec<br />
+</code></p></div>
+
+    <p>�׷��� ���� ����ġ�� �����ϴ� �׷츸�� suEXEC wrapper��
+    ������ �� �ִ�.</p>
+</div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="enable" id="enable">suEXEC �� ���</a></h2>
+
+    <p>����ġ�� �����Ҷ� <code>--sbindir</code> �ɼ����� ������
+    ���丮���� <code>suexec</code> ������ (�⺻��
+    "/usr/local/apache2/sbin/suexec") ã�´�. ����ġ��
+    ���������� ������ suEXEC wrapper�� �߰��ϸ� ���� �α�(error
+    log)�� ������ ���� ����Ѵ�:</p>
+
+<div class="example"><p><code>
+    [notice] suEXEC mechanism enabled (wrapper: <em>/path/to/suexec</em>)
+</code></p></div>
+
+    <p>���� �����߿� �̷� ������ ���ٸ� ������ ����� ��ҿ���
+    wrapper ���α׷��� ã�� ���߰ų�, ���������� <em>setuid
+    root</em>�� ��ġ�����ʾұ� ������ ���̴�.</p>
+
+     <p>ó������ suEXEC ����� ����ϰ� �Ͱ� �̹� ����ġ ������
+     �������̶��, ����ġ�� ���̰� �ٽ� �����ؾ� �Ѵ�. ������
+     HUP�̳� USR1 �ñ׳η� ������ϴ� �����δ� ������� �ʴ�. </p>
+     <p>suEXEC�� �Ȼ���Ϸ��� <code>suexec</code> ������ ������
+     ����ġ�� ���̰� ������ؾ� �Ѵ�. </p>
+</div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="usage" id="usage">suEXEC ����ϱ�</a></h2>
+
+    <p>CGI ���α׷� ��û�� ��� <code class="directive"><a href="./mod/mod_suexec.html#suexecusergroup">SuexecUserGroup</a></code> ���þ
+    ����� ����ȣ��Ʈ�� ��û�� �Ͽ��ų� <code class="module"><a href="./mod/mod_userdir.html">mod_userdir</a></code>��
+    ��û�� ó���ϴ� ��쿡�� suEXEC wrapper�� ȣ���Ѵ�.</p>
+
+    <p><strong>����ȣ��Ʈ:</strong><br /> suEXEC wrapper��
+    ����ϴ� �Ѱ��� ����� <code class="directive"><a href="./mod/core.html#virtualhost">VirtualHost</a></code> ���ǿ� <code class="directive"><a href="./mod/mod_suexec.html#suexecusergroup">SuexecUserGroup</a></code> ���þ
+    ����ϴ� ���̴�. �� ���þ �ּ��� ����� ID�� �ٸ���
+    �����ϸ� CGI �ڿ��� ��� ��û�� <code class="directive"><a href="./mod/core.html#virtualhost">&lt;VirtualHost&gt;</a></code>����
+    ������ <em>User</em>�� <em>Group</em>���� ����ȴ�. ��
+    ���þ���� <code class="directive"><a href="./mod/core.html#virtualhost">&lt;VirtualHost&gt;</a></code>�� ������ �ּ���
+    userid�� ����Ѵ�.</p>
+
+    <p><strong>����� ���丮:</strong><br />
+     <code class="module"><a href="./mod/mod_userdir.html">mod_userdir</a></code>�� ��û�� ó���Ѵٸ� suEXEC
+     wrapper�� ȣ���Ͽ�, ��û�� ����� ���丮�� �ش��ϴ� �����
+     ID�� CGI ���α׷��� �����Ѵ�. �� ����� �����Ϸ��� �����
+     ID�� CGI�� ������ �� �ְ� ��ũ��Ʈ�� ���� <a href="#model">����
+     �˻�</a> �׸��� �����ؾ� �Ѵ�. <a href="#install">����
+     �ɼ�</a> <code>--with-suexec-userdir</code>�� �����϶�.</p> </div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="debug" id="debug">suEXEC ������ϱ�</a></h2>
+
+    <p>suEXEC wrapper�� �α� ������ ������ �ٷ�
+    <code>--with-suexec-logfile</code> �ɼ����� ������ ���Ͽ�
+    ����. wrapper�� �ùٷ� �����ϰ� ��ġ�ߴٸ� ��� �߸��Ǿ�����
+    �� �α����Ͽ� ������ error_log�� �������.</p>
+
+</div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="jabberwock" id="jabberwock">�ٽ� �ѹ� �����϶�: ���� ����</a></h2>
+
+    <p><strong>����!</strong> �� ������ �������� ���� �� �ִ�.
+    ����ġ�׷��� <a href="http://httpd.apache.org/docs/2.4/suexec.html">�¶���
+    ����</a>���� �� ������ �ֽ����� �����϶�.</p>
+
+    <p>wrapper�� ���� ������ �����ϴ� ��� ��̷ο� ���� �ִ�.
+    suEXEC�� ���õ� "����"�� �����ϱ� ���� �̵��� ���캸�� �ٶ���.</p>
+
+    <ul>
+      <li><strong>suEXEC ���� ����</strong></li>
+
+      <li>
+        ���丮 ���� ����
+
+        <p class="indent">
+          ���Ȱ� ȿ������ ���� ��� suEXEC ��û�� ����ȣ��Ʈ��
+          ��� �ֻ��� document root Ȥ�� userdir ��û�� ���
+          �ֻ��� ���� document root �ȿ��� �߻��ؾ� �Ѵ�. ����
+          ���, ����ȣ��Ʈ �װ��� �����ߴٸ� ����ȣ��Ʈ����
+          suEXEC�� �̿��ϱ����� ����ȣ��Ʈ�� document root��
+          �� ����ġ ���� �������� �ۿ� ������ �ʿ䰡 �ִ�.
+          (������ ������.)
+        </p>
+      </li>
+
+      <li>
+        suEXEC�� PATH ȯ�溯��
+
+        <p class="indent">
+          �����ϸ� ������ �� �ִ�.  ���⿡ �����ϴ� ��� ��ΰ�
+          <strong>���� �� �ִ�</strong> ���丮���� Ȯ���϶�. 
+          �� �������� �������� �װ��� �ִ� Ʈ���̸񸶸� �����ϱ�
+          ������ ���� ���̴�.
+        </p>
+      </li>
+
+      <li>
+        suEXEC �ڵ� �����ϱ�
+
+        <p class="indent">
+          �ݺ��ؼ� ��������, ����� ������ �ϴ��� �𸣰� �õ��Ѵٸ�
+          <strong>ū ����</strong>�� �߻��� �� �ִ�. � ��쿡��
+          ������������.
+        </p>
+      </li>
+    </ul>
+
+</div></div>
+<div class="bottomlang">
+<p><span>������ ���: </span><a href="./en/suexec.html" hreflang="en" rel="alternate" title="English">&nbsp;en&nbsp;</a> |
+<a href="./fr/suexec.html" hreflang="fr" rel="alternate" title="Fran&#231;ais">&nbsp;fr&nbsp;</a> |
+<a href="./ja/suexec.html" hreflang="ja" rel="alternate" title="Japanese">&nbsp;ja&nbsp;</a> |
+<a href="./ko/suexec.html" title="Korean">&nbsp;ko&nbsp;</a> |
+<a href="./tr/suexec.html" hreflang="tr" rel="alternate" title="T&#252;rk&#231;e">&nbsp;tr&nbsp;</a></p>
+</div><div class="top"><a href="#page-header"><img src="./images/up.gif" alt="top" /></a></div><div class="section"><h2><a id="comments_section" name="comments_section">Comments</a></h2><div class="warning"><strong>Notice:</strong><br />This is not a Q&amp;A section. Comments placed here should be pointed towards suggestions on improving the documentation or server, and may be removed again by our moderators if they are either implemented or considered invalid/off-topic. Questions on how to manage the Apache HTTP Server should be directed at either our IRC channel, #httpd, on Freenode, or sent to our <a href="http://httpd.apache.org/lists.html">mailing lists</a>.</div>
+<script type="text/javascript"><!--//--><![CDATA[//><!--
+var comments_shortname = 'httpd';
+var comments_identifier = 'http://httpd.apache.org/docs/2.4/suexec.html';
+(function(w, d) {
+    if (w.location.hostname.toLowerCase() == "httpd.apache.org") {
+        d.write('<div id="comments_thread"><\/div>');
+        var s = d.createElement('script');
+        s.type = 'text/javascript';
+        s.async = true;
+        s.src = 'https://comments.apache.org/show_comments.lua?site=' + comments_shortname + '&page=' + comments_identifier;
+        (d.getElementsByTagName('head')[0] || d.getElementsByTagName('body')[0]).appendChild(s);
+    }
+    else { 
+        d.write('<div id="comments_thread">Comments are disabled for this page at the moment.<\/div>');
+    }
+})(window, document);
+//--><!]]></script></div><div id="footer">
+<p class="apache">Copyright 2015 The Apache Software Foundation.<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p>
+<p class="menu"><a href="./mod/">���</a> | <a href="./mod/directives.html">���þ��</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="./glossary.html">���</a> | <a href="./sitemap.html">����Ʈ��</a></p></div><script type="text/javascript"><!--//--><![CDATA[//><!--
+if (typeof(prettyPrint) !== 'undefined') {
+    prettyPrint();
+}
+//--><!]]></script>
+</body></html>
\ No newline at end of file
diff --git a/docs/manual/suexec.html.tr.utf8 b/docs/manual/suexec.html.tr.utf8
new file mode 100644
index 0000000..b3f7ed3
--- /dev/null
+++ b/docs/manual/suexec.html.tr.utf8
@@ -0,0 +1,583 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" lang="tr" xml:lang="tr"><head>
+<meta content="text/html; charset=UTF-8" http-equiv="Content-Type" />
+<!--
+        XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+              This file is generated from xml source: DO NOT EDIT
+        XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+      -->
+<title>SuEXEC Desteği - Apache HTTP Sunucusu Sürüm 2.4</title>
+<link href="./style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" />
+<link href="./style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" />
+<link href="./style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" /><link rel="stylesheet" type="text/css" href="./style/css/prettify.css" />
+<script src="./style/scripts/prettify.min.js" type="text/javascript">
+</script>
+
+<link href="./images/favicon.ico" rel="shortcut icon" /></head>
+<body id="manual-page"><div id="page-header">
+<p class="menu"><a href="./mod/">Modüller</a> | <a href="./mod/directives.html">Yönergeler</a> | <a href="http://wiki.apache.org/httpd/FAQ">SSS</a> | <a href="./glossary.html">Terimler</a> | <a href="./sitemap.html">Site Haritası</a></p>
+<p class="apache">Apache HTTP Sunucusu Sürüm 2.4</p>
+<img alt="" src="./images/feather.gif" /></div>
+<div class="up"><a href="./"><img title="&lt;-" alt="&lt;-" src="./images/left.gif" /></a></div>
+<div id="path">
+<a href="http://www.apache.org/">Apache</a> &gt; <a href="http://httpd.apache.org/">HTTP Sunucusu</a> &gt; <a href="http://httpd.apache.org/docs/">Belgeleme</a> &gt; <a href="./">Sürüm 2.4</a></div><div id="page-content"><div id="preamble"><h1>SuEXEC Desteği</h1>
+<div class="toplang">
+<p><span>Mevcut Diller: </span><a href="./en/suexec.html" hreflang="en" rel="alternate" title="English">&nbsp;en&nbsp;</a> |
+<a href="./fr/suexec.html" hreflang="fr" rel="alternate" title="Français">&nbsp;fr&nbsp;</a> |
+<a href="./ja/suexec.html" hreflang="ja" rel="alternate" title="Japanese">&nbsp;ja&nbsp;</a> |
+<a href="./ko/suexec.html" hreflang="ko" rel="alternate" title="Korean">&nbsp;ko&nbsp;</a> |
+<a href="./tr/suexec.html" title="Türkçe">&nbsp;tr&nbsp;</a></p>
+</div>
+
+    <p><strong>SuEXEC</strong> özelliği, Apache HTTP Sunucusu kullanıcılarına
+      <strong>CGI</strong> ve <strong>SSI</strong> programlarını sunucunun
+      aidiyetinde çalıştığı kullanıcıdan farklı bir kullanıcının aidiyetinde
+      çalıştırma olanağı verir. Normalde, <strong>CGI</strong> ve
+      <strong>SSI</strong> programlarını çalıştıranla sunucuyu çalıştıran
+      aynı kullanıcıdır.</p>
+
+    <p>Gerektiği gibi kullanıldığında bu özellik, kullanıcılara
+      <strong>CGI</strong> ve <strong>SSI</strong> programlarını çalıştırma
+      ve geliştirmeye izin vermekle ortaya çıkan güvenlik risklerini azaltır.
+      Bununla birlikte, <strong>suEXEC</strong> gerektiği gibi
+      yapılandırılmadığı takdirde bazı sorunlara yol açabilir ve bilgisayar
+      güvenliğinizde yeni delikler ortaya çıkmasına sebep olabilir.
+      Güvenlikle ilgili mevcut sorunlarla başa çıkmada ve <em>setuid
+      root</em> programları yönetmekte bilgi ve deneyim sahibi değilseniz
+      <strong>suEXEC</strong> kullanmayı kesinlikle düşünmemenizi
+      öneririz.</p>
+  </div>
+<div id="quickview"><ul id="toc"><li><img alt="" src="./images/down.gif" /> <a href="#before">Başlamadan önce</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#model">SuEXEC Güvenlik Modeli</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#install">suEXEC’in Yapılandırılması ve Kurulumu</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#enable">suEXEC’in etkin kılınması ve iptal edilmesi</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#usage">SuEXEC’in kullanımı</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#debug">SuEXEC ve hata ayıklama</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#jabberwock">Uyarılar ve Örnekler</a></li>
+</ul><ul class="seealso"><li><a href="#comments_section">Yorum</a></li></ul></div>
+<div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="before" id="before">Başlamadan önce</a></h2>
+
+    <p>Belgeye balıklama dalmadan önce, suexec'i kullanacağınız ortam ve
+      kendiniz hakkında yapılmış çeşitli kabuller hakkında bilgi sahibi
+      olmalısınız.</p>
+
+    <p>Öncelikle, üzerinde <strong>setuid</strong> va <strong>setgid</strong>
+      işlemlerinin yapılabildiği Unix türevi bir işletim sistemi
+      kullandığınızı varsayıyoruz. Tüm komut örnekleri buna dayanarak
+      verilmiştir. Bu desteğe sahip başka platformlar varsa onlardaki
+      yapılandırma burada anlattığımız yapılandırmadan farklı olabilir.</p>
+
+    <p>İkinci olarak, bilgisayarınızın güvenliği ve yönetimi ile ilgili bazı
+      temel kavramları bildiğinizi kabul ediyoruz. Buna
+      <strong>setuid/setgid</strong> işlemlerinin sisteminiz ve güvenlik
+      seviyesi üzerindeki etkilerini bilmek dahildir.</p>
+
+    <p>Üçüncü olarak, <strong>suEXEC</strong> kodunun
+      <strong>değiştirilmemiş</strong> bir sürümünü kullandığınızı
+      varsayıyoruz. Tüm suEXEC kodu, geliştiricilerin yanında sayısız beta
+      kullanıcısı tarafından dikkatle incelenmiş ve denenmiştir. Kodların hem
+      basit hem de sağlam bir şekilde güvenli olması için gerekli tüm
+      önlemler alınmıştır. Bu kodun değiştirilmesi beklenmedik sorunlara ve
+      yeni güvenlik risklerine yol açabilir. Özellikle güvenlikle ilgili
+      programlarda deneyimli değilseniz suEXEC kodunda kesinlikle bir
+      değişiklik yapmamalısınız. Değişiklik yaparsanız kodlarınızı gözden
+      geçirmek ve tartışmak üzere Apache HTTP Sunucusu geliştirme ekibi ile
+      paylaşmanızı öneririz.</p>
+
+    <p>Dördüncü ve son olarak, Apache HTTP Sunucusu geliştirme ekibinin
+      suEXEC’i öntanımlı httpd kurulumunun bir parçası yapmama kararından
+      bahsetmek gerekir. Bunun sonucu olarak, suEXEC yapılandırması sistem
+      yöneticisinin ayrıntılı bir incelemesini gerektirir. Gerekli incelemeden
+      sonra yönetici tarafından suEXEC yapılandırma seçeneklerine karar
+      verilip, normal yollardan sisteme kurulumu yapılır. Bu seçeneklerin
+      belirlenmesi, suEXEC işlevselliğinin kullanımı sırasında sistem
+      güvenliğini gerektiği gibi sağlamak için yönetici tarafından dikkatle
+      saptanmayı gerektirir. Bu sürecin ayrıntılarının yöneticiye bırakılma
+      sebebi, suEXEC kurulumunu, suEXEC’i dikkatle kullanacak yeterliliğe sahip
+      olanlarla sınırlama  beklentimizdir.</p>
+
+    <p>Hala bizimle misiniz? Evet mi? Pekala, o halde devam!</p>
+</div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="model" id="model">SuEXEC Güvenlik Modeli</a></h2>
+
+    <p>SuEXEC yapılandırması ve kurulumuna girişmeden önce biraz da
+      gerçekleşmesini istediğiniz güvenlik modelinin ayrıntıları üzerinde
+      duralım. Böylece, suEXEC’in içinde olup bitenleri ve sisteminizin
+      güvenliği için alınacak önlemleri daha iyi anlayabilirsiniz.</p>
+
+    <p><strong>suEXEC</strong> işlevselliği, Apache HTTP Sunucusu tarafından
+      gerektiği takdirde artalanda çalıştırılan bir setuid programa dayanır.
+      Bu program, bir CGI veya SSI betiğine bir HTTP isteği yapıldığı zaman,
+      bu betiği, yöneticinin ana sunucunun aidiyetinde çalıştığı kullanıcıdan
+      farklı olarak seçtiği bir kullanıcının aidiyetinde çalıştırmak için
+      çağrılır. Böyle bir istek geldiğinde, Apache httpd artalandaki setuid
+      programına, HTTP isteği yapılan programın ismiyle beraber aidiyetinde
+      çalışacağı kullanıcı ve grup kimliklerini de aktarır.</p>
+
+    <p>Artalanda çalıştırılan setuid program başarıyı ve başarısızlığı
+      aşağıdaki süreci izleyerek saptar. Bunlardan herhangi biri başarısız
+      olursa program başarısızlık durumunu günlüğe kaydeder ve bir hata
+      vererek çıkar. Aksi takdirde çalışmaya devam eder.</p>
+
+    <ol>
+      <li>
+        <strong>Setuid programı çalıştıran kullanıcı sistemin geçerli
+        kullanıcılarından biri mi?</strong>
+
+        <p class="indent">Bu, setuid programı çalıştıran kullanıcının
+        sistemin gerçek bir kullanıcısı olduğunudan emin olunmasını sağlar.
+        </p>
+     </li>
+
+     <li>
+        <strong>Setuid program yeterli sayıda argümanla çağrılmış mı?
+        </strong>
+
+        <p class="indent">Apache HTTP Sunucusunun artalanda çağırdığı
+          setuid program ancak yeterli sayıda argüman sağlandığı takdirde
+          çalışacaktır. Argümanların sayısını ve sırasını Apache HTTP sunucusu
+          bilir. Eğer setuid program yeterli sayıda argümanla çağrılmamışsa
+          ya kendisinde bir değişiklik yapılmıştır ya da kurulu Apache httpd
+          çalıştırılabilirinin suEXEC ile ilgili kısmında yanlış giden bir
+          şeyler vardır.</p>
+      </li>
+
+      <li>
+        <strong>Bu geçerli kullanıcının bu setuid programı çalıştırma
+          yetkisi var mı?</strong>
+
+        <p class="indent">Sadece tek bir kullanıcı (Apache’nin aidiyetinde
+          çalıştığı kullanıcı) bu programı çalıştırmaya yetkilidir.</p>
+      </li>
+
+      <li>
+        <strong>Hedef CGI veya SSI programı hiyerarşik olarak güvenliği
+          bozacak bir dosya yolu üzerinde mi?</strong>
+
+        <p class="indent">Hedef CGI veya SSI programının dosya yolu '/' veya
+          '..' ile başlıyor  mu? Buna izin verilmez. Hedef CGI veya SSI
+          programı suEXEC’in belge kök dizininde yer almalıdır (aşağıda
+          <code>--with-suexec-docroot=<em>DİZİN</em></code> seçeneğine
+          bakınız).</p>
+      </li>
+
+      <li>
+        <strong>Hedef kullanıcı ismi geçerli mi?</strong>
+
+        <p class="indent">Hedef kullanıcı mevcut mu?</p>
+      </li>
+
+      <li>
+        <strong>Hedef grup ismi geçerli mi?</strong>
+
+        <p class="indent">Hedef grup mevcut mu?</p>
+      </li>
+
+      <li>
+        <strong>Hedef kullanıcı <code>root</code> değil, değil mi?</strong>
+
+        <p class="indent">Mevcut durumda, <code>root</code> kullanıcısının
+          CGI/SSI programlarını çalıştırmasına izin verilmemektedir.</p>
+      </li>
+
+      <li>
+        <strong>Hedef kullanıcı kimliği asgari kullanıcı numarasından
+          <em>BÜYÜK</em> mü?</strong>
+
+        <p class="indent">Asgari kullanıcı numarası yapılandırma sırasında
+          belirtilir. Böylece CGI/SSI programlarını çalıştırmasına izin
+          verilecek olası en düşük kullanıcı numarasını belirlemeniz mümkün
+          kılınmıştır. Bu bazı “sistem” hesaplarını devreden çıkarmak için
+          yararlıdır.</p>
+      </li>
+
+      <li>
+        <strong>Hedef grup <code>root</code>  değil, değil mi?</strong>
+
+        <p class="indent"><code>root</code> grubunun CGI/SSI
+          programlarını çalıştırmasına izin verilmemektedir.</p>
+      </li>
+
+      <li>
+        <strong>Hedef grup numarası asgari grup numarasından
+          <em>BÜYÜK</em> mü?</strong>
+
+        <p class="indent">Asgari grup numarası yapılandırma sırasında
+          belirtilir. Böylece CGI/SSI programlarını çalıştırmasına izin
+          verilecek olası en düşük grup numarasını belirlemeniz mümkün
+          kılınmıştır. Bu bazı “sistem” hesaplarını devreden çıkarmak için
+          yararlıdır.</p>
+      </li>
+
+      <li>
+        <strong>Apache’nin artalanda çağırdığı setuid program hedef
+          kullanıcı ve grubun aidiyetine geçebildi mi?</strong>
+
+        <p class="indent">Bu noktadan itibaren program setuid ve setgid
+          çağrıları üzerinden hedef kullanıcı ve grubun aidiyetine geçer.
+          Erişim grubu listesi de ayrıca kullanıcının üyesi olduğu tüm
+          gruplara genişletilir.</p>
+      </li>
+
+      <li>
+        <strong>Hedef CGI/SSI programının bulunduğu dizine geçebildik mi?
+        </strong>
+
+        <p class="indent">Dizin mevcut değilse dosyaları da içeremez. Hedef
+          dizine geçemiyorsak bu, dizin mevcut olmadığından olabilir.</p>
+      </li>
+
+      <li>
+        <strong>Hedef dizin Apache için izin verilen yerlerden biri mi?
+        </strong>
+
+        <p class="indent">İstek sunucunun normal bir bölümü için yapılmış
+          olsa da istenen dizin acaba suEXEC’in belge kök dizini altında mı?
+          Yani, istenen dizin, suEXEC’in aidiyetinde çalıştığı kullanıcının
+          ev dizini altında bulunan, <code class="directive"><a href="./mod/mod_userdir.html#userdir">UserDir</a></code> ile belirtilen dizinin altında mı? (<a href="#install">suEXEC’in yapılandırma seçeneklerine</a>
+          bakınız).</p>
+      </li>
+
+      <li>
+        <strong>Hedef dizin başkaları tarafından yazılabilen bir dizin değil,
+          değil mi?</strong>
+
+        <p class="indent">Başkaları da yazabilsin diye bir dizin açmıyoruz;
+          dizin içeriğini sadece sahibi değiştirebilmelidir.</p>
+      </li>
+
+      <li>
+        <strong>Hedef CGI/SSI programı mevcut mu?</strong>
+
+        <p class="indent">Mevcut değilse çalıştırılamaz.</p>
+      </li>