Merge ~ahasenack/ubuntu/+source/apache2:bionic-balance-member-hostname-1750356 into ubuntu/+source/apache2:ubuntu/bionic-devel

[Andreas Hasenack]

Please use git to review the changes, as the LP diff in this MP is incorrect for some reason.

Apply upstream patches (from 2.4.30) to Bionic's 2.4.29 apache to address long hostnames used in proxy balancer members in the following way:
- provide a new attribute in the proxy structure that can hold a longer hostname. Modules that are aware of it can use this attribute
- if the hostname is still too long, truncate it and log a warning instead of causing a fatal error.

I didn't change the MODULE_MAGIC_NUMBER_MINOR define, see comments https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/1750356/comments/5 through https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/1750356/comments/7.

The bug has the SRU template filled out and a testing procedure.

qa-regression-testing tests for apache2 passed: https://pastebin.ubuntu.com/p/nZ6GGHXgwQ/

[Christian Ehrhardt  (paelzer)]

Hi,
LGTM in general.
Patches look ok as taken from upstream - it is ok that we don't change the upstream STATUS/Changelog.
Packaging Changelog seems ok to me (it would fit in three lines without too early line breaks, but that isn't important)

I agree to the magic number decision, as we would have to get all other changes up to 75 in to really announce that.

The log message before also was already clear:
  BalancerMember worker hostname (xxxxx...xxxx) too long
So I'm not sure how much that is more a feature than a backport, were there earlier versions of apache in which this worked.
But this would be for the SRU Team to decide, from the code/packaging alone it LGTM.

I also tested the steps to reproduce and can confirm the issue and the fix.

The one thing I have to nack is that maybe we an Author tag on the patches?
Usually in git-format-patch exports we have the Author listed, which is why we don't need to add it in our dep-3 tags.
But in the svn export of apache2 there is no Author - I think legally you are supposed to add something when adding them - could you find the Authors name and add it?

So you are at +0.95 just missing the Author statement in the patches I'd think.

review: Needs Fixing

[Andreas Hasenack (ahasenack)]

I didn't add Author because I couldn't figure out who it was that authored the patch:
- svn has nicknames, not names + emails
- DEP3 says that Author is optional if Origin is given, and in this case Origin is pointing straight at svn merges/commits
- trunk and stable tree have different svn nicknames as their authors, complicating the authorship a bit more
- I fear more giving wrong authorship than not giving one

If you still think Author is warranted, I'll do some research and come up with one.

[Christian Ehrhardt  (paelzer)]

>
> If you still think Author is warranted, I'll do some research and come up
> with one.
>

Sure - you have my +1 if it can not be found - once you have exceeded 10
minutes it certainly isn't worth anymore.

[Christian Ehrhardt  (paelzer)]

review: Approve

[Robie Basak (racb)]

Blocked on previous SRU clearing but otherwise ready for upload.

[Andreas Hasenack (ahasenack)]

The previous SRU is done, if someone could push the upload tag I can then dput this package. Thanks.

[Andreas Hasenack (ahasenack)]

Thanks, uploaded.

diff --git a/debian/changelog b/debian/changelog
index e81196b..58eefae 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,12 @@
+apache2 (2.4.29-1ubuntu4.3) bionic; urgency=medium
+
+  * d/p/balance-member-long-hostname-part{1,2}.patch: Provide an RFC1035
+    compliant version of the hostname in the
+    proxy_worker_shared structure. A hostname that is too long is no longer a
+    fatal error. (LP: #1750356)
+
+ -- Andreas Hasenack <[e-mail]>  Wed, 27 Jun 2018 14:05:04 -0300
+
 apache2 (2.4.29-1ubuntu4.2) bionic; urgency=medium
 
   * debian/patches/includeoptional-ignore-non-existent.patch: silently
diff --git a/debian/patches/balance-member-long-hostname-part1.patch b/debian/patches/balance-member-long-hostname-part1.patch
new file mode 100644
index 0000000..eb389a3
--- /dev/null
+++ b/debian/patches/balance-member-long-hostname-part1.patch
@@ -0,0 +1,30 @@
+Description: Too long hostnames and schemes are no longer fatal errors
+ proxy_util: Schemes and hostnames that are "too long" are
+ no longer automatically fatal errors but are instead logged
+ and truncated, at which point the admin can determine if that
+ is OK or not.
+ trunk patch: http://svn.apache.org/r1823482
+ +1: jim, minfrin, rpluem
+Origin: upstream, http://svn.apache.org/viewvc?view=revision&revision=1824455
+Bug: https://bz.apache.org/bugzilla/show_bug.cgi?id=62085
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/1750356
+Last-Update: 2018-06-27
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+--- 2.4.x/modules/proxy/proxy_util.c	2018/02/16 12:31:28	1824454
++++ 2.4.x/modules/proxy/proxy_util.c	2018/02/16 12:35:03	1824455
+@@ -1691,10 +1691,12 @@
+         "Alert! worker name (%s) too long; truncated to: %s", ptr, wshared->name);
+     }
+     if (PROXY_STRNCPY(wshared->scheme, uri.scheme) != APR_SUCCESS) {
+-        return apr_psprintf(p, "worker scheme (%s) too long", uri.scheme);
++        ap_log_error(APLOG_MARK, APLOG_ERR, 0, ap_server_conf, APLOGNO(010117)
++        "Alert! worker scheme (%s) too long; truncated to: %s", uri.scheme, wshared->scheme);
+     }
+     if (PROXY_STRNCPY(wshared->hostname, uri.hostname) != APR_SUCCESS) {
+-        return apr_psprintf(p, "worker hostname (%s) too long", uri.hostname);
++        ap_log_error(APLOG_MARK, APLOG_ERR, 0, ap_server_conf, APLOGNO(010118)
++        "Alert! worker hostname (%s) too long; truncated to: %s", uri.hostname, wshared->hostname);
+     }
+     wshared->flush_packets = flush_off;
+     wshared->flush_wait = PROXY_FLUSH_WAIT;
diff --git a/debian/patches/balance-member-long-hostname-part2.patch b/debian/patches/balance-member-long-hostname-part2.patch
new file mode 100644
index 0000000..dc1b1ab
--- /dev/null
+++ b/debian/patches/balance-member-long-hostname-part2.patch
@@ -0,0 +1,430 @@
+Description: Provide an RFC1035 compliant version of the hostname
+ mod_proxy: Provide an RFC1035 compliant version of the hostname in the
+ proxy_worker_shared structure. PR62085
+ .
+ Tone down the message that worker hostname is too long noting it only
+ affects legacy modules not yet using hostname_ex.
+ .
+ Set the notice when hostname is too long for legacy proxy modules to info level.
+ .
+ Submitted by: minfrin
+ Reviewed by: minfrin, jim, ylavic
+ .
+ Modified in Ubuntu to not change MODULE_MAGIC_NUMBER_MINOR in include/ap_mmn.h
+Origin: upstream, http://svn.apache.org/viewvc?view=revision&revision=1824504
+Bug: https://bz.apache.org/bugzilla/show_bug.cgi?id=62085
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/1750356
+Last-Update: 2018-06-27
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+--- 2.4.x/include/ap_mmn.h	2018/02/16 14:58:32	1824503
++++ 2.4.x/include/ap_mmn.h	2018/02/16 15:04:41	1824504
+@@ -496,6 +496,7 @@
+  *                          to ap_[r]getline()
+  * 20120211.68 (2.4.26-dev) Add ap_get_basic_auth_components() and deprecate
+  *                          ap_get_basic_auth_pw()
++ * 20120211.75 (2.4.30-dev) Add hostname_ex to proxy_worker_shared
+  */
+ 
+ #define MODULE_MAGIC_COOKIE 0x41503234UL /* "AP24" */
+--- 2.4.x/modules/proxy/balancers/mod_lbmethod_heartbeat.c	2018/02/16 14:58:32	1824503
++++ 2.4.x/modules/proxy/balancers/mod_lbmethod_heartbeat.c	2018/02/16 15:04:41	1824504
+@@ -300,7 +300,7 @@
+ 
+     for (i = 0; i < balancer->workers->nelts; i++) {
+         worker = &APR_ARRAY_IDX(balancer->workers, i, proxy_worker *);
+-        server = apr_hash_get(servers, (*worker)->s->hostname, APR_HASH_KEY_STRING);
++        server = apr_hash_get(servers, (*worker)->s->hostname_ex, APR_HASH_KEY_STRING);
+ 
+         if (!server) {
+             ap_log_rerror(APLOG_MARK, APLOG_DEBUG, rv, r, APLOGNO(01214)
+--- 2.4.x/modules/proxy/mod_proxy.c	2018/02/16 14:58:32	1824503
++++ 2.4.x/modules/proxy/mod_proxy.c	2018/02/16 15:04:41	1824504
+@@ -2838,7 +2838,7 @@
+             char fbuf[50];
+             if (!(flags & AP_STATUS_SHORT)) {
+                 ap_rvputs(r, "<tr>\n<td>", (*worker)->s->scheme, "</td>", NULL);
+-                ap_rvputs(r, "<td>", (*worker)->s->hostname, "</td><td>", NULL);
++                ap_rvputs(r, "<td>", (*worker)->s->hostname_ex, "</td><td>", NULL);
+                 ap_rvputs(r, ap_proxy_parse_wstatus(r->pool, *worker), NULL);
+                 ap_rvputs(r, "</td><td>", (*worker)->s->route, NULL);
+                 ap_rvputs(r, "</td><td>", (*worker)->s->redirect, NULL);
+@@ -2930,7 +2930,8 @@
+             ap_proxy_define_worker(p, &forward, NULL, NULL, "http://www.apache.org", 0);
+             conf->forward = forward;
+             PROXY_STRNCPY(conf->forward->s->name,     "proxy:forward");
+-            PROXY_STRNCPY(conf->forward->s->hostname, "*");
++            PROXY_STRNCPY(conf->forward->s->hostname, "*"); /* for compatibility */
++            PROXY_STRNCPY(conf->forward->s->hostname_ex, "*");
+             PROXY_STRNCPY(conf->forward->s->scheme,   "*");
+             conf->forward->hash.def = conf->forward->s->hash.def =
+                 ap_proxy_hashfunc(conf->forward->s->name, PROXY_HASHFUNC_DEFAULT);
+@@ -2947,7 +2948,8 @@
+         if (!reverse) {
+             ap_proxy_define_worker(p, &reverse, NULL, NULL, "http://www.apache.org", 0);
+             PROXY_STRNCPY(reverse->s->name,     "proxy:reverse");
+-            PROXY_STRNCPY(reverse->s->hostname, "*");
++            PROXY_STRNCPY(reverse->s->hostname, "*"); /* for compatibility */
++            PROXY_STRNCPY(reverse->s->hostname_ex, "*");
+             PROXY_STRNCPY(reverse->s->scheme,   "*");
+             reverse->hash.def = reverse->s->hash.def =
+                 ap_proxy_hashfunc(reverse->s->name, PROXY_HASHFUNC_DEFAULT);
+--- 2.4.x/modules/proxy/mod_proxy.h	2018/02/16 14:58:32	1824503
++++ 2.4.x/modules/proxy/mod_proxy.h	2018/02/16 15:04:41	1824504
+@@ -354,6 +354,8 @@
+ #define PROXY_BALANCER_MAX_HOSTNAME_SIZE PROXY_WORKER_MAX_HOSTNAME_SIZE
+ #define PROXY_BALANCER_MAX_STICKY_SIZE  64
+ 
++#define PROXY_RFC1035_HOSTNAME_SIZE	256
++
+ /* RFC-1035 mentions limits of 255 for host-names and 253 for domain-names,
+  * dotted together(?) this would fit the below size (+ trailing NUL).
+  */
+@@ -384,7 +386,7 @@
+ typedef struct {
+     char      name[PROXY_WORKER_MAX_NAME_SIZE];
+     char      scheme[PROXY_WORKER_MAX_SCHEME_SIZE];   /* scheme to use ajp|http|https */
+-    char      hostname[PROXY_WORKER_MAX_HOSTNAME_SIZE];  /* remote backend address */
++    char      hostname[PROXY_WORKER_MAX_HOSTNAME_SIZE];  /* remote backend address (deprecated, use hostname_ex below) */
+     char      route[PROXY_WORKER_MAX_ROUTE_SIZE];     /* balancing route */
+     char      redirect[PROXY_WORKER_MAX_ROUTE_SIZE];  /* temporary balancing redirection route */
+     char      flusher[PROXY_WORKER_MAX_SCHEME_SIZE];  /* flush provider used by mod_proxy_fdpass */
+@@ -444,6 +446,7 @@
+     hcmethod_t      method;     /* method to use for health check */
+     apr_interval_time_t interval;
+     char      upgrade[PROXY_WORKER_MAX_SCHEME_SIZE];/* upgrade protocol used by mod_proxy_wstunnel */
++    char      hostname_ex[PROXY_RFC1035_HOSTNAME_SIZE];  /* RFC1035 compliant version of the remote backend address */
+ } proxy_worker_shared;
+ 
+ #define ALIGNED_PROXY_WORKER_SHARED_SIZE (APR_ALIGN_DEFAULT(sizeof(proxy_worker_shared)))
+--- 2.4.x/modules/proxy/mod_proxy_ajp.c	2018/02/16 14:58:32	1824503
++++ 2.4.x/modules/proxy/mod_proxy_ajp.c	2018/02/16 15:04:41	1824504
+@@ -213,7 +213,7 @@
+         ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(00868)
+                       "request failed to %pI (%s)",
+                       conn->worker->cp->addr,
+-                      conn->worker->s->hostname);
++                      conn->worker->s->hostname_ex);
+         if (status == AJP_EOVERFLOW)
+             return HTTP_BAD_REQUEST;
+         else if  (status == AJP_EBAD_METHOD) {
+@@ -297,7 +297,7 @@
+                 ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(00876)
+                               "send failed to %pI (%s)",
+                               conn->worker->cp->addr,
+-                              conn->worker->s->hostname);
++                              conn->worker->s->hostname_ex);
+                 /*
+                  * It is fatal when we failed to send a (part) of the request
+                  * body.
+@@ -337,7 +337,7 @@
+         ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(00878)
+                       "read response failed from %pI (%s)",
+                       conn->worker->cp->addr,
+-                      conn->worker->s->hostname);
++                      conn->worker->s->hostname_ex);
+ 
+         /* If we had a successful cping/cpong and then a timeout
+          * we assume it is a request that cause a back-end timeout,
+@@ -635,7 +635,7 @@
+         ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(00892)
+                       "got response from %pI (%s)",
+                       conn->worker->cp->addr,
+-                      conn->worker->s->hostname);
++                      conn->worker->s->hostname_ex);
+ 
+         if (conf->error_override && ap_is_HTTP_ERROR(r->status)) {
+             /* clear r->status for override error, otherwise ErrorDocument
+@@ -659,7 +659,7 @@
+         ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(00893)
+                       "dialog to %pI (%s) failed",
+                       conn->worker->cp->addr,
+-                      conn->worker->s->hostname);
++                      conn->worker->s->hostname_ex);
+         /*
+          * If we already send data, signal a broken backend connection
+          * upwards in the chain.
+@@ -794,7 +794,7 @@
+                 backend->close = 1;
+                 ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(00897)
+                               "cping/cpong failed to %pI (%s)",
+-                              worker->cp->addr, worker->s->hostname);
++                              worker->cp->addr, worker->s->hostname_ex);
+                 status = HTTP_SERVICE_UNAVAILABLE;
+                 retry++;
+                 continue;
+--- 2.4.x/modules/proxy/mod_proxy_balancer.c	2018/02/16 14:58:32	1824503
++++ 2.4.x/modules/proxy/mod_proxy_balancer.c	2018/02/16 15:04:41	1824504
+@@ -452,7 +452,7 @@
+             (*worker)->s->status &= ~PROXY_WORKER_IN_ERROR;
+             ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01165)
+                          "%s: Forcing recovery for worker (%s)",
+-                         balancer->s->name, (*worker)->s->hostname);
++                         balancer->s->name, (*worker)->s->hostname_ex);
+         }
+     }
+ }
+@@ -1469,7 +1469,7 @@
+                           "</httpd:name>\n", NULL);
+                 ap_rvputs(r, "          <httpd:scheme>", worker->s->scheme,
+                           "</httpd:scheme>\n", NULL);
+-                ap_rvputs(r, "          <httpd:hostname>", worker->s->hostname,
++                ap_rvputs(r, "          <httpd:hostname>", worker->s->hostname_ex,
+                           "</httpd:hostname>\n", NULL);
+                 ap_rprintf(r, "          <httpd:loadfactor>%.2f</httpd:loadfactor>\n",
+                           (float)(worker->s->lbfactor)/100.0);
+--- 2.4.x/modules/proxy/mod_proxy_hcheck.c	2018/02/16 14:58:32	1824503
++++ 2.4.x/modules/proxy/mod_proxy_hcheck.c	2018/02/16 15:04:41	1824504
+@@ -416,7 +416,7 @@
+                                "OPTIONS * HTTP/1.0\r\n"
+                                "Host: %s:%d\r\n"
+                                "\r\n",
+-                               hc->s->hostname, (int)hc->s->port);
++                               hc->s->hostname_ex, (int)hc->s->port);
+             break;
+ 
+         case HEAD:
+@@ -434,7 +434,7 @@
+                                (wctx->path ? wctx->path : ""),
+                                (wctx->path && *hc->s->hcuri ? "/" : "" ),
+                                (*hc->s->hcuri ? hc->s->hcuri : ""),
+-                               hc->s->hostname, (int)hc->s->port);
++                               hc->s->hostname_ex, (int)hc->s->port);
+             break;
+ 
+         default:
+@@ -461,12 +461,13 @@
+                                 : ap_proxy_port_of_scheme(worker->s->scheme));
+         ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, ctx->s, APLOGNO(03248)
+                      "Creating hc worker %pp for %s://%s:%d",
+-                     worker, worker->s->scheme, worker->s->hostname,
++                     worker, worker->s->scheme, worker->s->hostname_ex,
+                      (int)port);
+ 
+         ap_proxy_define_worker(ctx->p, &hc, NULL, NULL, worker->s->name, 0);
+         apr_snprintf(hc->s->name, sizeof hc->s->name, "%pp", worker);
+-        PROXY_STRNCPY(hc->s->hostname, worker->s->hostname);
++        PROXY_STRNCPY(hc->s->hostname, worker->s->hostname); /* for compatibility */
++        PROXY_STRNCPY(hc->s->hostname_ex, worker->s->hostname_ex);
+         PROXY_STRNCPY(hc->s->scheme,   worker->s->scheme);
+         PROXY_STRNCPY(hc->s->hcuri,    worker->s->hcuri);
+         PROXY_STRNCPY(hc->s->hcexpr,   worker->s->hcexpr);
+@@ -498,7 +499,7 @@
+                                 : ap_proxy_port_of_scheme(worker->s->scheme));
+         ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, ctx->s, APLOGNO(03311)
+                      "Updating hc worker %pp for %s://%s:%d",
+-                     worker, worker->s->scheme, worker->s->hostname,
++                     worker, worker->s->scheme, worker->s->hostname_ex,
+                      (int)port);
+         hc->s->method = worker->s->method;
+         create_hcheck_req(wctx, hc, ctx->p);
+@@ -519,12 +520,12 @@
+         *addr = worker->cp->addr;
+     }
+     else {
+-        rv = apr_sockaddr_info_get(addr, worker->s->hostname,
++        rv = apr_sockaddr_info_get(addr, worker->s->hostname_ex,
+                                    APR_UNSPEC, worker->s->port, 0, p);
+         if (rv != APR_SUCCESS) {
+             ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, ctx->s, APLOGNO(03249)
+                          "DNS lookup failure for: %s:%d",
+-                         worker->s->hostname, (int)worker->s->port);
++                         worker->s->hostname_ex, (int)worker->s->port);
+         }
+     }
+     return (rv == APR_SUCCESS ? OK : !OK);
+@@ -579,7 +580,7 @@
+     status = ap_proxy_acquire_connection(proxy_function, backend, hc, ctx->s);
+     if (status == OK) {
+         (*backend)->addr = hc->cp->addr;
+-        (*backend)->hostname = hc->s->hostname;
++        (*backend)->hostname = hc->s->hostname_ex;
+         if (strcmp(hc->s->scheme, "https") == 0) {
+             if (!ap_proxy_ssl_enable(NULL)) {
+                 ap_log_error(APLOG_MARK, APLOG_WARNING, 0, ctx->s, APLOGNO(03252)
+--- 2.4.x/modules/proxy/mod_proxy_http.c	2018/02/16 14:58:32	1824503
++++ 2.4.x/modules/proxy/mod_proxy_http.c	2018/02/16 15:04:41	1824504
+@@ -1973,7 +1973,7 @@
+                 backend->close = 1;
+                 ap_log_rerror(APLOG_MARK, APLOG_INFO, status, r, APLOGNO(01115)
+                               "HTTP: 100-Continue failed to %pI (%s)",
+-                              worker->cp->addr, worker->s->hostname);
++                              worker->cp->addr, worker->s->hostname_ex);
+                 retry++;
+                 continue;
+             } else {
+--- 2.4.x/modules/proxy/proxy_util.c	2018/02/16 14:58:32	1824503
++++ 2.4.x/modules/proxy/proxy_util.c	2018/02/16 15:04:41	1824504
+@@ -1694,9 +1694,13 @@
+         ap_log_error(APLOG_MARK, APLOG_ERR, 0, ap_server_conf, APLOGNO(010117)
+         "Alert! worker scheme (%s) too long; truncated to: %s", uri.scheme, wshared->scheme);
+     }
++    if (PROXY_STRNCPY(wshared->hostname_ex, uri.hostname) != APR_SUCCESS) {
++        return apr_psprintf(p, "worker hostname (%s) too long", uri.hostname);
++    }
+     if (PROXY_STRNCPY(wshared->hostname, uri.hostname) != APR_SUCCESS) {
+-        ap_log_error(APLOG_MARK, APLOG_ERR, 0, ap_server_conf, APLOGNO(010118)
+-        "Alert! worker hostname (%s) too long; truncated to: %s", uri.hostname, wshared->hostname);
++        ap_log_error(APLOG_MARK, APLOG_INFO, 0, ap_server_conf, APLOGNO(010118)
++        "worker hostname (%s) too long; truncated for legacy modules that do not use "
++        "proxy_worker_shared->hostname_ex: %s", uri.hostname, wshared->hostname);
+     }
+     wshared->flush_packets = flush_off;
+     wshared->flush_wait = PROXY_FLUSH_WAIT;
+@@ -1854,7 +1858,7 @@
+ 
+             ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(00930)
+                 "initialized pool in child %" APR_PID_T_FMT " for (%s) min=%d max=%d smax=%d",
+-                 getpid(), worker->s->hostname, worker->s->min,
++                 getpid(), worker->s->hostname_ex, worker->s->min,
+                  worker->s->hmax, worker->s->smax);
+ 
+             /* Set the acquire timeout */
+@@ -1871,7 +1875,7 @@
+ 
+             ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(00931)
+                  "initialized single connection worker in child %" APR_PID_T_FMT " for (%s)",
+-                 getpid(), worker->s->hostname);
++                 getpid(), worker->s->hostname_ex);
+         }
+         apr_global_mutex_unlock(proxy_mutex);
+ 
+@@ -1890,7 +1894,7 @@
+         if (PROXY_WORKER_IS(worker, PROXY_WORKER_STOPPED)) {
+             ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(3305)
+                          "%s: Won't retry worker (%s): stopped",
+-                         proxy_function, worker->s->hostname);
++                         proxy_function, worker->s->hostname_ex);
+             return DECLINED;
+         }
+         if ((worker->s->status & PROXY_WORKER_IGNORE_ERRORS)
+@@ -1899,13 +1903,13 @@
+             worker->s->status &= ~PROXY_WORKER_IN_ERROR;
+             ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(00932)
+                          "%s: worker for (%s) has been marked for retry",
+-                         proxy_function, worker->s->hostname);
++                         proxy_function, worker->s->hostname_ex);
+             return OK;
+         }
+         else {
+             ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(00933)
+                          "%s: too soon to retry worker for (%s)",
+-                         proxy_function, worker->s->hostname);
++                         proxy_function, worker->s->hostname_ex);
+             return DECLINED;
+         }
+     }
+@@ -2127,7 +2131,7 @@
+         if (!PROXY_WORKER_IS_USABLE(worker)) {
+             ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(00940)
+                          "%s: disabled connection for (%s)",
+-                         proxy_function, worker->s->hostname);
++                         proxy_function, worker->s->hostname_ex);
+             return HTTP_SERVICE_UNAVAILABLE;
+         }
+     }
+@@ -2150,12 +2154,12 @@
+     if (rv != APR_SUCCESS) {
+         ap_log_error(APLOG_MARK, APLOG_ERR, rv, s, APLOGNO(00941)
+                      "%s: failed to acquire connection for (%s)",
+-                     proxy_function, worker->s->hostname);
++                     proxy_function, worker->s->hostname_ex);
+         return HTTP_SERVICE_UNAVAILABLE;
+     }
+     ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(00942)
+                  "%s: has acquired connection for (%s)",
+-                 proxy_function, worker->s->hostname);
++                 proxy_function, worker->s->hostname_ex);
+ 
+     (*conn)->worker = worker;
+     (*conn)->close  = 0;
+@@ -2170,7 +2174,7 @@
+ {
+     ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(00943)
+                 "%s: has released connection for (%s)",
+-                proxy_function, conn->worker->s->hostname);
++                proxy_function, conn->worker->s->hostname_ex);
+     connection_cleanup(conn);
+ 
+     return OK;
+@@ -2766,7 +2770,7 @@
+                              "%s: error creating Unix domain socket for "
+                              "target %s",
+                              proxy_function,
+-                             worker->s->hostname);
++                             worker->s->hostname_ex);
+                 break;
+             }
+             conn->connection = NULL;
+@@ -2779,7 +2783,7 @@
+                              "%s (%s) failed",
+                              proxy_function,
+                              conn->uds_path,
+-                             worker->s->hostname);
++                             worker->s->hostname_ex);
+                 break;
+             }
+ 
+@@ -2788,7 +2792,7 @@
+                          "%s (%s)",
+                          proxy_function,
+                          conn->uds_path,
+-                         worker->s->hostname);
++                         worker->s->hostname_ex);
+         }
+         else
+ #endif
+@@ -2802,7 +2806,7 @@
+                              "target %s",
+                              proxy_function,
+                              backend_addr->family,
+-                             worker->s->hostname);
++                             worker->s->hostname_ex);
+                 /*
+                  * this could be an IPv6 address from the DNS but the
+                  * local machine won't give us an IPv6 socket; hopefully the
+@@ -2852,7 +2856,7 @@
+             }
+             ap_log_error(APLOG_MARK, APLOG_TRACE2, 0, s,
+                          "%s: fam %d socket created to connect to %s",
+-                         proxy_function, backend_addr->family, worker->s->hostname);
++                         proxy_function, backend_addr->family, worker->s->hostname_ex);
+ 
+             if (conf->source_address_set) {
+                 local_addr = apr_pmemdup(conn->scpool, conf->source_address,
+@@ -2877,7 +2881,7 @@
+                              "%s: attempt to connect to %pI (%s) failed",
+                              proxy_function,
+                              backend_addr,
+-                             worker->s->hostname);
++                             worker->s->hostname_ex);
+                 backend_addr = backend_addr->next;
+                 continue;
+             }
+@@ -2886,7 +2890,7 @@
+                          "%s: connection established with %pI (%s)",
+                          proxy_function,
+                          backend_addr,
+-                         worker->s->hostname);
++                         worker->s->hostname_ex);
+         }
+ 
+         /* Set a timeout on the socket */
+@@ -2920,7 +2924,7 @@
+                                  "via http CONNECT through %pI (%s) failed",
+                                  proxy_function,
+                                  forward->target_host, forward->target_port,
+-                                 backend_addr, worker->s->hostname);
++                                 backend_addr, worker->s->hostname_ex);
+                     backend_addr = backend_addr->next;
+                     continue;
+                 }
+@@ -2942,7 +2946,7 @@
+                 ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(00959)
+                     "ap_proxy_connect_backend disabling worker for (%s) for %"
+                     APR_TIME_T_FMT "s",
+-                    worker->s->hostname, apr_time_sec(worker->s->retry));
++                    worker->s->hostname_ex, apr_time_sec(worker->s->retry));
+             }
+         }
+         else {
diff --git a/debian/patches/series b/debian/patches/series
index d9d8038..bb7ccb0 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -23,3 +23,5 @@ CVE-2018-1301.patch
 CVE-2018-1303.patch
 CVE-2018-1312.patch
 includeoptional-ignore-non-existent.patch
+balance-member-long-hostname-part1.patch
+balance-member-long-hostname-part2.patch
diff --git a/docs/manual/style/latex/atbeginend.sty b/docs/manual/style/latex/atbeginend.sty
new file mode 100644
index 0000000..79b555d
--- /dev/null
+++ b/docs/manual/style/latex/atbeginend.sty
@@ -0,0 +1,80 @@
+% atbeginend.sty 
+%
+% Licensed to the Apache Software Foundation (ASF) under one or more
+% contributor license agreements.  See the NOTICE file distributed with
+% this work for additional information regarding copyright ownership.
+% The ASF licenses this file to You under the Apache License, Version 2.0
+% (the "License"); you may not use this file except in compliance with
+% the License.  You may obtain a copy of the License at
+%
+%     http://www.apache.org/licenses/LICENSE-2.0
+%
+% Unless required by applicable law or agreed to in writing, software
+% distributed under the License is distributed on an "AS IS" BASIS,
+% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+% See the License for the specific language governing permissions and
+% limitations under the License.
+
+% defines
+% \BeforeBegin{environment}{code-to-execute}
+% \BeforeEnd  {environment}{code-to-execute}
+% \AfterBegin {environment}{code-to-execute}
+% \AfterEnd   {environment}{code-to-execute}
+%
+% Save \begin and \end to \BeginEnvironment and \EndEnvironment
+\let\BeginEnvironment=\begin
+\let\EndEnvironment=\end
+
+\def\IfUnDef#1{\expandafter\ifx\csname#1\endcsname\relax}
+
+% Null command needed to for \nothing{something}=.nothing.
+\def\NullCom#1{}
+
+\def\begin#1{%
+%
+% if defined \BeforeBeg for this environment, execute it
+\IfUnDef{BeforeBeg#1}\else\csname BeforeBeg#1\endcsname\fi%
+%
+%
+%
+\IfUnDef{AfterBeg#1}% This is done to skip the command for environments
+		     % which can take arguments, like multicols; YOU MUST NOT
+		     % USE \AfterBegin{...}{...} for such environments!
+	\let\SaveBegEng=\BeginEnvironment%
+\else%
+	% Start this environment
+		\BeginEnvironment{#1}%
+	% and execute code after \begin{environment}
+		\csname AfterBeg#1\endcsname%
+	% 
+	\let\SaveBegEng=\NullCom%
+\fi%
+\SaveBegEng{#1}%
+}
+
+
+\def\end#1{%
+%
+% execute code before \end{environment}
+\IfUnDef{BeforeEnd#1}\else\csname BeforeEnd#1\endcsname\fi%
+%
+% close this environment
+\EndEnvironment{#1}%
+%
+% and execute code after \begin{environment}
+\IfUnDef{AfterEnd#1}\else\csname AfterEnd#1\endcsname\fi%
+}
+
+
+%% Now, define commands
+% \BeforeBegin{environment}{code-to-execute}
+% \BeforeEnd  {environment}{code-to-execute}
+% \AfterBegin {environment}{code-to-execute}
+% \AfterEnd   {environment}{code-to-execute}
+
+\def\BeforeBegin#1#2{\expandafter\gdef\csname BeforeBeg#1\endcsname
+{#2}}
+\def\BeforeEnd  #1#2{\expandafter\gdef\csname BeforeEnd#1\endcsname
+{#2}}
+\def\AfterBegin #1#2{\expandafter\gdef\csname AfterBeg#1\endcsname {#2}}
+\def\AfterEnd   #1#2{\expandafter\gdef\csname AfterEnd#1\endcsname{#2}}
diff --git a/docs/manual/style/manualpage.dtd b/docs/manual/style/manualpage.dtd
new file mode 100644
index 0000000..e9c22a0
--- /dev/null
+++ b/docs/manual/style/manualpage.dtd
@@ -0,0 +1,29 @@
+<?xml version='1.0' encoding='UTF-8' ?>
+
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements.  See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License.  You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+
+<!ENTITY % common SYSTEM "common.dtd">
+%common;
+
+<!-- <manualpage> is the root element -->
+<!ELEMENT manualpage (parentdocument?, title, summary?,
+seealso*, section*)>
+
+<!ATTLIST manualpage metafile CDATA  #REQUIRED
+                     upgrade  CDATA  #IMPLIED
+>
diff --git a/docs/manual/style/modulesynopsis.dtd b/docs/manual/style/modulesynopsis.dtd
new file mode 100644
index 0000000..1ca9b06
--- /dev/null
+++ b/docs/manual/style/modulesynopsis.dtd
@@ -0,0 +1,85 @@
+<?xml version='1.0' encoding='UTF-8' ?>
+
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements.  See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License.  You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+
+<!ENTITY % sitemap SYSTEM "sitemap.dtd">
+%sitemap;
+
+<!ELEMENT modulesynopsis (name , description, status, hint?, sourcefile?,
+identifier? , compatibility? , summary? , seealso* , section*,
+directivesynopsis*)>
+
+<!ATTLIST modulesynopsis metafile CDATA  #REQUIRED
+                         upgrade  CDATA  #IMPLIED>
+
+<!ELEMENT directivesynopsis (name , description? , syntax? , default?
+, contextlist? , override? , modulelist?, status?, compatibility? ,
+usage?, seealso*)>
+
+<!ELEMENT name (#PCDATA)>
+
+<!ELEMENT status (#PCDATA)>
+
+<!ELEMENT hint %Inline;>
+
+<!ELEMENT identifier (#PCDATA)>
+
+<!ELEMENT sourcefile (#PCDATA)>
+
+<!ELEMENT compatibility %Inline;>
+
+<!ELEMENT description %Inline;>
+
+<!ATTLIST directivesynopsis  type CDATA  #IMPLIED
+                             location CDATA  #IMPLIED >
+
+<!ELEMENT syntax %Inline;>
+
+<!ELEMENT default (#PCDATA | directive | br)*>
+
+<!ELEMENT contextlist (context+)+>
+
+<!ELEMENT context (#PCDATA)>
+
+<!ELEMENT override (#PCDATA)>
+
+<!ELEMENT usage %Block;>
+
+<!-- Used in index.xml -->
+<!ELEMENT moduleindex (title, summary, seealso*)>
+
+<!ATTLIST moduleindex metafile CDATA  #REQUIRED>
+
+<!-- Used in directive.xml -->
+<!ELEMENT directiveindex (title | summary)+>
+
+<!ATTLIST directiveindex metafile CDATA  #REQUIRED>
+
+<!-- Used in quickreference.xml -->
+<!ELEMENT quickreference (title | summary | legend)+>
+<!ATTLIST quickreference metafile CDATA  #REQUIRED>
+
+<!ELEMENT legend (table, table)>
+
+<!-- Used in overrides.xml -->
+<!ELEMENT overrideindex (title | summary | overridesummary)+>
+<!ATTLIST overrideindex metafile CDATA #REQUIRED>
+
+<!ELEMENT overridesummary %Block;>
+<!ATTLIST overridesummary class    CDATA #IMPLIED
+                          fallback CDATA #IMPLIED>
diff --git a/docs/manual/style/scripts/MINIFY b/docs/manual/style/scripts/MINIFY
new file mode 100644
index 0000000..2c1efc3
--- /dev/null
+++ b/docs/manual/style/scripts/MINIFY
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+(echo '// see prettify.js for copyright, license and expanded version'; python -mrjsmin <prettify.js) >prettify.min.js
+
+# needs python and rjsmin installed
diff --git a/docs/manual/style/scripts/prettify.js b/docs/manual/style/scripts/prettify.js
new file mode 100644
index 0000000..bb74158
--- /dev/null
+++ b/docs/manual/style/scripts/prettify.js
@@ -0,0 +1,1622 @@
+// Copyright (C) 2006 Google Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+
+/**
+ * @fileoverview
+ * some functions for browser-side pretty printing of code contained in html.
+ *
+ * <p>
+ * For a fairly comprehensive set of languages see the
+ * <a href="http://google-code-prettify.googlecode.com/svn/trunk/README.html#langs">README</a>
+ * file that came with this source.  At a minimum, the lexer should work on a
+ * number of languages including C and friends, Java, Python, Bash, SQL, HTML,
+ * XML, CSS, Javascript, and Makefiles.  It works passably on Ruby, PHP and Awk
+ * and a subset of Perl, but, because of commenting conventions, doesn't work on
+ * Smalltalk, Lisp-like, or CAML-like languages without an explicit lang class.
+ * <p>
+ * Usage: <ol>
+ * <li> include this source file in an html page via
+ *   {@code <script type="text/javascript" src="/path/to/prettify.js"></script>}
+ * <li> define style rules.  See the example page for examples.
+ * <li> mark the {@code <pre>} and {@code <code>} tags in your source with
+ *    {@code class=prettyprint.}
+ *    You can also use the (html deprecated) {@code <xmp>} tag, but the pretty
+ *    printer needs to do more substantial DOM manipulations to support that, so
+ *    some css styles may not be preserved.
+ * </ol>
+ * That's it.  I wanted to keep the API as simple as possible, so there's no
+ * need to specify which language the code is in, but if you wish, you can add
+ * another class to the {@code <pre>} or {@code <code>} element to specify the
+ * language, as in {@code <pre class="prettyprint lang-java">}.  Any class that
+ * starts with "lang-" followed by a file extension, specifies the file type.
+ * See the "lang-*.js" files in this directory for code that implements
+ * per-language file handlers.
+ * <p>
+ * Change log:<br>
+ * cbeust, 2006/08/22
+ * <blockquote>
+ *   Java annotations (start with "@") are now captured as literals ("lit")
+ * </blockquote>
+ * @requires console
+ */
+
+// JSLint declarations
+/*global console, document, navigator, setTimeout, window, define */
+
+/**
+ * Split {@code prettyPrint} into multiple timeouts so as not to interfere with
+ * UI events.
+ * If set to {@code false}, {@code prettyPrint()} is synchronous.
+ */
+window['PR_SHOULD_USE_CONTINUATION'] = true;
+
+/**
+ * Find all the {@code <pre>} and {@code <code>} tags in the DOM with
+ * {@code class=prettyprint} and prettify them.
+ *
+ * @param {Function?} opt_whenDone if specified, called when the last entry
+ *     has been finished.
+ */
+var prettyPrintOne;
+/**
+ * Pretty print a chunk of code.
+ *
+ * @param {string} sourceCodeHtml code as html
+ * @return {string} code as html, but prettier
+ */
+var prettyPrint;
+
+
+(function () {
+  var win = window;
+  // Keyword lists for various languages.
+  // We use things that coerce to strings to make them compact when minified
+  // and to defeat aggressive optimizers that fold large string constants.
+  var FLOW_CONTROL_KEYWORDS = ["break,continue,do,else,for,if,return,while"];
+  var C_KEYWORDS = [FLOW_CONTROL_KEYWORDS,"auto,case,char,const,default," + 
+      "double,enum,extern,float,goto,int,long,register,short,signed,sizeof,module," +
+      "static,struct,switch,typedef,union,unsigned,void,volatile"];
+  var COMMON_KEYWORDS = [C_KEYWORDS,"catch,class,delete,false,import," +
+      "new,operator,private,protected,public,this,throw,true,try,typeof"];
+  var CPP_KEYWORDS = [COMMON_KEYWORDS,"alignof,align_union,asm,axiom,bool," +
+      "concept,concept_map,const_cast,constexpr,decltype," +
+      "dynamic_cast,explicit,export,friend,inline,late_check," +
+      "mutable,namespace,nullptr,reinterpret_cast,static_assert,static_cast," +
+      "template,typeid,typename,using,virtual,where,request_req"];
+  var JAVA_KEYWORDS = [COMMON_KEYWORDS,
+      "abstract,boolean,byte,extends,final,finally,implements,import," +
+      "instanceof,null,native,package,strictfp,super,synchronized,throws," +
+      "transient"];
+  var CSHARP_KEYWORDS = [JAVA_KEYWORDS,
+      "as,base,by,checked,decimal,delegate,descending,dynamic,event," +
+      "fixed,foreach,from,group,implicit,in,interface,internal,into,is,let," +
+      "lock,object,out,override,orderby,params,partial,readonly,ref,sbyte," +
+      "sealed,stackalloc,string,select,uint,ulong,unchecked,unsafe,ushort," +
+      "var,virtual,where"];
+  var COFFEE_KEYWORDS = "all,and,by,catch,class,else,extends,false,finally," +
+      "for,if,in,is,isnt,loop,new,no,not,null,of,off,on,or,return,super,then," +
+      "throw,true,try,unless,until,when,while,yes";
+  var JSCRIPT_KEYWORDS = [COMMON_KEYWORDS,
+      "debugger,eval,export,function,get,null,set,undefined,var,with," +
+      "Infinity,NaN"];
+  var PERL_KEYWORDS = "caller,delete,die,do,dump,else,elsif,eval,exit,foreach,for," +
+      "goto,if,import,last,local,my,next,no,our,print,printf,package,redo,require," +
+      "sub,undef,unless,until,use,wantarray,while,BEGIN,END";
+  var PHP_KEYWORDS = "abstract,and,array,as,break,case,catch,cfunction,class," +
+      "clone,const,continue,declare,default,do,else,elseif,enddeclare,endfor," + 
+      "endforeach,endif,endswitch,endwhile,extends,final,for,foreach,function," +
+      "global,goto,if,implements,interface,instanceof,namespace,new,old_function," +
+      "or,private,protected,public,static,switch,throw,try,use,var,while,xor," + 
+      "die,echo,empty,exit,eval,include,include_once,isset,list,require," + 
+      "require_once,return,print,unset";
+  var PYTHON_KEYWORDS = [FLOW_CONTROL_KEYWORDS, "and,as,assert,class,def,del," +
+      "elif,except,exec,finally,from,global,import,in,is,lambda," +
+      "nonlocal,not,or,pass,print,raise,try,with,yield," +
+      "False,True,None"];
+  var RUBY_KEYWORDS = [FLOW_CONTROL_KEYWORDS, "alias,and,begin,case,class," +
+      "def,defined,elsif,end,ensure,false,in,module,next,nil,not,or,redo," +
+      "rescue,retry,self,super,then,true,undef,unless,until,when,yield," +
+      "BEGIN,END"];
+  var SH_KEYWORDS = [FLOW_CONTROL_KEYWORDS, "case,done,elif,esac,eval,fi," +
+      "function,in,local,set,then,until,echo"];
+  var CONFIG_ENVS = ["User-Agent,HTTP_USER_AGENT,HTTP_REFERER,HTTP_COOKIE,HTTP_FORWARDED,HTTP_HOST,HTTP_PROXY_CONNECTION,HTTP_ACCEPT,REMOTE_ADDR,REMOTE_HOST,REMOTE_PORT,REMOTE_USER,REMOTE_IDENT,REQUEST_METHOD,SCRIPT_FILENAME,PATH_INFO,QUERY_STRING,AUTH_TYPE,DOCUMENT_ROOT,SERVER_ADMIN,SERVER_NAME,SERVER_ADDR,SERVER_PORT,SERVER_PROTOCOL,SERVER_SOFTWARE,TIME_YEAR,TIME_MON,TIME_DAY,TIME_HOUR,TIME_MIN,TIME_SEC,TIME_WDAY,TIME,API_VERSION,THE_REQUEST,REQUEST_URI,REQUEST_FILENAME,IS_SUBREQ,HTTPS,REQUEST_SCHEME"];
+  var CONFIG_KEYWORDS = ["AcceptFilter,AcceptPathInfo,AccessFileName,Action,AddAlt,AddAltByEncoding,AddAltByType,AddCharset,AddDefaultCharset,AddDescription,AddEncoding,AddHandler,AddIcon,AddIconByEncoding,AddIconByType,AddInputFilter,AddLanguage,AddModuleInfo,AddOutputFilter,AddOutputFilterByType,AddType,Alias,AliasMatch,Allow,AllowCONNECT,AllowEncodedSlashes,AllowMethods,AllowOverride,AllowOverrideList,Anonymous,Anonymous_LogEmail,Anonymous_MustGiveEmail,Anonymous_NoUserID,Anonymous_VerifyEmail,AsyncRequestWorkerFactor,AuthBasicAuthoritative,AuthBasicFake,AuthBasicProvider,AuthBasicUseDigestAlgorithm,AuthDBDUserPWQuery,AuthDBDUserRealmQuery,AuthDBMGroupFile,AuthDBMType,AuthDBMUserFile,AuthDigestAlgorithm,AuthDigestDomain,AuthDigestNonceLifetime,AuthDigestProvider,AuthDigestQop,AuthDigestShmemSize,AuthFormAuthoritative,AuthFormBody,AuthFormDisableNoStore,AuthFormFakeBasicAuth,AuthFormLocation,AuthFormLoginRequiredLocation,AuthFormLoginSuccessLocation,AuthFormLogoutLocation,AuthFormMethod,AuthFormMimetype,AuthFormPassword,AuthFormProvider,AuthFormSitePassphrase,AuthFormSize,AuthFormUsername,AuthGroupFile,AuthLDAPAuthorizePrefix,AuthLDAPBindAuthoritative,AuthLDAPBindDN,AuthLDAPBindPassword,AuthLDAPCharsetConfig,AuthLDAPCompareAsUser,AuthLDAPCompareDNOnServer,AuthLDAPDereferenceAliases,AuthLDAPGroupAttribute,AuthLDAPGroupAttributeIsDN,AuthLDAPInitialBindAsUser,AuthLDAPInitialBindPattern,AuthLDAPMaxSubGroupDepth,AuthLDAPRemoteUserAttribute,AuthLDAPRemoteUserIsDN,AuthLDAPSearchAsUser,AuthLDAPSubGroupAttribute,AuthLDAPSubGroupClass,AuthLDAPUrl,AuthMerging,AuthName,AuthnCacheContext,AuthnCacheEnable,AuthnCacheProvideFor,AuthnCacheSOCache,AuthnCacheTimeout,<AuthnProviderAlias>,AuthnzFcgiCheckAuthnProvider,AuthnzFcgiDefineProvider,AuthType,AuthUserFile,AuthzDBDLoginToReferer,AuthzDBDQuery,AuthzDBDRedirectQuery,AuthzDBMType,<AuthzProviderAlias>,AuthzSendForbiddenOnFailure,BalancerGrowth,BalancerInherit,BalancerMember,BalancerPersist,BrotliAlterETag,BrotliCompressionMaxInputBlock,BrotliCompressionQuality,BrotliCompressionWindow,BrotliFilterNote,BrowserMatch,BrowserMatchNoCase,BufferedLogs,BufferSize,CacheDefaultExpire,CacheDetailHeader,CacheDirLength,CacheDirLevels,CacheDisable,CacheEnable,CacheFile,CacheHeader,CacheIgnoreCacheControl,CacheIgnoreHeaders,CacheIgnoreNoLastMod,CacheIgnoreQueryString,CacheIgnoreURLSessionIdentifiers,CacheKeyBaseURL,CacheLastModifiedFactor,CacheLock,CacheLockMaxAge,CacheLockPath,CacheMaxExpire,CacheMaxFileSize,CacheMinExpire,CacheMinFileSize,CacheNegotiatedDocs,CacheQuickHandler,CacheReadSize,CacheReadTime,CacheRoot,CacheSocache,CacheSocacheMaxSize,CacheSocacheMaxTime,CacheSocacheMinTime,CacheSocacheReadSize,CacheSocacheReadTime,CacheStaleOnError,CacheStoreExpired,CacheStoreNoStore,CacheStorePrivate,CGIDScriptTimeout,CGIMapExtension,CGIPassAuth,CGIVar,CharsetDefault,CharsetOptions,CharsetSourceEnc,CheckCaseOnly,CheckSpelling,ChrootDir,ContentDigest,CookieDomain,CookieExpires,CookieName,CookieStyle,CookieTracking,CoreDumpDirectory,CustomLog,Dav,DavDepthInfinity,DavGenericLockDB,DavLockDB,DavMinTimeout,DBDExptime,DBDInitSQL,DBDKeep,DBDMax,DBDMin,DBDParams,DBDPersist,DBDPrepareSQL,DBDriver,DefaultIcon,DefaultLanguage,DefaultRuntimeDir,DefaultType,Define,DeflateBufferSize,DeflateCompressionLevel,DeflateFilterNote,DeflateInflateLimitRequestBody,DeflateInflateRatioBurst,DeflateInflateRatioLimit,DeflateMemLevel,DeflateWindowSize,Deny,<Directory>,DirectoryCheckHandler,DirectoryIndex,DirectoryIndexRedirect,<DirectoryMatch>,DirectorySlash,DocumentRoot,DTracePrivileges,DumpIOInput,DumpIOOutput,<Else>,<ElseIf>,EnableExceptionHook,EnableMMAP,EnableSendfile,Error,ErrorDocument,ErrorLog,ErrorLogFormat,Example,ExpiresActive,ExpiresByType,ExpiresDefault,ExtendedStatus,ExtFilterDefine,ExtFilterOptions,FallbackResource,FileETag,<Files>,<FilesMatch>,FilterChain,FilterDeclare,FilterProtocol,FilterProvider,FilterTrace,ForceLanguagePriority,ForceType,ForensicLog,GlobalLog,GprofDir,GracefulShutdownTimeout,Group,H2CopyFiles,H2Direct,H2EarlyHints,H2MaxSessionStreams,H2MaxWorkerIdleSeconds,H2MaxWorkers,H2MinWorkers,H2ModernTLSOnly,H2Push,H2PushDiarySize,H2PushPriority,H2PushResource,H2SerializeHeaders,H2StreamMaxMemSize,H2TLSCoolDownSecs,H2TLSWarmUpSize,H2Upgrade,H2WindowSize,Header,HeaderName,HeartbeatAddress,HeartbeatListen,HeartbeatMaxServers,HeartbeatStorage,HeartbeatStorage,HostnameLookups,HttpProtocolOptions,IdentityCheck,IdentityCheckTimeout,<If>,<IfDefine>,<IfModule>,<IfVersion>,ImapBase,ImapDefault,ImapMenu,Include,IncludeOptional,IndexHeadInsert,IndexIgnore,IndexIgnoreReset,IndexOptions,IndexOrderDefault,IndexStyleSheet,InputSed,ISAPIAppendLogToErrors,ISAPIAppendLogToQuery,ISAPICacheFile,ISAPIFakeAsync,ISAPILogNotSupported,ISAPIReadAheadBuffer,KeepAlive,KeepAliveTimeout,KeptBodySize,LanguagePriority,LDAPCacheEntries,LDAPCacheTTL,LDAPConnectionPoolTTL,LDAPConnectionTimeout,LDAPLibraryDebug,LDAPOpCacheEntries,LDAPOpCacheTTL,LDAPReferralHopLimit,LDAPReferrals,LDAPRetries,LDAPRetryDelay,LDAPSharedCacheFile,LDAPSharedCacheSize,LDAPTimeout,LDAPTrustedClientCert,LDAPTrustedGlobalCert,LDAPTrustedMode,LDAPVerifyServerCert,<Limit>,<LimitExcept>,LimitInternalRecursion,LimitRequestBody,LimitRequestFields,LimitRequestFieldSize,LimitRequestLine,LimitXMLRequestBody,Listen,ListenBackLog,ListenCoresBucketsRatio,LoadFile,LoadModule,<Location>,<LocationMatch>,LogFormat,LogIOTrackTTFB,LogLevel,LogMessage,LuaAuthzProvider,LuaCodeCache,LuaHookAccessChecker,LuaHookAuthChecker,LuaHookCheckUserID,LuaHookFixups,LuaHookInsertFilter,LuaHookLog,LuaHookMapToStorage,LuaHookTranslateName,LuaHookTypeChecker,LuaInherit,LuaInputFilter,LuaMapHandler,LuaOutputFilter,LuaPackageCPath,LuaPackagePath,LuaQuickHandler,LuaRoot,LuaScope,<Macro>,MaxConnectionsPerChild,MaxKeepAliveRequests,MaxMemFree,MaxRangeOverlaps,MaxRangeReversals,MaxRanges,MaxRequestWorkers,MaxSpareServers,MaxSpareThreads,MaxThreads,MemcacheConnTTL,MergeTrailers,MetaDir,MetaFiles,MetaSuffix,MimeMagicFile,MinSpareServers,MinSpareThreads,MMapFile,ModemStandard,ModMimeUsePathInfo,MultiviewsMatch,Mutex,NameVirtualHost,NoProxy,NWSSLTrustedCerts,NWSSLUpgradeable,Options,Order,OutputSed,PassEnv,PidFile,PrivilegesMode,Protocol,ProtocolEcho,Protocols,ProtocolsHonorOrder,<Proxy>,ProxyAddHeaders,ProxyBadHeader,ProxyBlock,ProxyDomain,ProxyErrorOverride,ProxyExpressDBMFile,ProxyExpressDBMType,ProxyExpressEnable,ProxyFCGIBackendType,ProxyFCGISetEnvIf,ProxyFtpDirCharset,ProxyFtpEscapeWildcards,ProxyFtpListOnWildcard,ProxyHCExpr,ProxyHCTemplate,ProxyHCTPsize,ProxyHTMLBufSize,ProxyHTMLCharsetOut,ProxyHTMLDocType,ProxyHTMLEnable,ProxyHTMLEvents,ProxyHTMLExtended,ProxyHTMLFixups,ProxyHTMLInterp,ProxyHTMLLinks,ProxyHTMLMeta,ProxyHTMLStripComments,ProxyHTMLURLMap,ProxyIOBufferSize,<ProxyMatch>,ProxyMaxForwards,ProxyPass,ProxyPassInherit,ProxyPassInterpolateEnv,ProxyPassMatch,ProxyPassReverse,ProxyPassReverseCookieDomain,ProxyPassReverseCookiePath,ProxyPreserveHost,ProxyReceiveBufferSize,ProxyRemote,ProxyRemoteMatch,ProxyRequests,ProxySCGIInternalRedirect,ProxySCGISendfile,ProxySet,ProxySourceAddress,ProxyStatus,ProxyTimeout,ProxyVia,QualifyRedirectURL,ReadmeName,ReceiveBufferSize,Redirect,RedirectMatch,RedirectPermanent,RedirectTemp,ReflectorHeader,RegisterHttpMethod,RemoteIPHeader,RemoteIPInternalProxy,RemoteIPInternalProxyList,RemoteIPProxiesHeader,RemoteIPTrustedProxy,RemoteIPTrustedProxyList,RemoveCharset,RemoveEncoding,RemoveHandler,RemoveInputFilter,RemoveLanguage,RemoveOutputFilter,RemoveType,RequestHeader,RequestReadTimeout,Require,<RequireAll>,<RequireAny>,<RequireNone>,RewriteBase,RewriteCond,RewriteEngine,RewriteMap,RewriteOptions,RewriteRule,RLimitCPU,RLimitMEM,RLimitNPROC,Satisfy,ScoreBoardFile,Script,ScriptAlias,ScriptAliasMatch,ScriptInterpreterSource,ScriptLog,ScriptLogBuffer,ScriptLogLength,ScriptSock,SecureListen,SeeRequestTail,SendBufferSize,ServerAdmin,ServerAlias,ServerLimit,ServerName,ServerPath,ServerRoot,ServerSignature,ServerTokens,Session,SessionCookieName,SessionCookieName2,SessionCookieRemove,SessionCryptoCipher,SessionCryptoDriver,SessionCryptoPassphrase,SessionCryptoPassphraseFile,SessionDBDCookieName,SessionDBDCookieName2,SessionDBDCookieRemove,SessionDBDDeleteLabel,SessionDBDInsertLabel,SessionDBDPerUser,SessionDBDSelectLabel,SessionDBDUpdateLabel,SessionEnv,SessionExclude,SessionHeader,SessionInclude,SessionMaxAge,SetEnv,SetEnvIf,SetEnvIfExpr,SetEnvIfNoCase,SetHandler,SetInputFilter,SetOutputFilter,SSIEndTag,SSIErrorMsg,SSIETag,SSILastModified,SSILegacyExprParser,SSIStartTag,SSITimeFormat,SSIUndefinedEcho,SSLCACertificateFile,SSLCACertificatePath,SSLCADNRequestFile,SSLCADNRequestPath,SSLCARevocationCheck,SSLCARevocationFile,SSLCARevocationPath,SSLCertificateChainFile,SSLCertificateFile,SSLCertificateKeyFile,SSLCipherSuite,SSLCompression,SSLCryptoDevice,SSLEngine,SSLFIPS,SSLHonorCipherOrder,SSLInsecureRenegotiation,SSLOCSPDefaultResponder,SSLOCSPEnable,SSLOCSPNoverify,SSLOCSPOverrideResponder,SSLOCSPProxyURL,SSLOCSPResponderCertificateFile,SSLOCSPResponderTimeout,SSLOCSPResponseMaxAge,SSLOCSPResponseTimeSkew,SSLOCSPUseRequestNonce,SSLOpenSSLConfCmd,SSLOptions,SSLPassPhraseDialog,SSLProtocol,SSLProxyCACertificateFile,SSLProxyCACertificatePath,SSLProxyCARevocationCheck,SSLProxyCARevocationFile,SSLProxyCARevocationPath,SSLProxyCheckPeerCN,SSLProxyCheckPeerExpire,SSLProxyCheckPeerName,SSLProxyCipherSuite,SSLProxyEngine,SSLProxyMachineCertificateChainFile,SSLProxyMachineCertificateFile,SSLProxyMachineCertificatePath,SSLProxyProtocol,SSLProxyVerify,SSLProxyVerifyDepth,SSLRandomSeed,SSLRenegBufferSize,SSLRequire,SSLRequireSSL,SSLSessionCache,SSLSessionCacheTimeout,SSLSessionTicketKeyFile,SSLSessionTickets,SSLSRPUnknownUserSeed,SSLSRPVerifierFile,SSLStaplingCache,SSLStaplingErrorCacheTimeout,SSLStaplingFakeTryLater,SSLStaplingForceURL,SSLStaplingResponderTimeout,SSLStaplingResponseMaxAge,SSLStaplingResponseTimeSkew,SSLStaplingReturnResponderErrors,SSLStaplingStandardCacheTimeout,SSLStrictSNIVHostCheck,SSLUserName,SSLUseStapling,SSLVerifyClient,SSLVerifyDepth,StartServers,StartThreads,Substitute,SubstituteInheritBefore,SubstituteMaxLineLength,Suexec,SuexecUserGroup,ThreadLimit,ThreadsPerChild,ThreadStackSize,TimeOut,TraceEnable,TransferLog,TypesConfig,UnDefine,UndefMacro,UnsetEnv,Use,UseCanonicalName,UseCanonicalPhysicalPort,User,UserDir,VHostCGIMode,VHostCGIPrivs,VHostGroup,VHostPrivs,VHostSecure,VHostUser,VirtualDocumentRoot,VirtualDocumentRootIP,<VirtualHost>,VirtualScriptAlias,VirtualScriptAliasIP,WatchdogInterval,XBitHack,xml2EncAlias,xml2EncDefault,xml2StartParse"];
+  var CONFIG_OPTIONS = /^[\\+\\-]?(AuthConfig|IncludesNOEXEC|ExecCGI|FollowSymLinks|MultiViews|Includes|Indexes|SymLinksIfOwnerMatch)\b/i;
+  var ALL_KEYWORDS = [
+      CPP_KEYWORDS, CSHARP_KEYWORDS, JSCRIPT_KEYWORDS, PERL_KEYWORDS +
+      PYTHON_KEYWORDS, RUBY_KEYWORDS, SH_KEYWORDS, CONFIG_KEYWORDS, PHP_KEYWORDS];
+  var C_TYPES = /^(DIR|FILE|vector|(de|priority_)?queue|list|stack|(const_)?iterator|(multi)?(set|map)|bitset|u?(int|float|char|void|const|static|struct)\d*(_t)?\b)|[a-z_]+_rec|cmd_parms\b/;
+
+  // token style names.  correspond to css classes
+  /**
+   * token style for a string literal
+   * @const
+   */
+  var PR_STRING = 'str';
+  /**
+   * token style for a keyword
+   * @const
+   */
+  var PR_KEYWORD = 'kwd';
+  /**
+   * token style for a comment
+   * @const
+   */
+  var PR_COMMENT = 'com';
+  /**
+   * token style for a type
+   * @const
+   */
+  var PR_TYPE = 'typ';
+  /**
+   * token style for a literal value.  e.g. 1, null, true.
+   * @const
+   */
+  var PR_LITERAL = 'lit';
+  /**
+   * token style for a punctuation string.
+   * @const
+   */
+  var PR_PUNCTUATION = 'pun';
+  /**
+   * token style for plain text.
+   * @const
+   */
+  var PR_PLAIN = 'pln';
+
+  /**
+   * token style for an sgml tag.
+   * @const
+   */
+  var PR_TAG = 'tag';
+  /**
+   * token style for a markup declaration such as a DOCTYPE.
+   * @const
+   */
+  var PR_DECLARATION = 'dec';
+  /**
+   * token style for embedded source.
+   * @const
+   */
+  var PR_SOURCE = 'src';
+  /**
+   * token style for an sgml attribute name.
+   * @const
+   */
+  var PR_ATTRIB_NAME = 'atn';
+  /**
+   * token style for an sgml attribute value.
+   * @const
+   */
+  var PR_ATTRIB_VALUE = 'atv';
+
+  /**
+   * A class that indicates a section of markup that is not code, e.g. to allow
+   * embedding of line numbers within code listings.
+   * @const
+   */
+  var PR_NOCODE = 'nocode';
+
+
+
+/**
+ * A set of tokens that can precede a regular expression literal in
+ * javascript
+ * http://web.archive.org/web/20070717142515/http://www.mozilla.org/js/language/js20/rationale/syntax.html
+ * has the full list, but I've removed ones that might be problematic when
+ * seen in languages that don't support regular expression literals.
+ *
+ * <p>Specifically, I've removed any keywords that can't precede a regexp
+ * literal in a syntactically legal javascript program, and I've removed the
+ * "in" keyword since it's not a keyword in many languages, and might be used
+ * as a count of inches.
+ *
+ * <p>The link above does not accurately describe EcmaScript rules since
+ * it fails to distinguish between (a=++/b/i) and (a++/b/i) but it works
+ * very well in practice.
+ *
+ * @private
+ * @const
+ */
+var REGEXP_PRECEDER_PATTERN = '(?:^^\\.?|[+-]|[!=]=?=?|\\#|%=?|&&?=?|\\(|\\*=?|[+\\-]=|->|\\/=?|::?|<<?=?|>>?>?=?|,|;|\\?|@|\\[|~|{|\\^\\^?=?|\\|\\|?=?|break|case|continue|delete|do|else|finally|instanceof|return|throw|try|typeof)\\s*';
+
+// CAVEAT: this does not properly handle the case where a regular
+// expression immediately follows another since a regular expression may
+// have flags for case-sensitivity and the like.  Having regexp tokens
+// adjacent is not valid in any language I'm aware of, so I'm punting.
+// TODO: maybe style special characters inside a regexp as punctuation.
+
+
+  /**
+   * Given a group of {@link RegExp}s, returns a {@code RegExp} that globally
+   * matches the union of the sets of strings matched by the input RegExp.
+   * Since it matches globally, if the input strings have a start-of-input
+   * anchor (/^.../), it is ignored for the purposes of unioning.
+   * @param {Array.<RegExp>} regexs non multiline, non-global regexs.
+   * @return {RegExp} a global regex.
+   */
+  function combinePrefixPatterns(regexs) {
+    var capturedGroupIndex = 0;
+  
+    var needToFoldCase = false;
+    var ignoreCase = false;
+    for (var i = 0, n = regexs.length; i < n; ++i) {
+      var regex = regexs[i];
+      if (regex.ignoreCase) {
+        ignoreCase = true;
+      } else if (/[a-z]/i.test(regex.source.replace(
+                     /\\u[0-9a-f]{4}|\\x[0-9a-f]{2}|\\[^ux]/gi, ''))) {
+        needToFoldCase = true;
+        ignoreCase = false;
+        break;
+      }
+    }
+  
+    var escapeCharToCodeUnit = {
+      'b': 8,
+      't': 9,
+      'n': 0xa,
+      'v': 0xb,
+      'f': 0xc,
+      'r': 0xd
+    };
+  
+    function decodeEscape(charsetPart) {
+      var cc0 = charsetPart.charCodeAt(0);
+      if (cc0 !== 92 /* \\ */) {
+        return cc0;
+      }
+      var c1 = charsetPart.charAt(1);
+      cc0 = escapeCharToCodeUnit[c1];
+      if (cc0) {
+        return cc0;
+      } else if ('0' <= c1 && c1 <= '7') {
+        return parseInt(charsetPart.substring(1), 8);
+      } else if (c1 === 'u' || c1 === 'x') {
+        return parseInt(charsetPart.substring(2), 16);
+      } else {
+        return charsetPart.charCodeAt(1);
+      }
+    }
+  
+    function encodeEscape(charCode) {
+      if (charCode < 0x20) {
+        return (charCode < 0x10 ? '\\x0' : '\\x') + charCode.toString(16);
+      }
+      var ch = String.fromCharCode(charCode);
+      return (ch === '\\' || ch === '-' || ch === ']' || ch === '^')
+          ? "\\" + ch : ch;
+    }
+  
+    function caseFoldCharset(charSet) {
+      var charsetParts = charSet.substring(1, charSet.length - 1).match(
+          new RegExp(
+              '\\\\u[0-9A-Fa-f]{4}'
+              + '|\\\\x[0-9A-Fa-f]{2}'
+              + '|\\\\[0-3][0-7]{0,2}'
+              + '|\\\\[0-7]{1,2}'
+              + '|\\\\[\\s\\S]'
+              + '|-'
+              + '|[^-\\\\]',
+              'g'));
+      var ranges = [];
+      var inverse = charsetParts[0] === '^';
+  
+      var out = ['['];
+      if (inverse) { out.push('^'); }
+  
+      for (var i = inverse ? 1 : 0, n = charsetParts.length; i < n; ++i) {
+        var p = charsetParts[i];
+        if (/\\[bdsw]/i.test(p)) {  // Don't muck with named groups.
+          out.push(p);
+        } else {
+          var start = decodeEscape(p);
+          var end;
+          if (i + 2 < n && '-' === charsetParts[i + 1]) {
+            end = decodeEscape(charsetParts[i + 2]);
+            i += 2;
+          } else {
+            end = start;
+          }
+          ranges.push([start, end]);
+          // If the range might intersect letters, then expand it.
+          // This case handling is too simplistic.
+          // It does not deal with non-latin case folding.
+          // It works for latin source code identifiers though.
+          if (!(end < 65 || start > 122)) {
+            if (!(end < 65 || start > 90)) {
+              ranges.push([Math.max(65, start) | 32, Math.min(end, 90) | 32]);
+            }
+            if (!(end < 97 || start > 122)) {
+              ranges.push([Math.max(97, start) & ~32, Math.min(end, 122) & ~32]);
+            }
+          }
+        }
+      }
+  
+      // [[1, 10], [3, 4], [8, 12], [14, 14], [16, 16], [17, 17]]
+      // -> [[1, 12], [14, 14], [16, 17]]
+      ranges.sort(function (a, b) { return (a[0] - b[0]) || (b[1]  - a[1]); });
+      var consolidatedRanges = [];
+      var lastRange = [];
+      for (var i = 0; i < ranges.length; ++i) {
+        var range = ranges[i];
+        if (range[0] <= lastRange[1] + 1) {
+          lastRange[1] = Math.max(lastRange[1], range[1]);
+        } else {
+          consolidatedRanges.push(lastRange = range);
+        }
+      }
+  
+      for (var i = 0; i < consolidatedRanges.length; ++i) {
+        var range = consolidatedRanges[i];
+        out.push(encodeEscape(range[0]));
+        if (range[1] > range[0]) {
+          if (range[1] + 1 > range[0]) { out.push('-'); }
+          out.push(encodeEscape(range[1]));
+        }
+      }
+      out.push(']');
+      return out.join('');
+    }
+  
+    function allowAnywhereFoldCaseAndRenumberGroups(regex) {
+      // Split into character sets, escape sequences, punctuation strings
+      // like ('(', '(?:', ')', '^'), and runs of characters that do not
+      // include any of the above.
+      var parts = regex.source.match(
+          new RegExp(
+              '(?:'
+              + '\\[(?:[^\\x5C\\x5D]|\\\\[\\s\\S])*\\]'  // a character set
+              + '|\\\\u[A-Fa-f0-9]{4}'  // a unicode escape
+              + '|\\\\x[A-Fa-f0-9]{2}'  // a hex escape
+              + '|\\\\[0-9]+'  // a back-reference or octal escape
+              + '|\\\\[^ux0-9]'  // other escape sequence
+              + '|\\(\\?[:!=]'  // start of a non-capturing group
+              + '|[\\(\\)\\^]'  // start/end of a group, or line start
+              + '|[^\\x5B\\x5C\\(\\)\\^]+'  // run of other characters
+              + ')',
+              'g'));
+      var n = parts.length;
+  
+      // Maps captured group numbers to the number they will occupy in
+      // the output or to -1 if that has not been determined, or to
+      // undefined if they need not be capturing in the output.
+      var capturedGroups = [];
+  
+      // Walk over and identify back references to build the capturedGroups
+      // mapping.
+      for (var i = 0, groupIndex = 0; i < n; ++i) {
+        var p = parts[i];
+        if (p === '(') {
+          // groups are 1-indexed, so max group index is count of '('
+          ++groupIndex;
+        } else if ('\\' === p.charAt(0)) {
+          var decimalValue = +p.substring(1);
+          if (decimalValue) {
+            if (decimalValue <= groupIndex) {
+              capturedGroups[decimalValue] = -1;
+            } else {
+              // Replace with an unambiguous escape sequence so that
+              // an octal escape sequence does not turn into a backreference
+              // to a capturing group from an earlier regex.
+              parts[i] = encodeEscape(decimalValue);
+            }
+          }
+        }
+      }
+  
+      // Renumber groups and reduce capturing groups to non-capturing groups
+      // where possible.
+      for (var i = 1; i < capturedGroups.length; ++i) {
+        if (-1 === capturedGroups[i]) {
+          capturedGroups[i] = ++capturedGroupIndex;
+        }
+      }
+      for (var i = 0, groupIndex = 0; i < n; ++i) {
+        var p = parts[i];
+        if (p === '(') {
+          ++groupIndex;
+          if (!capturedGroups[groupIndex]) {
+            parts[i] = '(?:';
+          }
+        } else if ('\\' === p.charAt(0)) {
+          var decimalValue = +p.substring(1);
+          if (decimalValue && decimalValue <= groupIndex) {
+            parts[i] = '\\' + capturedGroups[decimalValue];
+          }
+        }
+      }
+  
+      // Remove any prefix anchors so that the output will match anywhere.
+      // ^^ really does mean an anchored match though.
+      for (var i = 0; i < n; ++i) {
+        if ('^' === parts[i] && '^' !== parts[i + 1]) { parts[i] = ''; }
+      }
+  
+      // Expand letters to groups to handle mixing of case-sensitive and
+      // case-insensitive patterns if necessary.
+      if (regex.ignoreCase && needToFoldCase) {
+        for (var i = 0; i < n; ++i) {
+          var p = parts[i];
+          var ch0 = p.charAt(0);
+          if (p.length >= 2 && ch0 === '[') {
+            parts[i] = caseFoldCharset(p);
+          } else if (ch0 !== '\\') {
+            // TODO: handle letters in numeric escapes.
+            parts[i] = p.replace(
+                /[a-zA-Z]/g,
+                function (ch) {
+                  var cc = ch.charCodeAt(0);
+                  return '[' + String.fromCharCode(cc & ~32, cc | 32) + ']';
+                });
+          }
+        }
+      }
+  
+      return parts.join('');
+    }
+  
+    var rewritten = [];
+    for (var i = 0, n = regexs.length; i < n; ++i) {
+      var regex = regexs[i];
+      if (regex.global || regex.multiline) { throw new Error('' + regex); }
+      rewritten.push(
+          '(?:' + allowAnywhereFoldCaseAndRenumberGroups(regex) + ')');
+    }
+  
+    return new RegExp(rewritten.join('|'), ignoreCase ? 'gi' : 'g');
+  }
+
+
+  /**
+   * Split markup into a string of source code and an array mapping ranges in
+   * that string to the text nodes in which they appear.
+   *
+   * <p>
+   * The HTML DOM structure:</p>
+   * <pre>
+   * (Element   "p"
+   *   (Element "b"
+   *     (Text  "print "))       ; #1
+   *   (Text    "'Hello '")      ; #2
+   *   (Element "br")            ; #3
+   *   (Text    "  + 'World';")) ; #4
+   * </pre>
+   * <p>
+   * corresponds to the HTML
+   * {@code <p><b>print </b>'Hello '<br>  + 'World';</p>}.</p>
+   *
+   * <p>
+   * It will produce the output:</p>
+   * <pre>
+   * {
+   *   sourceCode: "print 'Hello '\n  + 'World';",
+   *   //                     1          2
+   *   //           012345678901234 5678901234567
+   *   spans: [0, #1, 6, #2, 14, #3, 15, #4]
+   * }
+   * </pre>
+   * <p>
+   * where #1 is a reference to the {@code "print "} text node above, and so
+   * on for the other text nodes.
+   * </p>
+   *
+   * <p>
+   * The {@code} spans array is an array of pairs.  Even elements are the start
+   * indices of substrings, and odd elements are the text nodes (or BR elements)
+   * that contain the text for those substrings.
+   * Substrings continue until the next index or the end of the source.
+   * </p>
+   *
+   * @param {Node} node an HTML DOM subtree containing source-code.
+   * @param {boolean} isPreformatted true if white-space in text nodes should
+   *    be considered significant.
+   * @return {Object} source code and the text nodes in which they occur.
+   */
+  function extractSourceSpans(node, isPreformatted) {
+    var nocode = /(?:^|\s)nocode(?:\s|$)/;
+  
+    var chunks = [];
+    var length = 0;
+    var spans = [];
+    var k = 0;
+  
+    function walk(node) {
+      switch (node.nodeType) {
+        case 1:  // Element
+          if (nocode.test(node.className)) { return; }
+          for (var child = node.firstChild; child; child = child.nextSibling) {
+            walk(child);
+          }
+          var nodeName = node.nodeName.toLowerCase();
+          if ('br' === nodeName || 'li' === nodeName) {
+            chunks[k] = '\n';
+            spans[k << 1] = length++;
+            spans[(k++ << 1) | 1] = node;
+          }
+          break;
+        case 3: case 4:  // Text
+          var text = node.nodeValue;
+          if (text.length) {
+            if (!isPreformatted) {
+              text = text.replace(/[ \t\r\n]+/g, ' ');
+            } else {
+              text = text.replace(/\r\n?/g, '\n');  // Normalize newlines.
+              text = text.replace(/^(\r?\n\s*)+/g, '');  // Remove leading newlines
+              text = text.replace(/^\s*/g, '');  // Remove leading spaces due to indented formatting
+              text = text.replace(/(\r?\n\s*)+$/g, '');  // Remove ending newlines
+              
+            }
+            // TODO: handle tabs here?
+            chunks[k] = text;
+            spans[k << 1] = length;
+            length += text.length;
+            spans[(k++ << 1) | 1] = node;
+          }
+          break;
+      }
+    }
+  
+    walk(node);
+  
+    return {
+      sourceCode: chunks.join('').replace(/\n$/, ''),
+      spans: spans
+    };
+  }
+
+
+  /**
+   * Apply the given language handler to sourceCode and add the resulting
+   * decorations to out.
+   * @param {number} basePos the index of sourceCode within the chunk of source
+   *    whose decorations are already present on out.
+   */
+  function appendDecorations(basePos, sourceCode, langHandler, out) {
+    if (!sourceCode) { return; }
+    var job = {
+      sourceCode: sourceCode,
+      basePos: basePos
+    };
+    langHandler(job);
+    out.push.apply(out, job.decorations);
+  }
+
+  var notWs = /\S/;
+
+  /**
+   * Given an element, if it contains only one child element and any text nodes
+   * it contains contain only space characters, return the sole child element.
+   * Otherwise returns undefined.
+   * <p>
+   * This is meant to return the CODE element in {@code <pre><code ...>} when
+   * there is a single child element that contains all the non-space textual
+   * content, but not to return anything where there are multiple child elements
+   * as in {@code <pre><code>...</code><code>...</code></pre>} or when there
+   * is textual content.
+   */
+  function childContentWrapper(element) {
+    var wrapper = undefined;
+    for (var c = element.firstChild; c; c = c.nextSibling) {
+      var type = c.nodeType;
+      wrapper = (type === 1)  // Element Node
+          ? (wrapper ? element : c)
+          : (type === 3)  // Text Node
+          ? (notWs.test(c.nodeValue) ? element : wrapper)
+          : wrapper;
+    }
+    return wrapper === element ? undefined : wrapper;
+  }
+
+  /** Given triples of [style, pattern, context] returns a lexing function,
+    * The lexing function interprets the patterns to find token boundaries and
+    * returns a decoration list of the form
+    * [index_0, style_0, index_1, style_1, ..., index_n, style_n]
+    * where index_n is an index into the sourceCode, and style_n is a style
+    * constant like PR_PLAIN.  index_n-1 <= index_n, and style_n-1 applies to
+    * all characters in sourceCode[index_n-1:index_n].
+    *
+    * The stylePatterns is a list whose elements have the form
+    * [style : string, pattern : RegExp, DEPRECATED, shortcut : string].
+    *
+    * Style is a style constant like PR_PLAIN, or can be a string of the
+    * form 'lang-FOO', where FOO is a language extension describing the
+    * language of the portion of the token in $1 after pattern executes.
+    * E.g., if style is 'lang-lisp', and group 1 contains the text
+    * '(hello (world))', then that portion of the token will be passed to the
+    * registered lisp handler for formatting.
+    * The text before and after group 1 will be restyled using this decorator
+    * so decorators should take care that this doesn't result in infinite
+    * recursion.  For example, the HTML lexer rule for SCRIPT elements looks
+    * something like ['lang-js', /<[s]cript>(.+?)<\/script>/].  This may match
+    * '<script>foo()<\/script>', which would cause the current decorator to
+    * be called with '<script>' which would not match the same rule since
+    * group 1 must not be empty, so it would be instead styled as PR_TAG by
+    * the generic tag rule.  The handler registered for the 'js' extension would
+    * then be called with 'foo()', and finally, the current decorator would
+    * be called with '<\/script>' which would not match the original rule and
+    * so the generic tag rule would identify it as a tag.
+    *
+    * Pattern must only match prefixes, and if it matches a prefix, then that
+    * match is considered a token with the same style.
+    *
+    * Context is applied to the last non-whitespace, non-comment token
+    * recognized.
+    *
+    * Shortcut is an optional string of characters, any of which, if the first
+    * character, gurantee that this pattern and only this pattern matches.
+    *
+    * @param {Array} shortcutStylePatterns patterns that always start with
+    *   a known character.  Must have a shortcut string.
+    * @param {Array} fallthroughStylePatterns patterns that will be tried in
+    *   order if the shortcut ones fail.  May have shortcuts.
+    *
+    * @return {function (Object)} a
+    *   function that takes source code and returns a list of decorations.
+    */
+  function createSimpleLexer(shortcutStylePatterns, fallthroughStylePatterns) {
+    var shortcuts = {};
+    var tokenizer;
+    (function () {
+      var allPatterns = shortcutStylePatterns.concat(fallthroughStylePatterns);
+      var allRegexs = [];
+      var regexKeys = {};
+      for (var i = 0, n = allPatterns.length; i < n; ++i) {
+        var patternParts = allPatterns[i];
+        var shortcutChars = patternParts[3];
+        if (shortcutChars) {
+          for (var c = shortcutChars.length; --c >= 0;) {
+            shortcuts[shortcutChars.charAt(c)] = patternParts;
+          }
+        }
+        var regex = patternParts[1];
+        var k = '' + regex;
+        if (!regexKeys.hasOwnProperty(k)) {
+          allRegexs.push(regex);
+          regexKeys[k] = null;
+        }
+      }
+      allRegexs.push(/[\0-\uffff]/);
+      tokenizer = combinePrefixPatterns(allRegexs);
+    })();
+
+    var nPatterns = fallthroughStylePatterns.length;
+
+    /**
+     * Lexes job.sourceCode and produces an output array job.decorations of
+     * style classes preceded by the position at which they start in
+     * job.sourceCode in order.
+     *
+     * @param {Object} job an object like <pre>{
+     *    sourceCode: {string} sourceText plain text,
+     *    basePos: {int} position of job.sourceCode in the larger chunk of
+     *        sourceCode.
+     * }</pre>
+     */
+    var decorate = function (job) {
+      var sourceCode = job.sourceCode, basePos = job.basePos;
+      /** Even entries are positions in source in ascending order.  Odd enties
+        * are style markers (e.g., PR_COMMENT) that run from that position until
+        * the end.
+        * @type {Array.<number|string>}
+        */
+      var decorations = [basePos, PR_PLAIN];
+      var pos = 0;  // index into sourceCode
+      var tokens = sourceCode.match(tokenizer) || [];
+      var styleCache = {};
+
+      for (var ti = 0, nTokens = tokens.length; ti < nTokens; ++ti) {
+        var token = tokens[ti];
+        var style = styleCache[token];
+        var match = void 0;
+
+        var isEmbedded;
+        if (typeof style === 'string') {
+          isEmbedded = false;
+        } else {
+          var patternParts = shortcuts[token.charAt(0)];
+          if (patternParts) {
+            match = token.match(patternParts[1]);
+            style = patternParts[0];
+          } else {
+            for (var i = 0; i < nPatterns; ++i) {
+              patternParts = fallthroughStylePatterns[i];
+              match = token.match(patternParts[1]);
+              if (match) {
+                style = patternParts[0];
+                break;
+              }
+            }
+
+            if (!match) {  // make sure that we make progress
+              style = PR_PLAIN;
+            }
+          }
+
+          isEmbedded = style.length >= 5 && 'lang-' === style.substring(0, 5);
+          if (isEmbedded && !(match && typeof match[1] === 'string')) {
+            isEmbedded = false;
+            style = PR_SOURCE;
+          }
+
+          if (!isEmbedded) { styleCache[token] = style; }
+        }
+
+        var tokenStart = pos;
+        pos += token.length;
+
+        if (!isEmbedded) {
+          decorations.push(basePos + tokenStart, style);
+        } else {  // Treat group 1 as an embedded block of source code.
+          var embeddedSource = match[1];
+          var embeddedSourceStart = token.indexOf(embeddedSource);
+          var embeddedSourceEnd = embeddedSourceStart + embeddedSource.length;
+          if (match[2]) {
+            // If embeddedSource can be blank, then it would match at the
+            // beginning which would cause us to infinitely recurse on the
+            // entire token, so we catch the right context in match[2].
+            embeddedSourceEnd = token.length - match[2].length;
+            embeddedSourceStart = embeddedSourceEnd - embeddedSource.length;
+          }
+          var lang = style.substring(5);
+          // Decorate the left of the embedded source
+          appendDecorations(
+              basePos + tokenStart,
+              token.substring(0, embeddedSourceStart),
+              decorate, decorations);
+          // Decorate the embedded source
+          appendDecorations(
+              basePos + tokenStart + embeddedSourceStart,
+              embeddedSource,
+              langHandlerForExtension(lang, embeddedSource),
+              decorations);
+          // Decorate the right of the embedded section
+          appendDecorations(
+              basePos + tokenStart + embeddedSourceEnd,
+              token.substring(embeddedSourceEnd),
+              decorate, decorations);
+        }
+      }
+      job.decorations = decorations;
+    };
+    return decorate;
+  }
+
+  /** returns a function that produces a list of decorations from source text.
+    *
+    * This code treats ", ', and ` as string delimiters, and \ as a string
+    * escape.  It does not recognize perl's qq() style strings.
+    * It has no special handling for double delimiter escapes as in basic, or
+    * the tripled delimiters used in python, but should work on those regardless
+    * although in those cases a single string literal may be broken up into
+    * multiple adjacent string literals.
+    *
+    * It recognizes C, C++, and shell style comments.
+    *
+    * @param {Object} options a set of optional parameters.
+    * @return {function (Object)} a function that examines the source code
+    *     in the input job and builds the decoration list.
+    */
+  function sourceDecorator(options) {
+    var shortcutStylePatterns = [], fallthroughStylePatterns = [];
+    if (options['tripleQuotedStrings']) {
+      // '''multi-line-string''', 'single-line-string', and double-quoted
+      shortcutStylePatterns.push(
+          [PR_STRING,  /^(?:\'\'\'(?:[^\'\\]|\\[\s\S]|\'{1,2}(?=[^\']))*(?:\'\'\'|$)|\"\"\"(?:[^\"\\]|\\[\s\S]|\"{1,2}(?=[^\"]))*(?:\"\"\"|$)|\'(?:[^\\\']|\\[\s\S])*(?:\'|$)|\"(?:[^\\\"]|\\[\s\S])*(?:\"|$))/,
+           null, '\'"']);
+    } else if (options['multiLineStrings']) {
+      // 'multi-line-string', "multi-line-string"
+      shortcutStylePatterns.push(
+          [PR_STRING,  /^(?:\'(?:[^\\\']|\\[\s\S])*(?:\'|$)|\"(?:[^\\\"]|\\[\s\S])*(?:\"|$)|\`(?:[^\\\`]|\\[\s\S])*(?:\`|$))/,
+           null, '\'"`']);
+    } else {
+      // 'single-line-string', "single-line-string"
+      shortcutStylePatterns.push(
+          [PR_STRING,
+           /^(?:\'(?:[^\\\'\r\n]|\\.)*(?:\'|$)|\"(?:[^\\\"\r\n]|\\.)*(?:\"|$))/,
+           null, '"\'']);
+    }
+    if (options['verbatimStrings']) {
+      // verbatim-string-literal production from the C# grammar.  See issue 93.
+      fallthroughStylePatterns.push(
+          [PR_STRING, /^@\"(?:[^\"]|\"\")*(?:\"|$)/, null]);
+    }
+    var hc = options['hashComments'];
+    if (hc) {
+      if (options['cStyleComments']) {
+        if (hc > 1) {  // multiline hash comments
+          shortcutStylePatterns.push(
+              [PR_COMMENT, /^#(?:##(?:[^#]|#(?!##))*(?:###|$)|.*)/, null, '#']);
+        } else {
+          // Stop C preprocessor declarations at an unclosed open comment
+          shortcutStylePatterns.push(
+              [PR_COMMENT, /^#(?:(?:define|elif|else|endif|error|ifdef|include|ifndef|line|pragma|undef|warning)\b|[^\r\n]*)/,
+               null, '#']);
+        }
+        // #include <stdio.h>
+        fallthroughStylePatterns.push(
+            [PR_STRING,
+             /^<(?:(?:(?:\.\.\/)*|\/?)(?:[\w-]+(?:\/[\w-]+)+)?[\w-]+\.h(?:h|pp|\+\+)?|[a-z]\w*)>/,
+             null]);
+      } else {
+        shortcutStylePatterns.push([PR_COMMENT, /^#[^\r\n]*/, null, '#']);
+      }
+    }
+    if (options['cStyleComments']) {
+      fallthroughStylePatterns.push([PR_COMMENT, /^\/\/[^\r\n]*/, null]);
+      fallthroughStylePatterns.push(
+          [PR_COMMENT, /^\/\*[\s\S]*?(?:\*\/|$)/, null]);
+    }
+    if (options['regexLiterals']) {
+      /**
+       * @const
+       */
+      var REGEX_LITERAL = (
+          // A regular expression literal starts with a slash that is
+          // not followed by * or / so that it is not confused with
+          // comments.
+          '/(?=[^/*])'
+          // and then contains any number of raw characters,
+          + '(?:[^/\\x5B\\x5C]'
+          // escape sequences (\x5C),
+          +    '|\\x5C[\\s\\S]'
+          // or non-nesting character sets (\x5B\x5D);
+          +    '|\\x5B(?:[^\\x5C\\x5D]|\\x5C[\\s\\S])*(?:\\x5D|$))+'
+          // finally closed by a /.
+          + '/');
+      fallthroughStylePatterns.push(
+          ['lang-regex',
+           new RegExp('^' + REGEXP_PRECEDER_PATTERN + '(' + REGEX_LITERAL + ')')
+           ]);
+    }
+
+    var types = options['types'];
+    if (types) {
+      fallthroughStylePatterns.push([PR_TYPE, types]);
+    }
+
+    if (options['strings']) {
+        var strings = ("" + options['strings']).replace(/^ | $/g, '').replace(/-/g, '\\-');
+        fallthroughStylePatterns.push(
+            [PR_STRING,
+            new RegExp('(?:' + strings.replace(/[\s,]+/g, '|') + ')'),
+            , null]
+        );
+    }
+    
+    var keywords = ("" + options['keywords']).replace(/^ | $/g, '');
+    if (keywords.length) {
+      fallthroughStylePatterns.push(
+          [PR_KEYWORD,
+           new RegExp('^(?:' + keywords.replace(/[\s,]+/g, '|') + ')\\b'),
+           null]);
+    }
+
+    shortcutStylePatterns.push([PR_PLAIN,       /^\s+/, null, ' \r\n\t\xA0']);
+    if (options['httpdComments']) {
+        fallthroughStylePatterns.push(
+            [PR_PLAIN,     /^.*\S.*#/i, null]
+        );
+    }
+    
+    fallthroughStylePatterns.push(
+        // TODO(mikesamuel): recognize non-latin letters and numerals in idents
+        [PR_LITERAL,     /^@[a-z_$][a-z_$@0-9]*|\bNULL\b/i, null],
+        [PR_LITERAL,     CONFIG_OPTIONS, null],
+        //[PR_STRING,     CONFIG_ENVS, null],
+        [PR_TAG,     /^\b(AuthzProviderAlias|AuthnProviderAlias|RequireAny|RequireAll|RequireNone|Directory|DirectoryMatch|Location|LocationMatch|VirtualHost|If|Else|ElseIf|Proxy\b|LoadBalancer|Files|FilesMatch|Limit|LimitExcept|IfDefine|IfModule|IfVersion)\b/, null],
+        [PR_TYPE,        /^(?:[@_]?[A-Z]+[a-z][A-Za-z_$@0-9]*|\w+_(t|req|module)\b)/, null],
+        [PR_TAG,     /^apr_[a-z_0-9]+|ap_[a-z_0-9]+/i, null],
+        [PR_PLAIN,       /^[a-z_$][a-z_$@0-9\-]*/i, null],
+        [PR_LITERAL,
+         new RegExp(
+             '^(?:'
+             // A hex number
+             + '0x[a-f0-9]+'
+             // An IPv6 Address
+             + '|[a-f0-9:]+:[a-f0-9:]+:[a-f0-9:]+:[a-f0-9:]+:[a-f0-9:]+:[a-f0-9:]+'
+             // or an octal or decimal number,
+             + '|(?:\\d(?:_\\d+)*\\d*(?:\\.\\d*)?|\\.\\d\\+)'
+             // possibly in scientific notation
+             + '(?:e[+\\-]?\\d+)?'
+             + ')'
+             // with an optional modifier like UL for unsigned long
+             + '[a-z]*', 'i'),
+         null, '0123456789'],
+        // Don't treat escaped quotes in bash as starting strings.  See issue 144.
+        [PR_PLAIN,       /^\\[\s\S]?/, null],
+        [PR_PUNCTUATION, /^.[^\s\w\.$@\'\"\`\/\#\\]*/, null]);
+
+    return createSimpleLexer(shortcutStylePatterns, fallthroughStylePatterns);
+  }
+
+  var decorateSource = sourceDecorator({
+        'keywords': ALL_KEYWORDS,
+        'hashComments': true,
+        'cStyleComments': true,
+        'multiLineStrings': true,
+        'regexLiterals': true
+      });
+
+  /**
+   * Given a DOM subtree, wraps it in a list, and puts each line into its own
+   * list item.
+   *
+   * @param {Node} node modified in place.  Its content is pulled into an
+   *     HTMLOListElement, and each line is moved into a separate list item.
+   *     This requires cloning elements, so the input might not have unique
+   *     IDs after numbering.
+   * @param {boolean} isPreformatted true iff white-space in text nodes should
+   *     be treated as significant.
+   */
+  function numberLines(node, opt_startLineNum, isPreformatted) {
+    var nocode = /(?:^|\s)nocode(?:\s|$)/;
+    var lineBreak = /\r\n?|\n/;
+  
+    var document = node.ownerDocument;
+  
+    var li = document.createElement('li');
+    while (node.firstChild) {
+      li.appendChild(node.firstChild);
+    }
+    // An array of lines.  We split below, so this is initialized to one
+    // un-split line.
+    var listItems = [li];
+  
+    function walk(node) {
+      switch (node.nodeType) {
+        case 1:  // Element
+          if (nocode.test(node.className)) { break; }
+          if ('br' === node.nodeName) {
+            breakAfter(node);
+            // Discard the <BR> since it is now flush against a </LI>.
+            if (node.parentNode) {
+              node.parentNode.removeChild(node);
+            }
+          } else {
+            for (var child = node.firstChild; child; child = child.nextSibling) {
+              walk(child);
+            }
+          }
+          break;
+        case 3: case 4:  // Text
+          if (isPreformatted) {
+            var text = node.nodeValue;
+            var match = text.match(lineBreak);
+            if (match) {
+              var firstLine = text.substring(0, match.index);
+              node.nodeValue = firstLine;
+              var tail = text.substring(match.index + match[0].length);
+              if (tail) {
+                var parent = node.parentNode;
+                parent.insertBefore(
+                    document.createTextNode(tail), node.nextSibling);
+              }
+              breakAfter(node);
+              if (!firstLine) {
+                // Don't leave blank text nodes in the DOM.
+                node.parentNode.removeChild(node);
+              }
+            }
+          }
+          break;
+      }
+    }
+  
+    // Split a line after the given node.
+    function breakAfter(lineEndNode) {
+      // If there's nothing to the right, then we can skip ending the line
+      // here, and move root-wards since splitting just before an end-tag
+      // would require us to create a bunch of empty copies.
+      while (!lineEndNode.nextSibling) {
+        lineEndNode = lineEndNode.parentNode;
+        if (!lineEndNode) { return; }
+      }
+  
+      function breakLeftOf(limit, copy) {
+        // Clone shallowly if this node needs to be on both sides of the break.
+        var rightSide = copy ? limit.cloneNode(false) : limit;
+        var parent = limit.parentNode;
+        if (parent) {
+          // We clone the parent chain.
+          // This helps us resurrect important styling elements that cross lines.
+          // E.g. in <i>Foo<br>Bar</i>
+          // should be rewritten to <li><i>Foo</i></li><li><i>Bar</i></li>.
+          var parentClone = breakLeftOf(parent, 1);
+          // Move the clone and everything to the right of the original
+          // onto the cloned parent.
+          var next = limit.nextSibling;
+          parentClone.appendChild(rightSide);
+          for (var sibling = next; sibling; sibling = next) {
+            next = sibling.nextSibling;
+            parentClone.appendChild(sibling);
+          }
+        }
+        return rightSide;
+      }
+  
+      var copiedListItem = breakLeftOf(lineEndNode.nextSibling, 0);
+  
+      // Walk the parent chain until we reach an unattached LI.
+      for (var parent;
+           // Check nodeType since IE invents document fragments.
+           (parent = copiedListItem.parentNode) && parent.nodeType === 1;) {
+        copiedListItem = parent;
+      }
+      // Put it on the list of lines for later processing.
+      listItems.push(copiedListItem);
+    }
+  
+    // Split lines while there are lines left to split.
+    for (var i = 0;  // Number of lines that have been split so far.
+         i < listItems.length;  // length updated by breakAfter calls.
+         ++i) {
+      walk(listItems[i]);
+    }
+  
+    // Make sure numeric indices show correctly.
+    if (opt_startLineNum === (opt_startLineNum|0)) {
+      listItems[0].setAttribute('value', opt_startLineNum);
+    }
+  
+    var ol = document.createElement('ol');
+    ol.className = 'linenums';
+    var offset = Math.max(0, ((opt_startLineNum - 1 /* zero index */)) | 0) || 0;
+    for (var i = 0, n = listItems.length; i < n; ++i) {
+      li = listItems[i];
+      // Stick a class on the LIs so that stylesheets can
+      // color odd/even rows, or any other row pattern that
+      // is co-prime with 10.
+      li.className = 'L' + ((i + offset) % 1);
+      if (!li.firstChild) {
+        li.appendChild(document.createTextNode('\xA0'));
+      }
+      ol.appendChild(li);
+    }
+  
+    node.appendChild(ol);
+  }
+
+  /**
+   * Breaks {@code job.sourceCode} around style boundaries in
+   * {@code job.decorations} and modifies {@code job.sourceNode} in place.
+   * @param {Object} job like <pre>{
+   *    sourceCode: {string} source as plain text,
+   *    spans: {Array.<number|Node>} alternating span start indices into source
+   *       and the text node or element (e.g. {@code <BR>}) corresponding to that
+   *       span.
+   *    decorations: {Array.<number|string} an array of style classes preceded
+   *       by the position at which they start in job.sourceCode in order
+   * }</pre>
+   * @private
+   */
+  function recombineTagsAndDecorations(job) {
+    var isIE8OrEarlier = /\bMSIE\s(\d+)/.exec(navigator.userAgent);
+    isIE8OrEarlier = isIE8OrEarlier && +isIE8OrEarlier[1] <= 8;
+    var newlineRe = /\n/g;
+  
+    var source = job.sourceCode;
+    var sourceLength = source.length;
+    // Index into source after the last code-unit recombined.
+    var sourceIndex = 0;
+  
+    var spans = job.spans;
+    var nSpans = spans.length;
+    // Index into spans after the last span which ends at or before sourceIndex.
+    var spanIndex = 0;
+  
+    var decorations = job.decorations;
+    var nDecorations = decorations.length;
+    // Index into decorations after the last decoration which ends at or before
+    // sourceIndex.
+    var decorationIndex = 0;
+  
+    // Remove all zero-length decorations.
+    decorations[nDecorations] = sourceLength;
+    var decPos, i;
+    for (i = decPos = 0; i < nDecorations;) {
+      if (decorations[i] !== decorations[i + 2]) {
+        decorations[decPos++] = decorations[i++];
+        decorations[decPos++] = decorations[i++];
+      } else {
+        i += 2;
+      }
+    }
+    nDecorations = decPos;
+  
+    // Simplify decorations.
+    for (i = decPos = 0; i < nDecorations;) {
+      var startPos = decorations[i];
+      // Conflate all adjacent decorations that use the same style.
+      var startDec = decorations[i + 1];
+      var end = i + 2;
+      while (end + 2 <= nDecorations && decorations[end + 1] === startDec) {
+        end += 2;
+      }
+      decorations[decPos++] = startPos;
+      decorations[decPos++] = startDec;
+      i = end;
+    }
+  
+    nDecorations = decorations.length = decPos;
+  
+    var sourceNode = job.sourceNode;
+    var oldDisplay;
+    if (sourceNode) {
+      oldDisplay = sourceNode.style.display;
+      sourceNode.style.display = 'none';
+    }
+    try {
+      var decoration = null;
+      var X = 0;
+      while (spanIndex < nSpans) {
+        X = X + 1;
+        if (X > 5000) { break; }
+        var spanStart = spans[spanIndex];
+        var spanEnd = spans[spanIndex + 2] || sourceLength;
+  
+        var decEnd = decorations[decorationIndex + 2] || sourceLength;
+  
+        var end = Math.min(spanEnd, decEnd);
+  
+        var textNode = spans[spanIndex + 1];
+        var styledText;
+        if (textNode.nodeType !== 1  // Don't muck with <BR>s or <LI>s
+            // Don't introduce spans around empty text nodes.
+            && (styledText = source.substring(sourceIndex, end))) {
+          // This may seem bizarre, and it is.  Emitting LF on IE causes the
+          // code to display with spaces instead of line breaks.
+          // Emitting Windows standard issue linebreaks (CRLF) causes a blank
+          // space to appear at the beginning of every line but the first.
+          // Emitting an old Mac OS 9 line separator makes everything spiffy.
+          if (isIE8OrEarlier) {
+            styledText = styledText.replace(newlineRe, '\r');
+          }
+          textNode.nodeValue = styledText;
+          var document = textNode.ownerDocument;
+          var span = document.createElement('span');
+          span.className = decorations[decorationIndex + 1];
+          var parentNode = textNode.parentNode;
+          parentNode.replaceChild(span, textNode);
+          span.appendChild(textNode);
+          if (sourceIndex < spanEnd) {  // Split off a text node.
+            spans[spanIndex + 1] = textNode
+                // TODO: Possibly optimize by using '' if there's no flicker.
+                = document.createTextNode(source.substring(end, spanEnd));
+            parentNode.insertBefore(textNode, span.nextSibling);
+          }
+        }
+  
+        sourceIndex = end;
+  
+        if (sourceIndex >= spanEnd) {
+          spanIndex += 2;
+        }
+        if (sourceIndex >= decEnd) {
+          decorationIndex += 2;
+        }
+      }
+    } finally {
+      if (sourceNode) {
+        sourceNode.style.display = oldDisplay;
+      }
+    }
+  }
+
+
+  /** Maps language-specific file extensions to handlers. */
+  var langHandlerRegistry = {};
+  /** Register a language handler for the given file extensions.
+    * @param {function (Object)} handler a function from source code to a list
+    *      of decorations.  Takes a single argument job which describes the
+    *      state of the computation.   The single parameter has the form
+    *      {@code {
+    *        sourceCode: {string} as plain text.
+    *        decorations: {Array.<number|string>} an array of style classes
+    *                     preceded by the position at which they start in
+    *                     job.sourceCode in order.
+    *                     The language handler should assigned this field.
+    *        basePos: {int} the position of source in the larger source chunk.
+    *                 All positions in the output decorations array are relative
+    *                 to the larger source chunk.
+    *      } }
+    * @param {Array.<string>} fileExtensions
+    */
+  function registerLangHandler(handler, fileExtensions) {
+    for (var i = fileExtensions.length; --i >= 0;) {
+      var ext = fileExtensions[i];
+      if (!langHandlerRegistry.hasOwnProperty(ext)) {
+        langHandlerRegistry[ext] = handler;
+      } else if (win['console']) {
+        console['warn']('cannot override language handler %s', ext);
+      }
+    }
+  }
+  function langHandlerForExtension(extension, source) {
+    if (!(extension && langHandlerRegistry.hasOwnProperty(extension))) {
+      // Treat it as markup if the first non whitespace character is a < and
+      // the last non-whitespace character is a >.
+      extension = /^\s*</.test(source)
+          ? 'default-markup'
+          : 'default-code';
+    }
+    return langHandlerRegistry[extension];
+  }
+  registerLangHandler(decorateSource, ['default-code']);
+  registerLangHandler(
+      createSimpleLexer(
+          [],
+          [
+           [PR_PLAIN,       /^[^<?]+/],
+           [PR_DECLARATION, /^<!\w[^>]*(?:>|$)/],
+           [PR_COMMENT,     /^<\!--[\s\S]*?(?:-\->|$)/],
+           // Unescaped content in an unknown language
+           ['lang-',        /^<\?([\s\S]+?)(?:\?>|$)/],
+           ['lang-',        /^<%([\s\S]+?)(?:%>|$)/],
+           [PR_PUNCTUATION, /^(?:<[%?]|[%?]>)/],
+           ['lang-',        /^<xmp\b[^>]*>([\s\S]+?)<\/xmp\b[^>]*>/i],
+           // Unescaped content in javascript.  (Or possibly vbscript).
+           ['lang-js',      /^<script\b[^>]*>([\s\S]*?)(<\/script\b[^>]*>)/i],
+           // Contains unescaped stylesheet content
+           ['lang-css',     /^<style\b[^>]*>([\s\S]*?)(<\/style\b[^>]*>)/i],
+           ['lang-in.tag',  /^(<\/?[a-z][^<>]*>)/i]
+          ]),
+      ['default-markup', 'htm', 'html', 'mxml', 'xhtml', 'xml', 'xsl']);
+  registerLangHandler(
+      createSimpleLexer(
+          [
+           [PR_PLAIN,        /^[\s]+/, null, ' \t\r\n'],
+           [PR_ATTRIB_VALUE, /^(?:\"[^\"]*\"?|\'[^\']*\'?)/, null, '\"\'']
+           ],
+          [
+           [PR_TAG,          /^^<\/?[a-z](?:[\w.:-]*\w)?|\/?>$/i],
+           [PR_ATTRIB_NAME,  /^(?!style[\s=]|on)[a-z](?:[\w:-]*\w)?/i],
+           ['lang-uq.val',   /^=\s*([^>\'\"\s]*(?:[^>\'\"\s\/]|\/(?=\s)))/],
+           [PR_PUNCTUATION,  /^[=<>\/]+/],
+           ['lang-js',       /^on\w+\s*=\s*\"([^\"]+)\"/i],
+           ['lang-js',       /^on\w+\s*=\s*\'([^\']+)\'/i],
+           ['lang-js',       /^on\w+\s*=\s*([^\"\'>\s]+)/i],
+           ['lang-css',      /^style\s*=\s*\"([^\"]+)\"/i],
+           ['lang-css',      /^style\s*=\s*\'([^\']+)\'/i],
+           ['lang-css',      /^style\s*=\s*([^\"\'>\s]+)/i]
+           ]),
+      ['in.tag']);
+  registerLangHandler(
+      createSimpleLexer([], [[PR_ATTRIB_VALUE, /^[\s\S]+/]]), ['uq.val']);
+  registerLangHandler(sourceDecorator({
+          'keywords': CPP_KEYWORDS,
+          'hashComments': true,
+          'cStyleComments': true,
+          'types': C_TYPES
+        }), ['c', 'cc', 'cpp', 'cxx', 'cyc', 'm']);
+  registerLangHandler(sourceDecorator({
+          'keywords': PHP_KEYWORDS,
+          'hashComments': false,
+          'cStyleComments': true,
+          'multiLineStrings': true,
+          'regexLiterals': true
+//          'types': C_TYPES,
+        }), ['php', 'phtml', 'inc']);
+  registerLangHandler(sourceDecorator({
+          'keywords': 'null,true,false'
+        }), ['json']);
+  registerLangHandler(sourceDecorator({
+          'keywords': CSHARP_KEYWORDS,
+          'hashComments': true,
+          'cStyleComments': true,
+          'verbatimStrings': true,
+          'types': C_TYPES
+        }), ['cs']);
+  registerLangHandler(sourceDecorator({
+          'keywords': JAVA_KEYWORDS,
+          'cStyleComments': true
+        }), ['java']);
+  registerLangHandler(sourceDecorator({
+          'keywords': SH_KEYWORDS,
+          'hashComments': true,
+          'multiLineStrings': true
+        }), ['bsh', 'csh', 'sh']);
+  registerLangHandler(sourceDecorator({
+          'keywords': PYTHON_KEYWORDS,
+          'hashComments': true,
+          'multiLineStrings': true,
+          'tripleQuotedStrings': true
+        }), ['cv', 'py']);
+  registerLangHandler(sourceDecorator({
+          'keywords': PERL_KEYWORDS,
+          'hashComments': true,
+          'multiLineStrings': true,
+          'regexLiterals': true
+        }), ['perl', 'pl', 'pm']);
+  registerLangHandler(sourceDecorator({
+          'keywords': RUBY_KEYWORDS,
+          'hashComments': true,
+          'multiLineStrings': true,
+          'regexLiterals': true
+        }), ['rb']);
+  registerLangHandler(sourceDecorator({
+          'keywords': JSCRIPT_KEYWORDS,
+          'cStyleComments': true,
+          'regexLiterals': true
+        }), ['js']);
+  registerLangHandler(sourceDecorator({
+          'keywords': COFFEE_KEYWORDS,
+          'hashComments': 3,  // ### style block comments
+          'cStyleComments': true,
+          'multilineStrings': true,
+          'tripleQuotedStrings': true,
+          'regexLiterals': true
+        }), ['coffee']);
+  registerLangHandler(
+      createSimpleLexer([], [[PR_STRING, /^[\s\S]+/]]), ['regex']);
+  registerLangHandler(sourceDecorator({
+          'keywords': CONFIG_KEYWORDS,
+          'literals': CONFIG_OPTIONS,
+          'strings': CONFIG_ENVS,
+          'hashComments': true,
+          'cStyleComments': false,
+          'multiLineStrings': false,
+          'regexLiterals': false,
+          'httpdComments': true
+        }), ['config']);
+
+  function applyDecorator(job) {
+    var opt_langExtension = job.langExtension;
+
+    try {
+      // Extract tags, and convert the source code to plain text.
+      var sourceAndSpans = extractSourceSpans(job.sourceNode, job.pre);
+      /** Plain text. @type {string} */
+      var source = sourceAndSpans.sourceCode;
+      job.sourceCode = source;
+      job.spans = sourceAndSpans.spans;
+      job.basePos = 0;
+
+      // Apply the appropriate language handler
+      langHandlerForExtension(opt_langExtension, source)(job);
+
+      // Integrate the decorations and tags back into the source code,
+      // modifying the sourceNode in place.
+      recombineTagsAndDecorations(job);
+    } catch (e) {
+      if (win['console']) {
+        console['log'](e && e['stack'] ? e['stack'] : e);
+      }
+    }
+  }
+
+  /**
+   * @param sourceCodeHtml {string} The HTML to pretty print.
+   * @param opt_langExtension {string} The language name to use.
+   *     Typically, a filename extension like 'cpp' or 'java'.
+   * @param opt_numberLines {number|boolean} True to number lines,
+   *     or the 1-indexed number of the first line in sourceCodeHtml.
+   */
+  function prettyPrintOne(sourceCodeHtml, opt_langExtension, opt_numberLines) {
+    var container = document.createElement('pre');
+    // This could cause images to load and onload listeners to fire.
+    // E.g. <img onerror="alert(1337)" src="nosuchimage.png">.
+    // We assume that the inner HTML is from a trusted source.
+    container.innerHTML = sourceCodeHtml;
+    if (opt_numberLines) {
+      numberLines(container, opt_numberLines, true);
+    }
+
+    var job = {
+      langExtension: opt_langExtension,
+      numberLines: opt_numberLines,
+      sourceNode: container,
+      pre: 1
+    };
+    applyDecorator(job);
+    return container.innerHTML;
+  }
+
+  function prettyPrint(opt_whenDone) {
+    function byTagName(tn) { return document.getElementsByTagName(tn); }
+    // fetch a list of nodes to rewrite
+    var codeSegments = [byTagName('pre'), byTagName('code'), byTagName('xmp')];
+    var elements = [];
+    for (var i = 0; i < codeSegments.length; ++i) {
+      for (var j = 0, n = codeSegments[i].length; j < n; ++j) {
+        elements.push(codeSegments[i][j]);
+      }
+    }
+    codeSegments = null;
+
+    var clock = Date;
+    if (!clock['now']) {
+      clock = { 'now': function () { return +(new Date); } };
+    }
+
+    // The loop is broken into a series of continuations to make sure that we
+    // don't make the browser unresponsive when rewriting a large page.
+    var k = 0;
+    var prettyPrintingJob;
+
+    var langExtensionRe = /\blang(?:uage)?-([\w.]+)(?!\S)/;
+    var prettyPrintRe = /\bprettyprint\b/;
+    var prettyPrintedRe = /\bprettyprinted\b/;
+    var preformattedTagNameRe = /pre|xmp/i;
+    var codeRe = /^code$/i;
+    var preCodeXmpRe = /^(?:pre|code|xmp)$/i;
+
+    function doWork() {
+      var endTime = (win['PR_SHOULD_USE_CONTINUATION'] ?
+                     clock['now']() + 250 /* ms */ :
+                     Infinity);
+      for (; k < elements.length && clock['now']() < endTime; k++) {
+        var cs = elements[k];
+        var className = cs.className;
+        if (prettyPrintRe.test(className)
+            // Don't redo this if we've already done it.
+            // This allows recalling pretty print to just prettyprint elements
+            // that have been added to the page since last call.
+            && !prettyPrintedRe.test(className)) {
+
+          // make sure this is not nested in an already prettified element
+          var nested = false;
+          for (var p = cs.parentNode; p; p = p.parentNode) {
+            var tn = p.tagName;
+            if (preCodeXmpRe.test(tn)
+                && p.className && prettyPrintRe.test(p.className)) {
+              nested = true;
+              break;
+            }
+          }
+          if (!nested) {
+            // Mark done.  If we fail to prettyprint for whatever reason,
+            // we shouldn't try again.
+            cs.className += ' prettyprinted';
+
+            // If the classes includes a language extensions, use it.
+            // Language extensions can be specified like
+            //     <pre class="prettyprint lang-cpp">
+            // the language extension "cpp" is used to find a language handler
+            // as passed to PR.registerLangHandler.
+            // HTML5 recommends that a language be specified using "language-"
+            // as the prefix instead.  Google Code Prettify supports both.
+            // http://dev.w3.org/html5/spec-author-view/the-code-element.html
+            var langExtension = className.match(langExtensionRe);
+            // Support <pre class="prettyprint"><code class="language-c">
+            var wrapper;
+            if (!langExtension && (wrapper = childContentWrapper(cs))
+                && codeRe.test(wrapper.tagName)) {
+              langExtension = wrapper.className.match(langExtensionRe);
+            }
+
+            if (langExtension) { langExtension = langExtension[1]; }
+
+            var preformatted;
+            if (preformattedTagNameRe.test(cs.tagName)) {
+              preformatted = 1;
+            } else {
+              var currentStyle = cs['currentStyle'];
+              var whitespace = (
+                  currentStyle
+                  ? currentStyle['whiteSpace']
+                  : (document.defaultView
+                     && document.defaultView.getComputedStyle)
+                  ? document.defaultView.getComputedStyle(cs, null)
+                  .getPropertyValue('white-space')
+                  : 0);
+              preformatted = whitespace
+                  && 'pre' === whitespace.substring(0, 3);
+            }
+
+            // Look for a class like linenums or linenums:<n> where <n> is the
+            // 1-indexed number of the first line.
+            var lineNums = cs.className.match(/\blinenums\b(?::(\d+))?/);
+            lineNums = lineNums
+                ? lineNums[1] && lineNums[1].length ? +lineNums[1] : true
+                : false;
+            if (lineNums) { numberLines(cs, lineNums, preformatted); }
+
+            // do the pretty printing
+            prettyPrintingJob = {
+              langExtension: langExtension,
+              sourceNode: cs,
+              numberLines: lineNums,
+              pre: preformatted
+            };
+            applyDecorator(prettyPrintingJob);
+          }
+        }
+      }
+      if (k < elements.length) {
+        // finish up in a continuation
+        setTimeout(doWork, 250);
+      } else if (opt_whenDone) {
+        opt_whenDone();
+      }
+    }
+
+    doWork();
+  }
+
+  /**
+   * Contains functions for creating and registering new language handlers.
+   * @type {Object}
+   */
+  var PR = win['PR'] = {
+        'createSimpleLexer': createSimpleLexer,
+        'registerLangHandler': registerLangHandler,
+        'sourceDecorator': sourceDecorator,
+        'PR_ATTRIB_NAME': PR_ATTRIB_NAME,
+        'PR_ATTRIB_VALUE': PR_ATTRIB_VALUE,
+        'PR_COMMENT': PR_COMMENT,
+        'PR_DECLARATION': PR_DECLARATION,
+        'PR_KEYWORD': PR_KEYWORD,
+        'PR_LITERAL': PR_LITERAL,
+        'PR_NOCODE': PR_NOCODE,
+        'PR_PLAIN': PR_PLAIN,
+        'PR_PUNCTUATION': PR_PUNCTUATION,
+        'PR_SOURCE': PR_SOURCE,
+        'PR_STRING': PR_STRING,
+        'PR_TAG': PR_TAG,
+        'PR_TYPE': PR_TYPE,
+        'prettyPrintOne': win['prettyPrintOne'] = prettyPrintOne,
+        'prettyPrint': win['prettyPrint'] = prettyPrint
+      };
+   
+
+/* Register Lua syntaxes */   
+   PR['registerLangHandler'](
+    PR['createSimpleLexer'](
+        [
+         // Whitespace
+         [PR['PR_PLAIN'],       /^[\t\n\r \xA0]+/, null, '\t\n\r \xA0'],
+         // A double or single quoted, possibly multi-line, string.
+         [PR['PR_STRING'],      /^(?:\"(?:[^\"\\]|\\[\s\S])*(?:\"|$)|\'(?:[^\'\\]|\\[\s\S])*(?:\'|$))/, null, '"\'']
+        ],
+        [
+         // A comment is either a line comment that starts with two dashes, or
+         // two dashes preceding a long bracketed block.
+         [PR['PR_COMMENT'], /^--(?:\[(=*)\[[\s\S]*?(?:\]\1\]|$)|[^\r\n]*)/],
+         [PR['PR_TYPE'], /^nil|false|true/],
+         // A long bracketed block not preceded by -- is a string.
+         [PR['PR_STRING'],  /^\[(=*)\[[\s\S]*?(?:\]\1\]|$)/],
+         [PR['PR_KEYWORD'], /^(?:and|break|do|else|elseif|end|for|function|if|in|local|not|or|repeat|require|return|then|until|while)\b/, null],
+         // A number is a hex integer literal, a decimal real literal, or in
+         // scientific notation.
+         [PR['PR_LITERAL'],
+          /^[+-]?(?:0x[\da-f]+|(?:(?:\.\d+|\d+(?:\.\d*)?)(?:e[+\-]?\d+)?))/i],
+         // An identifier
+         [PR['PR_PLAIN'], /^[a-z_]\w*/i],
+         // A run of punctuation
+         [PR['PR_PUNCTUATION'], /^[^\w\t\n\r \xA0][^\w\t\n\r \xA0\"\'\-\+=]*/]
+        ]),
+    ['lua']);
+
+
+  // Make PR available via the Asynchronous Module Definition (AMD) API.
+  // Per https://github.com/amdjs/amdjs-api/wiki/AMD:
+  // The Asynchronous Module Definition (AMD) API specifies a
+  // mechanism for defining modules such that the module and its
+  // dependencies can be asynchronously loaded.
+  // ...
+  // To allow a clear indicator that a global define function (as
+  // needed for script src browser loading) conforms to the AMD API,
+  // any global define function SHOULD have a property called "amd"
+  // whose value is an object. This helps avoid conflict with any
+  // other existing JavaScript code that could have defined a define()
+  // function that does not conform to the AMD API.
+  if (typeof define === "function" && define['amd']) {
+    define("google-code-prettify", [], function () {
+      return PR; 
+    });
+  }
+})();
diff --git a/docs/manual/style/scripts/prettify.min.js b/docs/manual/style/scripts/prettify.min.js
new file mode 100644
index 0000000..adb92be
--- /dev/null
+++ b/docs/manual/style/scripts/prettify.min.js
@@ -0,0 +1,123 @@
+// see prettify.js for copyright, license and expanded version
+window['PR_SHOULD_USE_CONTINUATION']=true;var prettyPrintOne;var prettyPrint;(function(){var win=window;var FLOW_CONTROL_KEYWORDS=["break,continue,do,else,for,if,return,while"];var C_KEYWORDS=[FLOW_CONTROL_KEYWORDS,"auto,case,char,const,default,"+"double,enum,extern,float,goto,int,long,register,short,signed,sizeof,module,"+"static,struct,switch,typedef,union,unsigned,void,volatile"];var COMMON_KEYWORDS=[C_KEYWORDS,"catch,class,delete,false,import,"+"new,operator,private,protected,public,this,throw,true,try,typeof"];var CPP_KEYWORDS=[COMMON_KEYWORDS,"alignof,align_union,asm,axiom,bool,"+"concept,concept_map,const_cast,constexpr,decltype,"+"dynamic_cast,explicit,export,friend,inline,late_check,"+"mutable,namespace,nullptr,reinterpret_cast,static_assert,static_cast,"+"template,typeid,typename,using,virtual,where,request_req"];var JAVA_KEYWORDS=[COMMON_KEYWORDS,"abstract,boolean,byte,extends,final,finally,implements,import,"+"instanceof,null,native,package,strictfp,super,synchronized,throws,"+"transient"];var CSHARP_KEYWORDS=[JAVA_KEYWORDS,"as,base,by,checked,decimal,delegate,descending,dynamic,event,"+"fixed,foreach,from,group,implicit,in,interface,internal,into,is,let,"+"lock,object,out,override,orderby,params,partial,readonly,ref,sbyte,"+"sealed,stackalloc,string,select,uint,ulong,unchecked,unsafe,ushort,"+"var,virtual,where"];var COFFEE_KEYWORDS="all,and,by,catch,class,else,extends,false,finally,"+"for,if,in,is,isnt,loop,new,no,not,null,of,off,on,or,return,super,then,"+"throw,true,try,unless,until,when,while,yes";var JSCRIPT_KEYWORDS=[COMMON_KEYWORDS,"debugger,eval,export,function,get,null,set,undefined,var,with,"+"Infinity,NaN"];var PERL_KEYWORDS="caller,delete,die,do,dump,else,elsif,eval,exit,foreach,for,"+"goto,if,import,last,local,my,next,no,our,print,printf,package,redo,require,"+"sub,undef,unless,until,use,wantarray,while,BEGIN,END";var PHP_KEYWORDS="abstract,and,array,as,break,case,catch,cfunction,class,"+"clone,const,continue,declare,default,do,else,elseif,enddeclare,endfor,"+"endforeach,endif,endswitch,endwhile,extends,final,for,foreach,function,"+"global,goto,if,implements,interface,instanceof,namespace,new,old_function,"+"or,private,protected,public,static,switch,throw,try,use,var,while,xor,"+"die,echo,empty,exit,eval,include,include_once,isset,list,require,"+"require_once,return,print,unset";var PYTHON_KEYWORDS=[FLOW_CONTROL_KEYWORDS,"and,as,assert,class,def,del,"+"elif,except,exec,finally,from,global,import,in,is,lambda,"+"nonlocal,not,or,pass,print,raise,try,with,yield,"+"False,True,None"];var RUBY_KEYWORDS=[FLOW_CONTROL_KEYWORDS,"alias,and,begin,case,class,"+"def,defined,elsif,end,ensure,false,in,module,next,nil,not,or,redo,"+"rescue,retry,self,super,then,true,undef,unless,until,when,yield,"+"BEGIN,END"];var SH_KEYWORDS=[FLOW_CONTROL_KEYWORDS,"case,done,elif,esac,eval,fi,"+"function,in,local,set,then,until,echo"];var CONFIG_ENVS=["User-Agent,HTTP_USER_AGENT,HTTP_REFERER,HTTP_COOKIE,HTTP_FORWARDED,HTTP_HOST,HTTP_PROXY_CONNECTION,HTTP_ACCEPT,REMOTE_ADDR,REMOTE_HOST,REMOTE_PORT,REMOTE_USER,REMOTE_IDENT,REQUEST_METHOD,SCRIPT_FILENAME,PATH_INFO,QUERY_STRING,AUTH_TYPE,DOCUMENT_ROOT,SERVER_ADMIN,SERVER_NAME,SERVER_ADDR,SERVER_PORT,SERVER_PROTOCOL,SERVER_SOFTWARE,TIME_YEAR,TIME_MON,TIME_DAY,TIME_HOUR,TIME_MIN,TIME_SEC,TIME_WDAY,TIME,API_VERSION,THE_REQUEST,REQUEST_URI,REQUEST_FILENAME,IS_SUBREQ,HTTPS,REQUEST_SCHEME"];var CONFIG_KEYWORDS=["AcceptFilter,AcceptPathInfo,AccessFileName,Action,AddAlt,AddAltByEncoding,AddAltByType,AddCharset,AddDefaultCharset,AddDescription,AddEncoding,AddHandler,AddIcon,AddIconByEncoding,AddIconByType,AddInputFilter,AddLanguage,AddModuleInfo,AddOutputFilter,AddOutputFilterByType,AddType,Alias,AliasMatch,Allow,AllowCONNECT,AllowEncodedSlashes,AllowMethods,AllowOverride,AllowOverrideList,Anonymous,Anonymous_LogEmail,Anonymous_MustGiveEmail,Anonymous_NoUserID,Anonymous_VerifyEmail,AsyncRequestWorkerFactor,AuthBasicAuthoritative,AuthBasicFake,AuthBasicProvider,AuthBasicUseDigestAlgorithm,AuthDBDUserPWQuery,AuthDBDUserRealmQuery,AuthDBMGroupFile,AuthDBMType,AuthDBMUserFile,AuthDigestAlgorithm,AuthDigestDomain,AuthDigestNonceLifetime,AuthDigestProvider,AuthDigestQop,AuthDigestShmemSize,AuthFormAuthoritative,AuthFormBody,AuthFormDisableNoStore,AuthFormFakeBasicAuth,AuthFormLocation,AuthFormLoginRequiredLocation,AuthFormLoginSuccessLocation,AuthFormLogoutLocation,AuthFormMethod,AuthFormMimetype,AuthFormPassword,AuthFormProvider,AuthFormSitePassphrase,AuthFormSize,AuthFormUsername,AuthGroupFile,AuthLDAPAuthorizePrefix,AuthLDAPBindAuthoritative,AuthLDAPBindDN,AuthLDAPBindPassword,AuthLDAPCharsetConfig,AuthLDAPCompareAsUser,AuthLDAPCompareDNOnServer,AuthLDAPDereferenceAliases,AuthLDAPGroupAttribute,AuthLDAPGroupAttributeIsDN,AuthLDAPInitialBindAsUser,AuthLDAPInitialBindPattern,AuthLDAPMaxSubGroupDepth,AuthLDAPRemoteUserAttribute,AuthLDAPRemoteUserIsDN,AuthLDAPSearchAsUser,AuthLDAPSubGroupAttribute,AuthLDAPSubGroupClass,AuthLDAPUrl,AuthMerging,AuthName,AuthnCacheContext,AuthnCacheEnable,AuthnCacheProvideFor,AuthnCacheSOCache,AuthnCacheTimeout,<AuthnProviderAlias>,AuthnzFcgiCheckAuthnProvider,AuthnzFcgiDefineProvider,AuthType,AuthUserFile,AuthzDBDLoginToReferer,AuthzDBDQuery,AuthzDBDRedirectQuery,AuthzDBMType,<AuthzProviderAlias>,AuthzSendForbiddenOnFailure,BalancerGrowth,BalancerInherit,BalancerMember,BalancerPersist,BrotliAlterETag,BrotliCompressionMaxInputBlock,BrotliCompressionQuality,BrotliCompressionWindow,BrotliFilterNote,BrowserMatch,BrowserMatchNoCase,BufferedLogs,BufferSize,CacheDefaultExpire,CacheDetailHeader,CacheDirLength,CacheDirLevels,CacheDisable,CacheEnable,CacheFile,CacheHeader,CacheIgnoreCacheControl,CacheIgnoreHeaders,CacheIgnoreNoLastMod,CacheIgnoreQueryString,CacheIgnoreURLSessionIdentifiers,CacheKeyBaseURL,CacheLastModifiedFactor,CacheLock,CacheLockMaxAge,CacheLockPath,CacheMaxExpire,CacheMaxFileSize,CacheMinExpire,CacheMinFileSize,CacheNegotiatedDocs,CacheQuickHandler,CacheReadSize,CacheReadTime,CacheRoot,CacheSocache,CacheSocacheMaxSize,CacheSocacheMaxTime,CacheSocacheMinTime,CacheSocacheReadSize,CacheSocacheReadTime,CacheStaleOnError,CacheStoreExpired,CacheStoreNoStore,CacheStorePrivate,CGIDScriptTimeout,CGIMapExtension,CGIPassAuth,CGIVar,CharsetDefault,CharsetOptions,CharsetSourceEnc,CheckCaseOnly,CheckSpelling,ChrootDir,ContentDigest,CookieDomain,CookieExpires,CookieName,CookieStyle,CookieTracking,CoreDumpDirectory,CustomLog,Dav,DavDepthInfinity,DavGenericLockDB,DavLockDB,DavMinTimeout,DBDExptime,DBDInitSQL,DBDKeep,DBDMax,DBDMin,DBDParams,DBDPersist,DBDPrepareSQL,DBDriver,DefaultIcon,DefaultLanguage,DefaultRuntimeDir,DefaultType,Define,DeflateBufferSize,DeflateCompressionLevel,DeflateFilterNote,DeflateInflateLimitRequestBody,DeflateInflateRatioBurst,DeflateInflateRatioLimit,DeflateMemLevel,DeflateWindowSize,Deny,<Directory>,DirectoryCheckHandler,DirectoryIndex,DirectoryIndexRedirect,<DirectoryMatch>,DirectorySlash,DocumentRoot,DTracePrivileges,DumpIOInput,DumpIOOutput,<Else>,<ElseIf>,EnableExceptionHook,EnableMMAP,EnableSendfile,Error,ErrorDocument,ErrorLog,ErrorLogFormat,Example,ExpiresActive,ExpiresByType,ExpiresDefault,ExtendedStatus,ExtFilterDefine,ExtFilterOptions,FallbackResource,FileETag,<Files>,<FilesMatch>,FilterChain,FilterDeclare,FilterProtocol,FilterProvider,FilterTrace,ForceLanguagePriority,ForceType,ForensicLog,GlobalLog,GprofDir,GracefulShutdownTimeout,Group,H2CopyFiles,H2Direct,H2EarlyHints,H2MaxSessionStreams,H2MaxWorkerIdleSeconds,H2MaxWorkers,H2MinWorkers,H2ModernTLSOnly,H2Push,H2PushDiarySize,H2PushPriority,H2PushResource,H2SerializeHeaders,H2StreamMaxMemSize,H2TLSCoolDownSecs,H2TLSWarmUpSize,H2Upgrade,H2WindowSize,Header,HeaderName,HeartbeatAddress,HeartbeatListen,HeartbeatMaxServers,HeartbeatStorage,HeartbeatStorage,HostnameLookups,HttpProtocolOptions,IdentityCheck,IdentityCheckTimeout,<If>,<IfDefine>,<IfModule>,<IfVersion>,ImapBase,ImapDefault,ImapMenu,Include,IncludeOptional,IndexHeadInsert,IndexIgnore,IndexIgnoreReset,IndexOptions,IndexOrderDefault,IndexStyleSheet,InputSed,ISAPIAppendLogToErrors,ISAPIAppendLogToQuery,ISAPICacheFile,ISAPIFakeAsync,ISAPILogNotSupported,ISAPIReadAheadBuffer,KeepAlive,KeepAliveTimeout,KeptBodySize,LanguagePriority,LDAPCacheEntries,LDAPCacheTTL,LDAPConnectionPoolTTL,LDAPConnectionTimeout,LDAPLibraryDebug,LDAPOpCacheEntries,LDAPOpCacheTTL,LDAPReferralHopLimit,LDAPReferrals,LDAPRetries,LDAPRetryDelay,LDAPSharedCacheFile,LDAPSharedCacheSize,LDAPTimeout,LDAPTrustedClientCert,LDAPTrustedGlobalCert,LDAPTrustedMode,LDAPVerifyServerCert,<Limit>,<LimitExcept>,LimitInternalRecursion,LimitRequestBody,LimitRequestFields,LimitRequestFieldSize,LimitRequestLine,LimitXMLRequestBody,Listen,ListenBackLog,ListenCoresBucketsRatio,LoadFile,LoadModule,<Location>,<LocationMatch>,LogFormat,LogIOTrackTTFB,LogLevel,LogMessage,LuaAuthzProvider,LuaCodeCache,LuaHookAccessChecker,LuaHookAuthChecker,LuaHookCheckUserID,LuaHookFixups,LuaHookInsertFilter,LuaHookLog,LuaHookMapToStorage,LuaHookTranslateName,LuaHookTypeChecker,LuaInherit,LuaInputFilter,LuaMapHandler,LuaOutputFilter,LuaPackageCPath,LuaPackagePath,LuaQuickHandler,LuaRoot,LuaScope,<Macro>,MaxConnectionsPerChild,MaxKeepAliveRequests,MaxMemFree,MaxRangeOverlaps,MaxRangeReversals,MaxRanges,MaxRequestWorkers,MaxSpareServers,MaxSpareThreads,MaxThreads,MemcacheConnTTL,MergeTrailers,MetaDir,MetaFiles,MetaSuffix,MimeMagicFile,MinSpareServers,MinSpareThreads,MMapFile,ModemStandard,ModMimeUsePathInfo,MultiviewsMatch,Mutex,NameVirtualHost,NoProxy,NWSSLTrustedCerts,NWSSLUpgradeable,Options,Order,OutputSed,PassEnv,PidFile,PrivilegesMode,Protocol,ProtocolEcho,Protocols,ProtocolsHonorOrder,<Proxy>,ProxyAddHeaders,ProxyBadHeader,ProxyBlock,ProxyDomain,ProxyErrorOverride,ProxyExpressDBMFile,ProxyExpressDBMType,ProxyExpressEnable,ProxyFCGIBackendType,ProxyFCGISetEnvIf,ProxyFtpDirCharset,ProxyFtpEscapeWildcards,ProxyFtpListOnWildcard,ProxyHCExpr,ProxyHCTemplate,ProxyHCTPsize,ProxyHTMLBufSize,ProxyHTMLCharsetOut,ProxyHTMLDocType,ProxyHTMLEnable,ProxyHTMLEvents,ProxyHTMLExtended,ProxyHTMLFixups,ProxyHTMLInterp,ProxyHTMLLinks,ProxyHTMLMeta,ProxyHTMLStripComments,ProxyHTMLURLMap,ProxyIOBufferSize,<ProxyMatch>,ProxyMaxForwards,ProxyPass,ProxyPassInherit,ProxyPassInterpolateEnv,ProxyPassMatch,ProxyPassReverse,ProxyPassReverseCookieDomain,ProxyPassReverseCookiePath,ProxyPreserveHost,ProxyReceiveBufferSize,ProxyRemote,ProxyRemoteMatch,ProxyRequests,ProxySCGIInternalRedirect,ProxySCGISendfile,ProxySet,ProxySourceAddress,ProxyStatus,ProxyTimeout,ProxyVia,QualifyRedirectURL,ReadmeName,ReceiveBufferSize,Redirect,RedirectMatch,RedirectPermanent,RedirectTemp,ReflectorHeader,RegisterHttpMethod,RemoteIPHeader,RemoteIPInternalProxy,RemoteIPInternalProxyList,RemoteIPProxiesHeader,RemoteIPTrustedProxy,RemoteIPTrustedProxyList,RemoveCharset,RemoveEncoding,RemoveHandler,RemoveInputFilter,RemoveLanguage,RemoveOutputFilter,RemoveType,RequestHeader,RequestReadTimeout,Require,<RequireAll>,<RequireAny>,<RequireNone>,RewriteBase,RewriteCond,RewriteEngine,RewriteMap,RewriteOptions,RewriteRule,RLimitCPU,RLimitMEM,RLimitNPROC,Satisfy,ScoreBoardFile,Script,ScriptAlias,ScriptAliasMatch,ScriptInterpreterSource,ScriptLog,ScriptLogBuffer,ScriptLogLength,ScriptSock,SecureListen,SeeRequestTail,SendBufferSize,ServerAdmin,ServerAlias,ServerLimit,ServerName,ServerPath,ServerRoot,ServerSignature,ServerTokens,Session,SessionCookieName,SessionCookieName2,SessionCookieRemove,SessionCryptoCipher,SessionCryptoDriver,SessionCryptoPassphrase,SessionCryptoPassphraseFile,SessionDBDCookieName,SessionDBDCookieName2,SessionDBDCookieRemove,SessionDBDDeleteLabel,SessionDBDInsertLabel,SessionDBDPerUser,SessionDBDSelectLabel,SessionDBDUpdateLabel,SessionEnv,SessionExclude,SessionHeader,SessionInclude,SessionMaxAge,SetEnv,SetEnvIf,SetEnvIfExpr,SetEnvIfNoCase,SetHandler,SetInputFilter,SetOutputFilter,SSIEndTag,SSIErrorMsg,SSIETag,SSILastModified,SSILegacyExprParser,SSIStartTag,SSITimeFormat,SSIUndefinedEcho,SSLCACertificateFile,SSLCACertificatePath,SSLCADNRequestFile,SSLCADNRequestPath,SSLCARevocationCheck,SSLCARevocationFile,SSLCARevocationPath,SSLCertificateChainFile,SSLCertificateFile,SSLCertificateKeyFile,SSLCipherSuite,SSLCompression,SSLCryptoDevice,SSLEngine,SSLFIPS,SSLHonorCipherOrder,SSLInsecureRenegotiation,SSLOCSPDefaultResponder,SSLOCSPEnable,SSLOCSPNoverify,SSLOCSPOverrideResponder,SSLOCSPProxyURL,SSLOCSPResponderCertificateFile,SSLOCSPResponderTimeout,SSLOCSPResponseMaxAge,SSLOCSPResponseTimeSkew,SSLOCSPUseRequestNonce,SSLOpenSSLConfCmd,SSLOptions,SSLPassPhraseDialog,SSLProtocol,SSLProxyCACertificateFile,SSLProxyCACertificatePath,SSLProxyCARevocationCheck,SSLProxyCARevocationFile,SSLProxyCARevocationPath,SSLProxyCheckPeerCN,SSLProxyCheckPeerExpire,SSLProxyCheckPeerName,SSLProxyCipherSuite,SSLProxyEngine,SSLProxyMachineCertificateChainFile,SSLProxyMachineCertificateFile,SSLProxyMachineCertificatePath,SSLProxyProtocol,SSLProxyVerify,SSLProxyVerifyDepth,SSLRandomSeed,SSLRenegBufferSize,SSLRequire,SSLRequireSSL,SSLSessionCache,SSLSessionCacheTimeout,SSLSessionTicketKeyFile,SSLSessionTickets,SSLSRPUnknownUserSeed,SSLSRPVerifierFile,SSLStaplingCache,SSLStaplingErrorCacheTimeout,SSLStaplingFakeTryLater,SSLStaplingForceURL,SSLStaplingResponderTimeout,SSLStaplingResponseMaxAge,SSLStaplingResponseTimeSkew,SSLStaplingReturnResponderErrors,SSLStaplingStandardCacheTimeout,SSLStrictSNIVHostCheck,SSLUserName,SSLUseStapling,SSLVerifyClient,SSLVerifyDepth,StartServers,StartThreads,Substitute,SubstituteInheritBefore,SubstituteMaxLineLength,Suexec,SuexecUserGroup,ThreadLimit,ThreadsPerChild,ThreadStackSize,TimeOut,TraceEnable,TransferLog,TypesConfig,UnDefine,UndefMacro,UnsetEnv,Use,UseCanonicalName,UseCanonicalPhysicalPort,User,UserDir,VHostCGIMode,VHostCGIPrivs,VHostGroup,VHostPrivs,VHostSecure,VHostUser,VirtualDocumentRoot,VirtualDocumentRootIP,<VirtualHost>,VirtualScriptAlias,VirtualScriptAliasIP,WatchdogInterval,XBitHack,xml2EncAlias,xml2EncDefault,xml2StartParse"];var CONFIG_OPTIONS=/^[\\+\\-]?(AuthConfig|IncludesNOEXEC|ExecCGI|FollowSymLinks|MultiViews|Includes|Indexes|SymLinksIfOwnerMatch)\b/i;var ALL_KEYWORDS=[CPP_KEYWORDS,CSHARP_KEYWORDS,JSCRIPT_KEYWORDS,PERL_KEYWORDS+
+PYTHON_KEYWORDS,RUBY_KEYWORDS,SH_KEYWORDS,CONFIG_KEYWORDS,PHP_KEYWORDS];var C_TYPES=/^(DIR|FILE|vector|(de|priority_)?queue|list|stack|(const_)?iterator|(multi)?(set|map)|bitset|u?(int|float|char|void|const|static|struct)\d*(_t)?\b)|[a-z_]+_rec|cmd_parms\b/;var PR_STRING='str';var PR_KEYWORD='kwd';var PR_COMMENT='com';var PR_TYPE='typ';var PR_LITERAL='lit';var PR_PUNCTUATION='pun';var PR_PLAIN='pln';var PR_TAG='tag';var PR_DECLARATION='dec';var PR_SOURCE='src';var PR_ATTRIB_NAME='atn';var PR_ATTRIB_VALUE='atv';var PR_NOCODE='nocode';var REGEXP_PRECEDER_PATTERN='(?:^^\\.?|[+-]|[!=]=?=?|\\#|%=?|&&?=?|\\(|\\*=?|[+\\-]=|->|\\/=?|::?|<<?=?|>>?>?=?|,|;|\\?|@|\\[|~|{|\\^\\^?=?|\\|\\|?=?|break|case|continue|delete|do|else|finally|instanceof|return|throw|try|typeof)\\s*';function combinePrefixPatterns(regexs){var capturedGroupIndex=0;var needToFoldCase=false;var ignoreCase=false;for(var i=0,n=regexs.length;i<n;++i){var regex=regexs[i];if(regex.ignoreCase){ignoreCase=true;}else if(/[a-z]/i.test(regex.source.replace(/\\u[0-9a-f]{4}|\\x[0-9a-f]{2}|\\[^ux]/gi,''))){needToFoldCase=true;ignoreCase=false;break;}}
+var escapeCharToCodeUnit={'b':8,'t':9,'n':0xa,'v':0xb,'f':0xc,'r':0xd};function decodeEscape(charsetPart){var cc0=charsetPart.charCodeAt(0);if(cc0!==92){return cc0;}
+var c1=charsetPart.charAt(1);cc0=escapeCharToCodeUnit[c1];if(cc0){return cc0;}else if('0'<=c1&&c1<='7'){return parseInt(charsetPart.substring(1),8);}else if(c1==='u'||c1==='x'){return parseInt(charsetPart.substring(2),16);}else{return charsetPart.charCodeAt(1);}}
+function encodeEscape(charCode){if(charCode<0x20){return(charCode<0x10?'\\x0':'\\x')+charCode.toString(16);}
+var ch=String.fromCharCode(charCode);return(ch==='\\'||ch==='-'||ch===']'||ch==='^')?"\\"+ch:ch;}
+function caseFoldCharset(charSet){var charsetParts=charSet.substring(1,charSet.length-1).match(new RegExp('\\\\u[0-9A-Fa-f]{4}'
++'|\\\\x[0-9A-Fa-f]{2}'
++'|\\\\[0-3][0-7]{0,2}'
++'|\\\\[0-7]{1,2}'
++'|\\\\[\\s\\S]'
++'|-'
++'|[^-\\\\]','g'));var ranges=[];var inverse=charsetParts[0]==='^';var out=['['];if(inverse){out.push('^');}
+for(var i=inverse?1:0,n=charsetParts.length;i<n;++i){var p=charsetParts[i];if(/\\[bdsw]/i.test(p)){out.push(p);}else{var start=decodeEscape(p);var end;if(i+2<n&&'-'===charsetParts[i+1]){end=decodeEscape(charsetParts[i+2]);i+=2;}else{end=start;}
+ranges.push([start,end]);if(!(end<65||start>122)){if(!(end<65||start>90)){ranges.push([Math.max(65,start)|32,Math.min(end,90)|32]);}
+if(!(end<97||start>122)){ranges.push([Math.max(97,start)&~32,Math.min(end,122)&~32]);}}}}
+ranges.sort(function(a,b){return(a[0]-b[0])||(b[1]-a[1]);});var consolidatedRanges=[];var lastRange=[];for(var i=0;i<ranges.length;++i){var range=ranges[i];if(range[0]<=lastRange[1]+1){lastRange[1]=Math.max(lastRange[1],range[1]);}else{consolidatedRanges.push(lastRange=range);}}
+for(var i=0;i<consolidatedRanges.length;++i){var range=consolidatedRanges[i];out.push(encodeEscape(range[0]));if(range[1]>range[0]){if(range[1]+1>range[0]){out.push('-');}
+out.push(encodeEscape(range[1]));}}
+out.push(']');return out.join('');}
+function allowAnywhereFoldCaseAndRenumberGroups(regex){var parts=regex.source.match(new RegExp('(?:'
++'\\[(?:[^\\x5C\\x5D]|\\\\[\\s\\S])*\\]'
++'|\\\\u[A-Fa-f0-9]{4}'
++'|\\\\x[A-Fa-f0-9]{2}'
++'|\\\\[0-9]+'
++'|\\\\[^ux0-9]'
++'|\\(\\?[:!=]'
++'|[\\(\\)\\^]'
++'|[^\\x5B\\x5C\\(\\)\\^]+'
++')','g'));var n=parts.length;var capturedGroups=[];for(var i=0,groupIndex=0;i<n;++i){var p=parts[i];if(p==='('){++groupIndex;}else if('\\'===p.charAt(0)){var decimalValue=+p.substring(1);if(decimalValue){if(decimalValue<=groupIndex){capturedGroups[decimalValue]=-1;}else{parts[i]=encodeEscape(decimalValue);}}}}
+for(var i=1;i<capturedGroups.length;++i){if(-1===capturedGroups[i]){capturedGroups[i]=++capturedGroupIndex;}}
+for(var i=0,groupIndex=0;i<n;++i){var p=parts[i];if(p==='('){++groupIndex;if(!capturedGroups[groupIndex]){parts[i]='(?:';}}else if('\\'===p.charAt(0)){var decimalValue=+p.substring(1);if(decimalValue&&decimalValue<=groupIndex){parts[i]='\\'+capturedGroups[decimalValue];}}}
+for(var i=0;i<n;++i){if('^'===parts[i]&&'^'!==parts[i+1]){parts[i]='';}}
+if(regex.ignoreCase&&needToFoldCase){for(var i=0;i<n;++i){var p=parts[i];var ch0=p.charAt(0);if(p.length>=2&&ch0==='['){parts[i]=caseFoldCharset(p);}else if(ch0!=='\\'){parts[i]=p.replace(/[a-zA-Z]/g,function(ch){var cc=ch.charCodeAt(0);return'['+String.fromCharCode(cc&~32,cc|32)+']';});}}}
+return parts.join('');}
+var rewritten=[];for(var i=0,n=regexs.length;i<n;++i){var regex=regexs[i];if(regex.global||regex.multiline){throw new Error(''+regex);}
+rewritten.push('(?:'+allowAnywhereFoldCaseAndRenumberGroups(regex)+')');}
+return new RegExp(rewritten.join('|'),ignoreCase?'gi':'g');}
+function extractSourceSpans(node,isPreformatted){var nocode=/(?:^|\s)nocode(?:\s|$)/;var chunks=[];var length=0;var spans=[];var k=0;function walk(node){switch(node.nodeType){case 1:if(nocode.test(node.className)){return;}
+for(var child=node.firstChild;child;child=child.nextSibling){walk(child);}
+var nodeName=node.nodeName.toLowerCase();if('br'===nodeName||'li'===nodeName){chunks[k]='\n';spans[k<<1]=length++;spans[(k++<<1)|1]=node;}
+break;case 3:case 4:var text=node.nodeValue;if(text.length){if(!isPreformatted){text=text.replace(/[ \t\r\n]+/g,' ');}else{text=text.replace(/\r\n?/g,'\n');text=text.replace(/^(\r?\n\s*)+/g,'');text=text.replace(/^\s*/g,'');text=text.replace(/(\r?\n\s*)+$/g,'');}
+chunks[k]=text;spans[k<<1]=length;length+=text.length;spans[(k++<<1)|1]=node;}
+break;}}
+walk(node);return{sourceCode:chunks.join('').replace(/\n$/,''),spans:spans};}
+function appendDecorations(basePos,sourceCode,langHandler,out){if(!sourceCode){return;}
+var job={sourceCode:sourceCode,basePos:basePos};langHandler(job);out.push.apply(out,job.decorations);}
+var notWs=/\S/;function childContentWrapper(element){var wrapper=undefined;for(var c=element.firstChild;c;c=c.nextSibling){var type=c.nodeType;wrapper=(type===1)?(wrapper?element:c):(type===3)?(notWs.test(c.nodeValue)?element:wrapper):wrapper;}
+return wrapper===element?undefined:wrapper;}
+function createSimpleLexer(shortcutStylePatterns,fallthroughStylePatterns){var shortcuts={};var tokenizer;(function(){var allPatterns=shortcutStylePatterns.concat(fallthroughStylePatterns);var allRegexs=[];var regexKeys={};for(var i=0,n=allPatterns.length;i<n;++i){var patternParts=allPatterns[i];var shortcutChars=patternParts[3];if(shortcutChars){for(var c=shortcutChars.length;--c>=0;){shortcuts[shortcutChars.charAt(c)]=patternParts;}}
+var regex=patternParts[1];var k=''+regex;if(!regexKeys.hasOwnProperty(k)){allRegexs.push(regex);regexKeys[k]=null;}}
+allRegexs.push(/[\0-\uffff]/);tokenizer=combinePrefixPatterns(allRegexs);})();var nPatterns=fallthroughStylePatterns.length;var decorate=function(job){var sourceCode=job.sourceCode,basePos=job.basePos;var decorations=[basePos,PR_PLAIN];var pos=0;var tokens=sourceCode.match(tokenizer)||[];var styleCache={};for(var ti=0,nTokens=tokens.length;ti<nTokens;++ti){var token=tokens[ti];var style=styleCache[token];var match=void 0;var isEmbedded;if(typeof style==='string'){isEmbedded=false;}else{var patternParts=shortcuts[token.charAt(0)];if(patternParts){match=token.match(patternParts[1]);style=patternParts[0];}else{for(var i=0;i<nPatterns;++i){patternParts=fallthroughStylePatterns[i];match=token.match(patternParts[1]);if(match){style=patternParts[0];break;}}
+if(!match){style=PR_PLAIN;}}
+isEmbedded=style.length>=5&&'lang-'===style.substring(0,5);if(isEmbedded&&!(match&&typeof match[1]==='string')){isEmbedded=false;style=PR_SOURCE;}
+if(!isEmbedded){styleCache[token]=style;}}
+var tokenStart=pos;pos+=token.length;if(!isEmbedded){decorations.push(basePos+tokenStart,style);}else{var embeddedSource=match[1];var embeddedSourceStart=token.indexOf(embeddedSource);var embeddedSourceEnd=embeddedSourceStart+embeddedSource.length;if(match[2]){embeddedSourceEnd=token.length-match[2].length;embeddedSourceStart=embeddedSourceEnd-embeddedSource.length;}
+var lang=style.substring(5);appendDecorations(basePos+tokenStart,token.substring(0,embeddedSourceStart),decorate,decorations);appendDecorations(basePos+tokenStart+embeddedSourceStart,embeddedSource,langHandlerForExtension(lang,embeddedSource),decorations);appendDecorations(basePos+tokenStart+embeddedSourceEnd,token.substring(embeddedSourceEnd),decorate,decorations);}}
+job.decorations=decorations;};return decorate;}
+function sourceDecorator(options){var shortcutStylePatterns=[],fallthroughStylePatterns=[];if(options['tripleQuotedStrings']){shortcutStylePatterns.push([PR_STRING,/^(?:\'\'\'(?:[^\'\\]|\\[\s\S]|\'{1,2}(?=[^\']))*(?:\'\'\'|$)|\"\"\"(?:[^\"\\]|\\[\s\S]|\"{1,2}(?=[^\"]))*(?:\"\"\"|$)|\'(?:[^\\\']|\\[\s\S])*(?:\'|$)|\"(?:[^\\\"]|\\[\s\S])*(?:\"|$))/,null,'\'"']);}else if(options['multiLineStrings']){shortcutStylePatterns.push([PR_STRING,/^(?:\'(?:[^\\\']|\\[\s\S])*(?:\'|$)|\"(?:[^\\\"]|\\[\s\S])*(?:\"|$)|\`(?:[^\\\`]|\\[\s\S])*(?:\`|$))/,null,'\'"`']);}else{shortcutStylePatterns.push([PR_STRING,/^(?:\'(?:[^\\\'\r\n]|\\.)*(?:\'|$)|\"(?:[^\\\"\r\n]|\\.)*(?:\"|$))/,null,'"\'']);}
+if(options['verbatimStrings']){fallthroughStylePatterns.push([PR_STRING,/^@\"(?:[^\"]|\"\")*(?:\"|$)/,null]);}
+var hc=options['hashComments'];if(hc){if(options['cStyleComments']){if(hc>1){shortcutStylePatterns.push([PR_COMMENT,/^#(?:##(?:[^#]|#(?!##))*(?:###|$)|.*)/,null,'#']);}else{shortcutStylePatterns.push([PR_COMMENT,/^#(?:(?:define|elif|else|endif|error|ifdef|include|ifndef|line|pragma|undef|warning)\b|[^\r\n]*)/,null,'#']);}
+fallthroughStylePatterns.push([PR_STRING,/^<(?:(?:(?:\.\.\/)*|\/?)(?:[\w-]+(?:\/[\w-]+)+)?[\w-]+\.h(?:h|pp|\+\+)?|[a-z]\w*)>/,null]);}else{shortcutStylePatterns.push([PR_COMMENT,/^#[^\r\n]*/,null,'#']);}}
+if(options['cStyleComments']){fallthroughStylePatterns.push([PR_COMMENT,/^\/\/[^\r\n]*/,null]);fallthroughStylePatterns.push([PR_COMMENT,/^\/\*[\s\S]*?(?:\*\/|$)/,null]);}
+if(options['regexLiterals']){var REGEX_LITERAL=('/(?=[^/*])'
++'(?:[^/\\x5B\\x5C]'
++'|\\x5C[\\s\\S]'
++'|\\x5B(?:[^\\x5C\\x5D]|\\x5C[\\s\\S])*(?:\\x5D|$))+'
++'/');fallthroughStylePatterns.push(['lang-regex',new RegExp('^'+REGEXP_PRECEDER_PATTERN+'('+REGEX_LITERAL+')')]);}
+var types=options['types'];if(types){fallthroughStylePatterns.push([PR_TYPE,types]);}
+if(options['strings']){var strings=(""+options['strings']).replace(/^ | $/g,'').replace(/-/g,'\\-');fallthroughStylePatterns.push([PR_STRING,new RegExp('(?:'+strings.replace(/[\s,]+/g,'|')+')'),,null]);}
+var keywords=(""+options['keywords']).replace(/^ | $/g,'');if(keywords.length){fallthroughStylePatterns.push([PR_KEYWORD,new RegExp('^(?:'+keywords.replace(/[\s,]+/g,'|')+')\\b'),null]);}
+shortcutStylePatterns.push([PR_PLAIN,/^\s+/,null,' \r\n\t\xA0']);if(options['httpdComments']){fallthroughStylePatterns.push([PR_PLAIN,/^.*\S.*#/i,null]);}
+fallthroughStylePatterns.push([PR_LITERAL,/^@[a-z_$][a-z_$@0-9]*|\bNULL\b/i,null],[PR_LITERAL,CONFIG_OPTIONS,null],[PR_TAG,/^\b(AuthzProviderAlias|AuthnProviderAlias|RequireAny|RequireAll|RequireNone|Directory|DirectoryMatch|Location|LocationMatch|VirtualHost|If|Else|ElseIf|Proxy\b|LoadBalancer|Files|FilesMatch|Limit|LimitExcept|IfDefine|IfModule|IfVersion)\b/,null],[PR_TYPE,/^(?:[@_]?[A-Z]+[a-z][A-Za-z_$@0-9]*|\w+_(t|req|module)\b)/,null],[PR_TAG,/^apr_[a-z_0-9]+|ap_[a-z_0-9]+/i,null],[PR_PLAIN,/^[a-z_$][a-z_$@0-9\-]*/i,null],[PR_LITERAL,new RegExp('^(?:'
++'0x[a-f0-9]+'
++'|[a-f0-9:]+:[a-f0-9:]+:[a-f0-9:]+:[a-f0-9:]+:[a-f0-9:]+:[a-f0-9:]+'
++'|(?:\\d(?:_\\d+)*\\d*(?:\\.\\d*)?|\\.\\d\\+)'
++'(?:e[+\\-]?\\d+)?'
++')'
++'[a-z]*','i'),null,'0123456789'],[PR_PLAIN,/^\\[\s\S]?/,null],[PR_PUNCTUATION,/^.[^\s\w\.$@\'\"\`\/\#\\]*/,null]);return createSimpleLexer(shortcutStylePatterns,fallthroughStylePatterns);}
+var decorateSource=sourceDecorator({'keywords':ALL_KEYWORDS,'hashComments':true,'cStyleComments':true,'multiLineStrings':true,'regexLiterals':true});function numberLines(node,opt_startLineNum,isPreformatted){var nocode=/(?:^|\s)nocode(?:\s|$)/;var lineBreak=/\r\n?|\n/;var document=node.ownerDocument;var li=document.createElement('li');while(node.firstChild){li.appendChild(node.firstChild);}
+var listItems=[li];function walk(node){switch(node.nodeType){case 1:if(nocode.test(node.className)){break;}
+if('br'===node.nodeName){breakAfter(node);if(node.parentNode){node.parentNode.removeChild(node);}}else{for(var child=node.firstChild;child;child=child.nextSibling){walk(child);}}
+break;case 3:case 4:if(isPreformatted){var text=node.nodeValue;var match=text.match(lineBreak);if(match){var firstLine=text.substring(0,match.index);node.nodeValue=firstLine;var tail=text.substring(match.index+match[0].length);if(tail){var parent=node.parentNode;parent.insertBefore(document.createTextNode(tail),node.nextSibling);}
+breakAfter(node);if(!firstLine){node.parentNode.removeChild(node);}}}
+break;}}
+function breakAfter(lineEndNode){while(!lineEndNode.nextSibling){lineEndNode=lineEndNode.parentNode;if(!lineEndNode){return;}}
+function breakLeftOf(limit,copy){var rightSide=copy?limit.cloneNode(false):limit;var parent=limit.parentNode;if(parent){var parentClone=breakLeftOf(parent,1);var next=limit.nextSibling;parentClone.appendChild(rightSide);for(var sibling=next;sibling;sibling=next){next=sibling.nextSibling;parentClone.appendChild(sibling);}}
+return rightSide;}
+var copiedListItem=breakLeftOf(lineEndNode.nextSibling,0);for(var parent;(parent=copiedListItem.parentNode)&&parent.nodeType===1;){copiedListItem=parent;}
+listItems.push(copiedListItem);}
+for(var i=0;i<listItems.length;++i){walk(listItems[i]);}
+if(opt_startLineNum===(opt_startLineNum|0)){listItems[0].setAttribute('value',opt_startLineNum);}
+var ol=document.createElement('ol');ol.className='linenums';var offset=Math.max(0,((opt_startLineNum-1))|0)||0;for(var i=0,n=listItems.length;i<n;++i){li=listItems[i];li.className='L'+((i+offset)%1);if(!li.firstChild){li.appendChild(document.createTextNode('\xA0'));}
+ol.appendChild(li);}
+node.appendChild(ol);}
+function recombineTagsAndDecorations(job){var isIE8OrEarlier=/\bMSIE\s(\d+)/.exec(navigator.userAgent);isIE8OrEarlier=isIE8OrEarlier&&+isIE8OrEarlier[1]<=8;var newlineRe=/\n/g;var source=job.sourceCode;var sourceLength=source.length;var sourceIndex=0;var spans=job.spans;var nSpans=spans.length;var spanIndex=0;var decorations=job.decorations;var nDecorations=decorations.length;var decorationIndex=0;decorations[nDecorations]=sourceLength;var decPos,i;for(i=decPos=0;i<nDecorations;){if(decorations[i]!==decorations[i+2]){decorations[decPos++]=decorations[i++];decorations[decPos++]=decorations[i++];}else{i+=2;}}
+nDecorations=decPos;for(i=decPos=0;i<nDecorations;){var startPos=decorations[i];var startDec=decorations[i+1];var end=i+2;while(end+2<=nDecorations&&decorations[end+1]===startDec){end+=2;}
+decorations[decPos++]=startPos;decorations[decPos++]=startDec;i=end;}
+nDecorations=decorations.length=decPos;var sourceNode=job.sourceNode;var oldDisplay;if(sourceNode){oldDisplay=sourceNode.style.display;sourceNode.style.display='none';}
+try{var decoration=null;var X=0;while(spanIndex<nSpans){X=X+1;if(X>5000){break;}
+var spanStart=spans[spanIndex];var spanEnd=spans[spanIndex+2]||sourceLength;var decEnd=decorations[decorationIndex+2]||sourceLength;var end=Math.min(spanEnd,decEnd);var textNode=spans[spanIndex+1];var styledText;if(textNode.nodeType!==1&&(styledText=source.substring(sourceIndex,end))){if(isIE8OrEarlier){styledText=styledText.replace(newlineRe,'\r');}
+textNode.nodeValue=styledText;var document=textNode.ownerDocument;var span=document.createElement('span');span.className=decorations[decorationIndex+1];var parentNode=textNode.parentNode;parentNode.replaceChild(span,textNode);span.appendChild(textNode);if(sourceIndex<spanEnd){spans[spanIndex+1]=textNode=document.createTextNode(source.substring(end,spanEnd));parentNode.insertBefore(textNode,span.nextSibling);}}
+sourceIndex=end;if(sourceIndex>=spanEnd){spanIndex+=2;}
+if(sourceIndex>=decEnd){decorationIndex+=2;}}}finally{if(sourceNode){sourceNode.style.display=oldDisplay;}}}
+var langHandlerRegistry={};function registerLangHandler(handler,fileExtensions){for(var i=fileExtensions.length;--i>=0;){var ext=fileExtensions[i];if(!langHandlerRegistry.hasOwnProperty(ext)){langHandlerRegistry[ext]=handler;}else if(win['console']){console['warn']('cannot override language handler %s',ext);}}}
+function langHandlerForExtension(extension,source){if(!(extension&&langHandlerRegistry.hasOwnProperty(extension))){extension=/^\s*</.test(source)?'default-markup':'default-code';}
+return langHandlerRegistry[extension];}
+registerLangHandler(decorateSource,['default-code']);registerLangHandler(createSimpleLexer([],[[PR_PLAIN,/^[^<?]+/],[PR_DECLARATION,/^<!\w[^>]*(?:>|$)/],[PR_COMMENT,/^<\!--[\s\S]*?(?:-\->|$)/],['lang-',/^<\?([\s\S]+?)(?:\?>|$)/],['lang-',/^<%([\s\S]+?)(?:%>|$)/],[PR_PUNCTUATION,/^(?:<[%?]|[%?]>)/],['lang-',/^<xmp\b[^>]*>([\s\S]+?)<\/xmp\b[^>]*>/i],['lang-js',/^<script\b[^>]*>([\s\S]*?)(<\/script\b[^>]*>)/i],['lang-css',/^<style\b[^>]*>([\s\S]*?)(<\/style\b[^>]*>)/i],['lang-in.tag',/^(<\/?[a-z][^<>]*>)/i]]),['default-markup','htm','html','mxml','xhtml','xml','xsl']);registerLangHandler(createSimpleLexer([[PR_PLAIN,/^[\s]+/,null,' \t\r\n'],[PR_ATTRIB_VALUE,/^(?:\"[^\"]*\"?|\'[^\']*\'?)/,null,'\"\'']],[[PR_TAG,/^^<\/?[a-z](?:[\w.:-]*\w)?|\/?>$/i],[PR_ATTRIB_NAME,/^(?!style[\s=]|on)[a-z](?:[\w:-]*\w)?/i],['lang-uq.val',/^=\s*([^>\'\"\s]*(?:[^>\'\"\s\/]|\/(?=\s)))/],[PR_PUNCTUATION,/^[=<>\/]+/],['lang-js',/^on\w+\s*=\s*\"([^\"]+)\"/i],['lang-js',/^on\w+\s*=\s*\'([^\']+)\'/i],['lang-js',/^on\w+\s*=\s*([^\"\'>\s]+)/i],['lang-css',/^style\s*=\s*\"([^\"]+)\"/i],['lang-css',/^style\s*=\s*\'([^\']+)\'/i],['lang-css',/^style\s*=\s*([^\"\'>\s]+)/i]]),['in.tag']);registerLangHandler(createSimpleLexer([],[[PR_ATTRIB_VALUE,/^[\s\S]+/]]),['uq.val']);registerLangHandler(sourceDecorator({'keywords':CPP_KEYWORDS,'hashComments':true,'cStyleComments':true,'types':C_TYPES}),['c','cc','cpp','cxx','cyc','m']);registerLangHandler(sourceDecorator({'keywords':PHP_KEYWORDS,'hashComments':false,'cStyleComments':true,'multiLineStrings':true,'regexLiterals':true}),['php','phtml','inc']);registerLangHandler(sourceDecorator({'keywords':'null,true,false'}),['json']);registerLangHandler(sourceDecorator({'keywords':CSHARP_KEYWORDS,'hashComments':true,'cStyleComments':true,'verbatimStrings':true,'types':C_TYPES}),['cs']);registerLangHandler(sourceDecorator({'keywords':JAVA_KEYWORDS,'cStyleComments':true}),['java']);registerLangHandler(sourceDecorator({'keywords':SH_KEYWORDS,'hashComments':true,'multiLineStrings':true}),['bsh','csh','sh']);registerLangHandler(sourceDecorator({'keywords':PYTHON_KEYWORDS,'hashComments':true,'multiLineStrings':true,'tripleQuotedStrings':true}),['cv','py']);registerLangHandler(sourceDecorator({'keywords':PERL_KEYWORDS,'hashComments':true,'multiLineStrings':true,'regexLiterals':true}),['perl','pl','pm']);registerLangHandler(sourceDecorator({'keywords':RUBY_KEYWORDS,'hashComments':true,'multiLineStrings':true,'regexLiterals':true}),['rb']);registerLangHandler(sourceDecorator({'keywords':JSCRIPT_KEYWORDS,'cStyleComments':true,'regexLiterals':true}),['js']);registerLangHandler(sourceDecorator({'keywords':COFFEE_KEYWORDS,'hashComments':3,'cStyleComments':true,'multilineStrings':true,'tripleQuotedStrings':true,'regexLiterals':true}),['coffee']);registerLangHandler(createSimpleLexer([],[[PR_STRING,/^[\s\S]+/]]),['regex']);registerLangHandler(sourceDecorator({'keywords':CONFIG_KEYWORDS,'literals':CONFIG_OPTIONS,'strings':CONFIG_ENVS,'hashComments':true,'cStyleComments':false,'multiLineStrings':false,'regexLiterals':false,'httpdComments':true}),['config']);function applyDecorator(job){var opt_langExtension=job.langExtension;try{var sourceAndSpans=extractSourceSpans(job.sourceNode,job.pre);var source=sourceAndSpans.sourceCode;job.sourceCode=source;job.spans=sourceAndSpans.spans;job.basePos=0;langHandlerForExtension(opt_langExtension,source)(job);recombineTagsAndDecorations(job);}catch(e){if(win['console']){console['log'](e&&e['stack']?e['stack']:e);}}}
+function prettyPrintOne(sourceCodeHtml,opt_langExtension,opt_numberLines){var container=document.createElement('pre');container.innerHTML=sourceCodeHtml;if(opt_numberLines){numberLines(container,opt_numberLines,true);}
+var job={langExtension:opt_langExtension,numberLines:opt_numberLines,sourceNode:container,pre:1};applyDecorator(job);return container.innerHTML;}
+function prettyPrint(opt_whenDone){function byTagName(tn){return document.getElementsByTagName(tn);}
+var codeSegments=[byTagName('pre'),byTagName('code'),byTagName('xmp')];var elements=[];for(var i=0;i<codeSegments.length;++i){for(var j=0,n=codeSegments[i].length;j<n;++j){elements.push(codeSegments[i][j]);}}
+codeSegments=null;var clock=Date;if(!clock['now']){clock={'now':function(){return+(new Date);}};}
+var k=0;var prettyPrintingJob;var langExtensionRe=/\blang(?:uage)?-([\w.]+)(?!\S)/;var prettyPrintRe=/\bprettyprint\b/;var prettyPrintedRe=/\bprettyprinted\b/;var preformattedTagNameRe=/pre|xmp/i;var codeRe=/^code$/i;var preCodeXmpRe=/^(?:pre|code|xmp)$/i;function doWork(){var endTime=(win['PR_SHOULD_USE_CONTINUATION']?clock['now']()+250:Infinity);for(;k<elements.length&&clock['now']()<endTime;k++){var cs=elements[k];var className=cs.className;if(prettyPrintRe.test(className)&&!prettyPrintedRe.test(className)){var nested=false;for(var p=cs.parentNode;p;p=p.parentNode){var tn=p.tagName;if(preCodeXmpRe.test(tn)&&p.className&&prettyPrintRe.test(p.className)){nested=true;break;}}
+if(!nested){cs.className+=' prettyprinted';var langExtension=className.match(langExtensionRe);var wrapper;if(!langExtension&&(wrapper=childContentWrapper(cs))&&codeRe.test(wrapper.tagName)){langExtension=wrapper.className.match(langExtensionRe);}
+if(langExtension){langExtension=langExtension[1];}
+var preformatted;if(preformattedTagNameRe.test(cs.tagName)){preformatted=1;}else{var currentStyle=cs['currentStyle'];var whitespace=(currentStyle?currentStyle['whiteSpace']:(document.defaultView&&document.defaultView.getComputedStyle)?document.defaultView.getComputedStyle(cs,null).getPropertyValue('white-space'):0);preformatted=whitespace&&'pre'===whitespace.substring(0,3);}
+var lineNums=cs.className.match(/\blinenums\b(?::(\d+))?/);lineNums=lineNums?lineNums[1]&&lineNums[1].length?+lineNums[1]:true:false;if(lineNums){numberLines(cs,lineNums,preformatted);}
+prettyPrintingJob={langExtension:langExtension,sourceNode:cs,numberLines:lineNums,pre:preformatted};applyDecorator(prettyPrintingJob);}}}
+if(k<elements.length){setTimeout(doWork,250);}else if(opt_whenDone){opt_whenDone();}}
+doWork();}
+var PR=win['PR']={'createSimpleLexer':createSimpleLexer,'registerLangHandler':registerLangHandler,'sourceDecorator':sourceDecorator,'PR_ATTRIB_NAME':PR_ATTRIB_NAME,'PR_ATTRIB_VALUE':PR_ATTRIB_VALUE,'PR_COMMENT':PR_COMMENT,'PR_DECLARATION':PR_DECLARATION,'PR_KEYWORD':PR_KEYWORD,'PR_LITERAL':PR_LITERAL,'PR_NOCODE':PR_NOCODE,'PR_PLAIN':PR_PLAIN,'PR_PUNCTUATION':PR_PUNCTUATION,'PR_SOURCE':PR_SOURCE,'PR_STRING':PR_STRING,'PR_TAG':PR_TAG,'PR_TYPE':PR_TYPE,'prettyPrintOne':win['prettyPrintOne']=prettyPrintOne,'prettyPrint':win['prettyPrint']=prettyPrint};PR['registerLangHandler'](PR['createSimpleLexer']([[PR['PR_PLAIN'],/^[\t\n\r \xA0]+/,null,'\t\n\r \xA0'],[PR['PR_STRING'],/^(?:\"(?:[^\"\\]|\\[\s\S])*(?:\"|$)|\'(?:[^\'\\]|\\[\s\S])*(?:\'|$))/,null,'"\'']],[[PR['PR_COMMENT'],/^--(?:\[(=*)\[[\s\S]*?(?:\]\1\]|$)|[^\r\n]*)/],[PR['PR_TYPE'],/^nil|false|true/],[PR['PR_STRING'],/^\[(=*)\[[\s\S]*?(?:\]\1\]|$)/],[PR['PR_KEYWORD'],/^(?:and|break|do|else|elseif|end|for|function|if|in|local|not|or|repeat|require|return|then|until|while)\b/,null],[PR['PR_LITERAL'],/^[+-]?(?:0x[\da-f]+|(?:(?:\.\d+|\d+(?:\.\d*)?)(?:e[+\-]?\d+)?))/i],[PR['PR_PLAIN'],/^[a-z_]\w*/i],[PR['PR_PUNCTUATION'],/^[^\w\t\n\r \xA0][^\w\t\n\r \xA0\"\'\-\+=]*/]]),['lua']);if(typeof define==="function"&&define['amd']){define("google-code-prettify",[],function(){return PR;});}})();
\ No newline at end of file
diff --git a/docs/manual/style/sitemap.dtd b/docs/manual/style/sitemap.dtd
new file mode 100644
index 0000000..829f326
--- /dev/null
+++ b/docs/manual/style/sitemap.dtd
@@ -0,0 +1,42 @@
+<?xml version='1.0' encoding='UTF-8' ?>
+
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements.  See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License.  You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+
+<!ENTITY % common SYSTEM "common.dtd">
+%common;
+
+<!-- <sitemap> is the root element -->
+<!ELEMENT sitemap (title, summary?, seealso*, category*)>
+
+<!ATTLIST sitemap metafile CDATA  #REQUIRED
+                  upgrade  CDATA  #IMPLIED
+>
+
+<!-- <indexpage> is another root element -->
+<!ELEMENT indexpage (parentdocument, title, category*)>
+
+<!ATTLIST indexpage metafile CDATA  #REQUIRED
+                    upgrade  CDATA  #IMPLIED
+>
+
+<!ELEMENT category (title, page*)>
+<!ATTLIST category id ID #IMPLIED>
+
+<!ELEMENT page (#PCDATA)>
+<!ATTLIST page href CDATA #IMPLIED
+               separate (yes | no) "no" >
diff --git a/docs/manual/style/version.ent b/docs/manual/style/version.ent
new file mode 100644
index 0000000..b44b2a7
--- /dev/null
+++ b/docs/manual/style/version.ent
@@ -0,0 +1,24 @@
+<?xml version='1.0' encoding='UTF-8' ?>
+
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements.  See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License.  You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+
+<!ENTITY httpd.major "2">
+<!ENTITY httpd.minor "4">
+<!ENTITY httpd.patch "29">
+
+<!ENTITY httpd.docs "2.4">
diff --git a/docs/manual/suexec.html b/docs/manual/suexec.html
new file mode 100644
index 0000000..c4cc65b
--- /dev/null
+++ b/docs/manual/suexec.html
@@ -0,0 +1,21 @@
+# GENERATED FROM XML -- DO NOT EDIT
+
+URI: suexec.html.en
+Content-Language: en
+Content-type: text/html; charset=ISO-8859-1
+
+URI: suexec.html.fr
+Content-Language: fr
+Content-type: text/html; charset=ISO-8859-1
+
+URI: suexec.html.ja.utf8
+Content-Language: ja
+Content-type: text/html; charset=UTF-8
+
+URI: suexec.html.ko.euc-kr
+Content-Language: ko
+Content-type: text/html; charset=EUC-KR
+
+URI: suexec.html.tr.utf8
+Content-Language: tr
+Content-type: text/html; charset=UTF-8
diff --git a/docs/manual/suexec.html.en b/docs/manual/suexec.html.en
new file mode 100644
index 0000000..28be5fd
--- /dev/null
+++ b/docs/manual/suexec.html.en
@@ -0,0 +1,643 @@
+<?xml version="1.0" encoding="ISO-8859-1"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head>
+<meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type" />
+<!--
+        XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+              This file is generated from xml source: DO NOT EDIT
+        XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+      -->
+<title>suEXEC Support - Apache HTTP Server Version 2.4</title>
+<link href="./style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" />
+<link href="./style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" />
+<link href="./style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" /><link rel="stylesheet" type="text/css" href="./style/css/prettify.css" />
+<script src="./style/scripts/prettify.min.js" type="text/javascript">
+</script>
+
+<link href="./images/favicon.ico" rel="shortcut icon" /></head>
+<body id="manual-page"><div id="page-header">
+<p class="menu"><a href="./mod/">Modules</a> | <a href="./mod/directives.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="./glossary.html">Glossary</a> | <a href="./sitemap.html">Sitemap</a></p>
+<p class="apache">Apache HTTP Server Version 2.4</p>
+<img alt="" src="./images/feather.png" /></div>
+<div class="up"><a href="./"><img title="&lt;-" alt="&lt;-" src="./images/left.gif" /></a></div>
+<div id="path">
+<a href="http://www.apache.org/">Apache</a> &gt; <a href="http://httpd.apache.org/">HTTP Server</a> &gt; <a href="http://httpd.apache.org/docs/">Documentation</a> &gt; <a href="./">Version 2.4</a></div><div id="page-content"><div id="preamble"><h1>suEXEC Support</h1>
+<div class="toplang">
+<p><span>Available Languages: </span><a href="./en/suexec.html" title="English">&nbsp;en&nbsp;</a> |
+<a href="./fr/suexec.html" hreflang="fr" rel="alternate" title="Fran�ais">&nbsp;fr&nbsp;</a> |
+<a href="./ja/suexec.html" hreflang="ja" rel="alternate" title="Japanese">&nbsp;ja&nbsp;</a> |
+<a href="./ko/suexec.html" hreflang="ko" rel="alternate" title="Korean">&nbsp;ko&nbsp;</a> |
+<a href="./tr/suexec.html" hreflang="tr" rel="alternate" title="T�rk�e">&nbsp;tr&nbsp;</a></p>
+</div>
+
+    <p>The <strong>suEXEC</strong> feature provides users of the Apache
+    HTTP Server the ability
+    to run <strong>CGI</strong> and <strong>SSI</strong> programs
+    under user IDs different from the user ID of the calling
+    web server. Normally, when a CGI or SSI program executes, it
+    runs as the same user who is running the web server.</p>
+
+    <p>Used properly, this feature can reduce
+    considerably the security risks involved with allowing users to
+    develop and run private CGI or SSI programs. However, if suEXEC
+    is improperly configured, it can cause any number of problems
+    and possibly create new holes in your computer's security. If
+    you aren't familiar with managing <em>setuid root</em> programs
+    and the security issues they present, we highly recommend that
+    you not consider using suEXEC.</p>
+  </div>
+<div id="quickview"><a href="https://www.apache.org/foundation/contributing.html" class="badge"><img src="https://www.apache.org/images/SupportApache-small.png" alt="Support Apache!" /></a><ul id="toc"><li><img alt="" src="./images/down.gif" /> <a href="#before">Before we begin</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#model">suEXEC Security Model</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#install">Configuring &amp; Installing
+    suEXEC</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#enable">Enabling &amp; Disabling
+    suEXEC</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#usage">Using suEXEC</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#debug">Debugging suEXEC</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#jabberwock">Beware the Jabberwock:
+    Warnings &amp; Examples</a></li>
+</ul><h3>See also</h3><ul class="seealso"><li><a href="#comments_section">Comments</a></li></ul></div>
+<div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="before" id="before">Before we begin</a></h2>
+
+    <p>Before jumping head-first into this document,
+    you should be aware that certain assumptions are made about you and
+    the environment in which you will be using suexec.</p>
+
+    <p>First, it is assumed that you are using a UNIX
+    derivative operating system that is capable of
+    <strong>setuid</strong> and <strong>setgid</strong> operations.
+    All command examples are given in this regard. Other platforms,
+    if they are capable of supporting suEXEC, may differ in their
+    configuration.</p>
+
+    <p>Second, it is assumed you are familiar with
+    some basic concepts of your computer's security and its
+    administration. This involves an understanding of
+    <strong>setuid/setgid</strong> operations and the various
+    effects they may have on your system and its level of
+    security.</p>
+
+    <p>Third, it is assumed that you are using an
+    <strong>unmodified</strong> version of suEXEC code. All code
+    for suEXEC has been carefully scrutinized and tested by the
+    developers as well as numerous beta testers. Every precaution
+    has been taken to ensure a simple yet solidly safe base of
+    code. Altering this code can cause unexpected problems and new
+    security risks. It is <strong>highly</strong> recommended you
+    not alter the suEXEC code unless you are well versed in the
+    particulars of security programming and are willing to share
+    your work with the Apache HTTP Server development team for consideration.</p>
+
+    <p>Fourth, and last, it has been the decision of
+    the Apache HTTP Server development team to <strong>NOT</strong> make suEXEC part of
+    the default installation of Apache httpd. To this end, suEXEC
+    configuration requires of the administrator careful attention
+    to details. After due consideration has been given to the
+    various settings for suEXEC, the administrator may install
+    suEXEC through normal installation methods. The values for
+    these settings need to be carefully determined and specified by
+    the administrator to properly maintain system security during
+    the use of suEXEC functionality. It is through this detailed
+    process that we hope to limit suEXEC
+    installation only to those who are careful and determined
+    enough to use it.</p>
+
+    <p>Still with us? Yes? Good. Let's move on!</p>
+</div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="model" id="model">suEXEC Security Model</a></h2>
+
+    <p>Before we begin configuring and installing
+    suEXEC, we will first discuss the security model you are about
+    to implement. By doing so, you may better understand what
+    exactly is going on inside suEXEC and what precautions are
+    taken to ensure your system's security.</p>
+
+    <p><strong>suEXEC</strong> is based on a setuid
+    "wrapper" program that is called by the main Apache HTTP Server.
+    This wrapper is called when an HTTP request is made for a CGI
+    or SSI program that the administrator has designated to run as
+    a userid other than that of the main server. When such a
+    request is made, Apache httpd provides the suEXEC wrapper with the
+    program's name and the user and group IDs under which the
+    program is to execute.</p>
+
+    <p>The wrapper then employs the following process
+    to determine success or failure -- if any one of these
+    conditions fail, the program logs the failure and exits with an
+    error, otherwise it will continue:</p>
+
+    <ol>
+      <li>
+        <strong>Is the user executing this wrapper a valid user of
+        this system?</strong>
+
+        <p class="indent">
+          This is to ensure that the user executing the wrapper is
+          truly a user of the system.
+        </p>
+     </li>
+
+     <li>
+        <strong>Was the wrapper called with the proper number of
+        arguments?</strong>
+
+        <p class="indent">
+          The wrapper will only execute if it is given the proper
+          number of arguments. The proper argument format is known
+          to the Apache HTTP Server. If the wrapper is not receiving
+          the proper number of arguments, it is either being
+          hacked, or there is something wrong with the suEXEC
+          portion of your Apache httpd binary.
+        </p>
+      </li>
+
+      <li>
+        <strong>Is this valid user allowed to run the
+        wrapper?</strong>
+
+        <p class="indent">
+          Is this user the user allowed to run this wrapper? Only
+          one user (the Apache user) is allowed to execute this
+          program.
+        </p>
+      </li>
+
+      <li>
+        <strong>Does the target CGI or SSI program have an unsafe
+        hierarchical reference?</strong>
+
+        <p class="indent">
+          Does the target CGI or SSI program's path contain a leading
+          '/' or have a '..' backreference? These are not allowed; the
+          target CGI/SSI program must reside within suEXEC's document
+          root (see <code>--with-suexec-docroot=<em>DIR</em></code>
+          below).
+        </p>
+      </li>
+
+      <li>
+        <strong>Is the target user name valid?</strong>
+
+        <p class="indent">
+          Does the target user exist?
+        </p>
+      </li>
+
+      <li>
+        <strong>Is the target group name valid?</strong>
+
+        <p class="indent">
+          Does the target group exist?
+        </p>
+      </li>
+
+      <li>
+        <strong>Is the target user <em>NOT</em> superuser?</strong>
+
+
+        <p class="indent">
+          suEXEC does not allow <code><em>root</em></code>
+          to execute CGI/SSI programs.
+        </p>
+      </li>
+
+      <li>
+        <strong>Is the target userid <em>ABOVE</em> the minimum ID
+        number?</strong>
+
+        <p class="indent">
+          The minimum user ID number is specified during
+          configuration. This allows you to set the lowest possible
+          userid that will be allowed to execute CGI/SSI programs.
+          This is useful to block out "system" accounts.
+        </p>
+      </li>
+
+      <li>
+        <strong>Is the target group <em>NOT</em> the superuser
+        group?</strong>
+
+        <p class="indent">
+          Presently, suEXEC does not allow the <code><em>root</em></code>
+          group to execute CGI/SSI programs.
+        </p>
+      </li>
+
+      <li>
+        <strong>Is the target groupid <em>ABOVE</em> the minimum ID
+        number?</strong>
+
+        <p class="indent">
+          The minimum group ID number is specified during
+          configuration. This allows you to set the lowest possible
+          groupid that will be allowed to execute CGI/SSI programs.
+          This is useful to block out "system" groups.
+        </p>
+      </li>
+
+      <li>
+        <strong>Can the wrapper successfully become the target user
+        and group?</strong>
+
+        <p class="indent">
+          Here is where the program becomes the target user and
+          group via setuid and setgid calls. The group access list
+          is also initialized with all of the groups of which the
+          user is a member.
+        </p>
+      </li>
+
+      <li>
+        <strong>Can we change directory to the one in which the target
+        CGI/SSI program resides?</strong>
+
+        <p class="indent">
+          If it doesn't exist, it can't very well contain files. If we
+          can't change directory to it, it might as well not exist.
+        </p>
+      </li>
+
+      <li>
+        <strong>Is the directory within the httpd webspace?</strong>
+
+        <p class="indent">
+          If the request is for a regular portion of the server, is
+          the requested directory within suEXEC's document root? If
+          the request is for a <code class="directive"><a href="./mod/mod_userdir.html#userdir">UserDir</a></code>, is the requested directory
+          within the directory configured as suEXEC's userdir (see
+          <a href="#install">suEXEC's configuration options</a>)?
+        </p>
+      </li>
+
+      <li>
+        <strong>Is the directory <em>NOT</em> writable by anyone
+        else?</strong>
+
+        <p class="indent">
+          We don't want to open up the directory to others; only
+          the owner user may be able to alter this directories
+          contents.
+        </p>
+      </li>
+
+      <li>
+        <strong>Does the target CGI/SSI program exist?</strong>
+
+        <p class="indent">
+          If it doesn't exists, it can't very well be executed.
+        </p>
+      </li>
+
+      <li>
+        <strong>Is the target CGI/SSI program <em>NOT</em> writable
+        by anyone else?</strong>
+
+        <p class="indent">
+          We don't want to give anyone other than the owner the
+          ability to change the CGI/SSI program.
+        </p>
+      </li>
+
+      <li>
+        <strong>Is the target CGI/SSI program <em>NOT</em> setuid or
+        setgid?</strong>
+
+        <p class="indent">
+          We do not want to execute programs that will then change
+          our UID/GID again.
+        </p>
+      </li>
+
+      <li>
+        <strong>Is the target user/group the same as the program's
+        user/group?</strong>
+
+        <p class="indent">
+          Is the user the owner of the file?
+        </p>
+      </li>
+
+      <li>
+        <strong>Can we successfully clean the process environment
+        to ensure safe operations?</strong>
+
+        <p class="indent">
+          suEXEC cleans the process' environment by establishing a
+          safe execution PATH (defined during configuration), as
+          well as only passing through those variables whose names
+          are listed in the safe environment list (also created
+          during configuration).
+        </p>
+      </li>
+
+      <li>
+        <strong>Can we successfully become the target CGI/SSI program
+        and execute?</strong>
+
+        <p class="indent">
+          Here is where suEXEC ends and the target CGI/SSI program begins.
+        </p>
+      </li>
+    </ol>
+
+    <p>This is the standard operation of the
+    suEXEC wrapper's security model. It is somewhat stringent and
+    can impose new limitations and guidelines for CGI/SSI design,
+    but it was developed carefully step-by-step with security in
+    mind.</p>
+
+    <p>For more information as to how this security
+    model can limit your possibilities in regards to server
+    configuration, as well as what security risks can be avoided
+    with a proper suEXEC setup, see the <a href="#jabberwock">"Beware the Jabberwock"</a> section of this
+    document.</p>
+</div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="install" id="install">Configuring &amp; Installing
+    suEXEC</a></h2>
+
+    <p>Here's where we begin the fun.</p>
+
+    <p><strong>suEXEC configuration
+    options</strong><br />
+    </p>
+
+    <dl>
+      <dt><code>--enable-suexec</code></dt>
+
+      <dd>This option enables the suEXEC feature which is never
+      installed or activated by default. At least one
+      <code>--with-suexec-xxxxx</code> option has to be provided
+      together with the <code>--enable-suexec</code> option to let
+      APACI accept your request for using the suEXEC feature.</dd>
+
+      <dt><code>--with-suexec-bin=<em>PATH</em></code></dt>
+
+      <dd>The path to the <code>suexec</code> binary must be hard-coded
+      in the server for security reasons. Use this option to override
+      the default path. <em>e.g.</em>
+      <code>--with-suexec-bin=/usr/sbin/suexec</code></dd>
+
+      <dt><code>--with-suexec-caller=<em>UID</em></code></dt>
+
+      <dd>The <a href="mod/mpm_common.html#user">username</a> under which
+      httpd normally runs. This is the only user allowed to
+      execute the suEXEC wrapper.</dd>
+
+      <dt><code>--with-suexec-userdir=<em>DIR</em></code></dt>
+
+      <dd>Define to be the subdirectory under users' home
+      directories where suEXEC access should be allowed. All
+      executables under this directory will be executable by suEXEC
+      as the user so they should be "safe" programs. If you are
+      using a "simple" <code class="directive"><a href="./mod/mod_userdir.html#userdir">UserDir</a></code>
+      directive (ie. one without a "*" in it) this should be set to the same
+      value. suEXEC will not work properly in cases where the <code class="directive"><a href="./mod/mod_userdir.html#userdir">UserDir</a></code> directive points to
+      a location that is not the same as the user's home directory
+      as referenced in the <code>passwd</code> file. Default value is
+      "<code>public_html</code>".<br />
+      If you have virtual hosts with a different <code class="directive"><a href="./mod/mod_userdir.html#userdir">UserDir</a></code> for each,
+      you will need to define them to all reside in one parent
+      directory; then name that parent directory here. <strong>If
+      this is not defined properly, "~userdir" cgi requests will
+      not work!</strong></dd>
+
+      <dt><code>--with-suexec-docroot=<em>DIR</em></code></dt>
+
+      <dd>Define as the DocumentRoot set for httpd. This will be
+      the only hierarchy (aside from <code class="directive"><a href="./mod/mod_userdir.html#userdir">UserDir</a></code>s) that can be used for suEXEC behavior. The
+      default directory is the <code>--datadir</code> value with the suffix
+      "<code>/htdocs</code>", <em>e.g.</em> if you configure with
+      "<code>--datadir=/home/apache</code>" the directory
+      "<code>/home/apache/htdocs</code>" is used as document root for the
+      suEXEC wrapper.</dd>
+
+      <dt><code>--with-suexec-uidmin=<em>UID</em></code></dt>
+
+      <dd>Define this as the lowest UID allowed to be a target user
+      for suEXEC. For most systems, 500 or 100 is common. Default
+      value is 100.</dd>
+
+      <dt><code>--with-suexec-gidmin=<em>GID</em></code></dt>
+
+      <dd>Define this as the lowest GID allowed to be a target
+      group for suEXEC. For most systems, 100 is common and
+      therefore used as default value.</dd>
+
+      <dt><code>--with-suexec-logfile=<em>FILE</em></code></dt>
+
+      <dd>This defines the filename to which all suEXEC
+      transactions and errors are logged (useful for auditing and
+      debugging purposes). By default the logfile is named
+      "<code>suexec_log</code>" and located in your standard logfile
+      directory (<code>--logfiledir</code>).</dd>
+
+      <dt><code>--with-suexec-safepath=<em>PATH</em></code></dt>
+
+      <dd>Define a safe PATH environment to pass to CGI
+      executables. Default value is
+      "<code>/usr/local/bin:/usr/bin:/bin</code>".</dd>
+    </dl>
+
+    <h3>Compiling and installing the suEXEC wrapper</h3>
+      
+
+      <p>If you have enabled the suEXEC feature with the
+      <code>--enable-suexec</code> option the <code>suexec</code> binary
+      (together with httpd itself) is automatically built if you execute
+      the <code>make</code> command.</p>
+
+      <p>After all components have been built you can execute the
+      command <code>make install</code> to install them. The binary image
+      <code>suexec</code> is installed in the directory defined by the
+      <code>--sbindir</code> option. The default location is
+      "/usr/local/apache2/bin/suexec".</p>
+
+      <p>Please note that you need <strong><em>root
+      privileges</em></strong> for the installation step. In order
+      for the wrapper to set the user ID, it must be installed as
+      owner <code><em>root</em></code> and must have the setuserid
+      execution bit set for file modes.</p>
+    
+
+    <h3>Setting paranoid permissions</h3>
+      
+
+      <p>Although the suEXEC wrapper will check to ensure that its
+      caller is the correct user as specified with the
+      <code>--with-suexec-caller</code> <code class="program"><a href="./programs/configure.html">configure</a></code>
+      option, there is
+      always the possibility that a system or library call suEXEC uses
+      before this check may be exploitable on your system. To counter
+      this, and because it is best-practise in general, you should use
+      filesystem permissions to ensure that only the group httpd
+      runs as may execute suEXEC.</p>
+
+      <p>If for example, your web server is configured to run as:</p>
+
+      <pre class="prettyprint lang-config">User www
+Group webgroup</pre>
+
+
+      <p>and <code class="program"><a href="./programs/suexec.html">suexec</a></code> is installed at
+      "/usr/local/apache2/bin/suexec", you should run:</p>
+
+      <div class="example"><p><code>
+          chgrp webgroup /usr/local/apache2/bin/suexec<br />
+          chmod 4750 /usr/local/apache2/bin/suexec<br />
+      </code></p></div>
+
+      <p>This will ensure that only the group httpd runs as can even
+      execute the suEXEC wrapper.</p>
+    
+</div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="enable" id="enable">Enabling &amp; Disabling
+    suEXEC</a></h2>
+
+    <p>Upon startup of httpd, it looks for the file
+    <code class="program"><a href="./programs/suexec.html">suexec</a></code> in the directory defined by the
+    <code>--sbindir</code> option (default is
+    "/usr/local/apache/sbin/suexec"). If httpd finds a properly
+    configured suEXEC wrapper, it will print the following message
+    to the error log:</p>
+
+<div class="example"><p><code>
+    [notice] suEXEC mechanism enabled (wrapper: <var>/path/to/suexec</var>)
+</code></p></div>
+
+    <p>If you don't see this message at server startup, the server is
+    most likely not finding the wrapper program where it expects
+    it, or the executable is not installed <em>setuid root</em>.</p>
+
+     <p>If you want to enable the suEXEC mechanism for the first time
+    and an Apache HTTP Server is already running you must kill and
+    restart httpd. Restarting it with a simple HUP or USR1 signal
+    will not be enough. </p>
+     <p>If you want to disable suEXEC you should kill and restart
+    httpd after you have removed the <code class="program"><a href="./programs/suexec.html">suexec</a></code> file.</p>
+</div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="usage" id="usage">Using suEXEC</a></h2>
+
+    <p>Requests for CGI programs will call the suEXEC wrapper only if
+    they are for a virtual host containing a <code class="directive"><a href="./mod/mod_suexec.html#suexecusergroup">SuexecUserGroup</a></code> directive or if
+    they are processed by <code class="module"><a href="./mod/mod_userdir.html">mod_userdir</a></code>.</p>
+
+    <p><strong>Virtual Hosts:</strong><br /> One way to use the suEXEC
+    wrapper is through the <code class="directive"><a href="./mod/mod_suexec.html#suexecusergroup">SuexecUserGroup</a></code> directive in
+    <code class="directive"><a href="./mod/core.html#virtualhost">VirtualHost</a></code> definitions.  By
+    setting this directive to values different from the main server
+    user ID, all requests for CGI resources will be executed as the
+    <em>User</em> and <em>Group</em> defined for that <code class="directive"><a href="./mod/core.html#virtualhost">&lt;VirtualHost&gt;</a></code>. If this
+    directive is not specified for a <code class="directive"><a href="./mod/core.html#virtualhost">&lt;VirtualHost&gt;</a></code> then the main server userid
+    is assumed.</p>
+
+    <p><strong>User directories:</strong><br /> Requests that are
+     processed by <code class="module"><a href="./mod/mod_userdir.html">mod_userdir</a></code> will call the suEXEC
+     wrapper to execute CGI programs under the userid of the requested
+     user directory.  The only requirement needed for this feature to
+     work is for CGI execution to be enabled for the user and that the
+     script must meet the scrutiny of the <a href="#model">security
+     checks</a> above.  See also the
+     <code>--with-suexec-userdir</code> <a href="#install">compile
+     time option</a>.</p> </div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="debug" id="debug">Debugging suEXEC</a></h2>
+
+    <p>The suEXEC wrapper will write log information
+    to the file defined with the <code>--with-suexec-logfile</code>
+    option as indicated above. If you feel you have configured and
+    installed the wrapper properly, have a look at this log and the
+    error_log for the server to see where you may have gone astray.</p>
+
+</div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="jabberwock" id="jabberwock">Beware the Jabberwock:
+    Warnings &amp; Examples</a></h2>
+
+    <p><strong>NOTE!</strong> This section may not be
+    complete. For the latest revision of this section of the
+    documentation, see the <a href="http://httpd.apache.org/docs/2.4/suexec.html">Online
+    Documentation</a> version.</p>
+
+    <p>There are a few points of interest regarding
+    the wrapper that can cause limitations on server setup. Please
+    review these before submitting any "bugs" regarding suEXEC.</p>
+
+    <ul>
+      <li><strong>suEXEC Points Of Interest</strong></li>
+
+      <li>
+        Hierarchy limitations
+
+        <p class="indent">
+          For security and efficiency reasons, all suEXEC requests
+          must remain within either a top-level document root for
+          virtual host requests, or one top-level personal document
+          root for userdir requests. For example, if you have four
+          VirtualHosts configured, you would need to structure all
+          of your VHosts' document roots off of one main httpd
+          document hierarchy to take advantage of suEXEC for
+          VirtualHosts. (Example forthcoming.)
+        </p>
+      </li>
+
+      <li>
+        suEXEC's PATH environment variable
+
+        <p class="indent">
+          This can be a dangerous thing to change. Make certain
+          every path you include in this define is a
+          <strong>trusted</strong> directory. You don't want to
+          open people up to having someone from across the world
+          running a trojan horse on them.
+        </p>
+      </li>
+
+      <li>
+        Altering the suEXEC code
+
+        <p class="indent">
+          Again, this can cause <strong>Big Trouble</strong> if you
+          try this without knowing what you are doing. Stay away
+          from it if at all possible.
+        </p>
+      </li>
+    </ul>
+
+</div></div>
+<div class="bottomlang">
+<p><span>Available Languages: </span><a href="./en/suexec.html" title="English">&nbsp;en&nbsp;</a> |
+<a href="./fr/suexec.html" hreflang="fr" rel="alternate" title="Fran�ais">&nbsp;fr&nbsp;</a> |
+<a href="./ja/suexec.html" hreflang="ja" rel="alternate" title="Japanese">&nbsp;ja&nbsp;</a> |
+<a href="./ko/suexec.html" hreflang="ko" rel="alternate" title="Korean">&nbsp;ko&nbsp;</a> |
+<a href="./tr/suexec.html" hreflang="tr" rel="alternate" title="T�rk�e">&nbsp;tr&nbsp;</a></p>
+</div><div class="top"><a href="#page-header"><img src="./images/up.gif" alt="top" /></a></div><div class="section"><h2><a id="comments_section" name="comments_section">Comments</a></h2><div class="warning"><strong>Notice:</strong><br />This is not a Q&amp;A section. Comments placed here should be pointed towards suggestions on improving the documentation or server, and may be removed again by our moderators if they are either implemented or considered invalid/off-topic. Questions on how to manage the Apache HTTP Server should be directed at either our IRC channel, #httpd, on Freenode, or sent to our <a href="http://httpd.apache.org/lists.html">mailing lists</a>.</div>
+<script type="text/javascript"><!--//--><![CDATA[//><!--
+var comments_shortname = 'httpd';
+var comments_identifier = 'http://httpd.apache.org/docs/2.4/suexec.html';
+(function(w, d) {
+    if (w.location.hostname.toLowerCase() == "httpd.apache.org") {
+        d.write('<div id="comments_thread"><\/div>');
+        var s = d.createElement('script');
+        s.type = 'text/javascript';
+        s.async = true;
+        s.src = 'https://comments.apache.org/show_comments.lua?site=' + comments_shortname + '&page=' + comments_identifier;
+        (d.getElementsByTagName('head')[0] || d.getElementsByTagName('body')[0]).appendChild(s);
+    }
+    else { 
+        d.write('<div id="comments_thread">Comments are disabled for this page at the moment.<\/div>');
+    }
+})(window, document);
+//--><!]]></script></div><div id="footer">
+<p class="apache">Copyright 2017 The Apache Software Foundation.<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p>
+<p class="menu"><a href="./mod/">Modules</a> | <a href="./mod/directives.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="./glossary.html">Glossary</a> | <a href="./sitemap.html">Sitemap</a></p></div><script type="text/javascript"><!--//--><![CDATA[//><!--
+if (typeof(prettyPrint) !== 'undefined') {
+    prettyPrint();
+}
+//--><!]]></script>
+</body></html>
\ No newline at end of file
diff --git a/docs/manual/suexec.html.fr b/docs/manual/suexec.html.fr
new file mode 100644
index 0000000..02aa50c
--- /dev/null
+++ b/docs/manual/suexec.html.fr
@@ -0,0 +1,689 @@
+<?xml version="1.0" encoding="ISO-8859-1"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" lang="fr" xml:lang="fr"><head>
+<meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type" />
+<!--
+        XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+              This file is generated from xml source: DO NOT EDIT
+        XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+      -->
+<title>Support suEXEC - Serveur Apache HTTP Version 2.4</title>
+<link href="./style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" />
+<link href="./style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" />
+<link href="./style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" /><link rel="stylesheet" type="text/css" href="./style/css/prettify.css" />
+<script src="./style/scripts/prettify.min.js" type="text/javascript">
+</script>
+
+<link href="./images/favicon.ico" rel="shortcut icon" /></head>
+<body id="manual-page"><div id="page-header">
+<p class="menu"><a href="./mod/">Modules</a> | <a href="./mod/directives.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="./glossary.html">Glossaire</a> | <a href="./sitemap.html">Plan du site</a></p>
+<p class="apache">Serveur Apache HTTP Version 2.4</p>
+<img alt="" src="./images/feather.png" /></div>
+<div class="up"><a href="./"><img title="&lt;-" alt="&lt;-" src="./images/left.gif" /></a></div>
+<div id="path">
+<a href="http://www.apache.org/">Apache</a> &gt; <a href="http://httpd.apache.org/">Serveur HTTP</a> &gt; <a href="http://httpd.apache.org/docs/">Documentation</a> &gt; <a href="./">Version 2.4</a></div><div id="page-content"><div id="preamble"><h1>Support suEXEC</h1>
+<div class="toplang">
+<p><span>Langues Disponibles: </span><a href="./en/suexec.html" hreflang="en" rel="alternate" title="English">&nbsp;en&nbsp;</a> |
+<a href="./fr/suexec.html" title="Fran�ais">&nbsp;fr&nbsp;</a> |
+<a href="./ja/suexec.html" hreflang="ja" rel="alternate" title="Japanese">&nbsp;ja&nbsp;</a> |
+<a href="./ko/suexec.html" hreflang="ko" rel="alternate" title="Korean">&nbsp;ko&nbsp;</a> |
+<a href="./tr/suexec.html" hreflang="tr" rel="alternate" title="T�rk�e">&nbsp;tr&nbsp;</a></p>
+</div>
+
+    <p>La fonctionnalit� <strong>suEXEC</strong> permet
+    l'ex�cution des programmes <strong>CGI</strong> et
+    <strong>SSI</strong> sous un utilisateur autre que celui sous
+    lequel s'ex�cute le serveur web qui appelle ces programmes.
+    Normalement, lorsqu'un programme CGI ou SSI est lanc�, il
+    s'ex�cute sous le m�me utilisateur que celui du serveur web qui
+    l'appelle.</p>
+
+    <p>Utilis�e de mani�re appropri�e, cette fonctionnalit� peut
+    r�duire consid�rablement les risques de s�curit� encourus
+    lorsqu'on autorise les utilisateurs � d�velopper et faire
+    s'ex�cuter des programmes CGI ou SSI de leur cru. Cependant, mal
+    configur�, suEXEC peut causer de nombreux probl�mes et m�me cr�er
+    de nouvelles failles dans la s�curit� de votre ordinateur. Si
+    vous n'�tes pas familier avec la gestion des programmes
+    <em>setuid root</em> et les risques de s�curit� qu'ils comportent,
+    nous vous recommandons vivement de ne pas tenter
+    d'utiliser suEXEC.</p>
+  </div>
+<div id="quickview"><a href="https://www.apache.org/foundation/contributing.html" class="badge"><img src="https://www.apache.org/images/SupportApache-small.png" alt="Support Apache!" /></a><ul id="toc"><li><img alt="" src="./images/down.gif" /> <a href="#before">Avant de commencer</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#model">Mod�le de s�curit� de suEXEC</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#install">Configurer et installer suEXEC</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#enable">Activation et d�sactivation
+de suEXEC</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#usage">Utilisation de suEXEC</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#debug">D�bogage de suEXEC</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#jabberwock">Avis � la population !
+    Avertissements et exemples</a></li>
+</ul><h3>Voir aussi</h3><ul class="seealso"><li><a href="#comments_section">Commentaires</a></li></ul></div>
+<div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="before" id="before">Avant de commencer</a></h2>
+
+    <p>Avant de foncer t�te baiss�e dans la lecture de ce document,
+    vous devez tenir compte de certaines hypoth�ses concernant vous-m�me
+    et l'environnement dans lequel vous allez utiliser suexec.</p>
+
+    <p>Premi�rement, vous devez utiliser un syst�me d'exploitation
+    UNIX ou d�riv�, capable d'effectuer des op�rations
+    <strong>setuid</strong> et <strong>setgid</strong>. Tous les
+    exemples de commande sont donn�s en cons�quence. D'autres
+    plates-formes, m�me si elles supportent suEXEC, peuvent
+    avoir une configuration diff�rente.</p>
+
+    <p>Deuxi�mement, vous devez �tre familier avec les concepts de base
+    relatifs � la s�curit� de votre ordinateur et son administration.
+    Ceci implique la compr�hension des op�rations
+    <strong>setuid/setgid</strong> et des diff�rents effets qu'elles
+    peuvent produire sur votre syst�me et son niveau de s�curit�.</p>
+
+    <p>Troisi�mement, vous devez utiliser une version
+    <strong>non modifi�e</strong> du code de suEXEC. L'ensemble du
+    code de suEXEC a �t� scrut� et test� avec soin par les d�veloppeurs
+    et de nombreux b�ta testeurs. Toutes les pr�cautions ont �t� prises
+    pour s'assurer d'une base s�re de code non seulement simple, mais
+    aussi solide. La modification de ce code peut causer des probl�mes
+    inattendus et de nouveaux risques de s�curit�. Il est
+    <strong>vivement</strong> recommand� de ne pas modifier le code de
+    suEXEC, � moins que vous ne soyez un programmeur sp�cialiste des
+    particularit�s li�es � la s�curit�, et souhaitez partager votre
+    travail avec l'�quipe de d�veloppement du serveur HTTP Apache afin
+    de pouvoir en discuter.</p>
+
+    <p>Quatri�mement et derni�rement, l'�quipe de d�veloppement du
+    serveur HTTP Apache a d�cid� de ne
+    <strong>PAS</strong> inclure suEXEC dans l'installation par d�faut
+    d'Apache httpd. Pour pouvoir mettre en oeuvre suEXEC, l'administrateur
+    doit porter la plus grande attention aux d�tails. Apr�s avoir bien
+    r�fl�chi aux diff�rents points de la configuration de suEXEC,
+    l'administrateur peut l'installer selon les m�thodes classiques.
+    Les valeurs des param�tres de configuration doivent �tre
+    d�termin�es et sp�cifi�es avec soin par l'administrateur, afin de
+    maintenir la s�curit� du syst�me de mani�re appropri�e lors de
+    l'utilisation de la fonctionnalit� suEXEC. C'est par le biais de
+    ce processus minutieux que nous esp�rons r�server
+    l'installation de suEXEC aux administrateurs prudents et
+    suffisamment d�termin�s � vouloir l'utiliser.</p>
+
+    <p>Vous �tes encore avec nous ? Oui ? Bien.
+    Alors nous pouvons continuer !</p>
+</div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="model" id="model">Mod�le de s�curit� de suEXEC</a></h2>
+
+    <p>Avant d'installer et configurer suEXEC, nous allons tout d'abord
+    d�crire le mod�le de s�curit� que vous �tes sur le point
+    d'impl�menter. Vous devriez ainsi mieux comprendre ce qui se passe
+    vraiment � l'int�rieur de suEXEC et quelles pr�cautions ont �t�
+    prises pour pr�server la s�curit� de votre syst�me.</p>
+
+    <p><strong>suEXEC</strong> est bas� sur un programme "conteneur"
+    (wrapper) setuid qui est appel� par le serveur HTTP Apache principal.
+    Ce conteneur est appel� quand une requ�te HTTP concerne
+    un programme CGI ou SSI que l'administrateur
+    a d�cid� de faire s'ex�cuter
+    sous un utilisateur autre que celui du serveur principal.
+    Lorsqu'il re�oit une telle requ�te, Apache httpd fournit au conteneur
+    suEXEC le nom du programme, ainsi que les identifiants utilisateur
+    et groupe sous lesquels le programme doit s'ex�cuter.</p>
+
+    <p>Le conteneur effectue ensuite les v�rifications suivantes afin
+    de d�terminer la r�ussite ou l'�chec du processus -- si une seule
+    de ces conditions n'est pas v�rifi�e, le programme journalise
+    l'erreur et se termine en retournant un code d'erreur, sinon il
+    continue :</p>
+
+    <ol>
+      <li>
+        <strong>L'utilisateur qui ex�cute le conteneur est-il un
+	utilisateur valide de ce syst�me ?</strong>
+
+        <p class="indent">
+          Ceci permet de s'assurer que l'utilisateur qui ex�cute le
+	  conteneur est vraiment un utilisateur appartenant au syst�me.
+        </p>
+     </li>
+
+     <li>
+        <strong>Le conteneur a-t-il �t� appel� avec un nombre
+	d'arguments correct ?</strong>
+
+        <p class="indent">
+          Le conteneur ne s'ex�cutera que si on lui fournit un nombre
+	  d'arguments correct. Le serveur HTTP apache sait quel est le
+	  bon format des arguments. Si le conteneur ne re�oit pas un
+	  nombre d'arguments correct, soit il a �t� modifi�,
+	  soit quelque chose ne va pas dans la portion suEXEC de
+	  votre binaire Apache httpd.
+        </p>
+      </li>
+
+      <li>
+        <strong>Cet utilisateur valide est-il autoris� � ex�cuter le
+	conteneur ?</strong>
+
+        <p class="indent">
+          Cet utilisateur est-il celui autoris� � ex�cuter le
+	  conteneur ? Un seul utilisateur (celui d'Apache) est
+	  autoris� � ex�cuter ce programme.
+        </p>
+      </li>
+
+      <li>
+        <strong>Le chemin du programme CGI ou SSI cible est-il
+	non s�r ?</strong>
+
+        <p class="indent">
+          Le chemin du programme CGI ou SSI cible d�bute-t-il par un
+	  '/' ou contient-il une r�f�rence arri�re '..' ? Ceci est
+	  interdit ; le programme CGI ou SSI cible doit se trouver dans
+	  la hi�rarchie de la racine des documents de suEXEC (voir
+	  <code>--with-suexec-docroot=<em>DIR</em></code> ci-dessous).
+        </p>
+      </li>
+
+      <li>
+        <strong>Le nom utilisateur cible est-il valide ?</strong>
+
+        <p class="indent">
+          L'utilisateur cible existe-t-il ?
+        </p>
+      </li>
+
+      <li>
+        <strong>Le nom du groupe cible est-il valide ?</strong>
+
+        <p class="indent">
+          Le groupe cible existe-t-il ?
+        </p>
+      </li>
+
+      <li>
+        <strong>L'utilisateur cible n'est-il <em>PAS</em>
+	superutilisateur ?</strong>
+
+
+        <p class="indent">
+          suEXEc ne permet pas �
+	  <code><em>root</em></code> d'ex�cuter des programmes CGI/SSI.
+        </p>
+      </li>
+
+      <li>
+        <strong>Le num�ro de l'identifiant de l'utilisateur cible
+	est-il <em>SUPERIEUR</em> au num�ro d'identifiant
+	minimum ?</strong>
+
+        <p class="indent">
+          Le num�ro d'identifiant utilisateur minimum est d�fini �
+	  l'ex�cution du script configure. Ceci vous permet de d�finir
+	  le num�ro d'identifiant utilisateur le plus bas qui sera
+	  autoris� � �x�cuter des programmes CGI/SSI. En particulier,
+	  cela permet d'�carter les comptes syst�me.
+        </p>
+      </li>
+
+      <li>
+        <strong>Le groupe cible n'est-il <em>PAS</em> le groupe
+	superutilisateur ?</strong>
+
+        <p class="indent">
+          Actuellement, suEXEC ne permet pas au groupe
+	  <code><em>root</em></code> d'ex�cuter des programmes CGI/SSI.
+        </p>
+      </li>
+
+      <li>
+        <strong> Le num�ro d'identifiant du groupe cible est-il
+	<em>SUPERIEUR</em> au num�ro d'identifiant minimum ?</strong>
+
+        <p class="indent">
+          Le num�ro d'identifiant de groupe minimum est sp�cifi� lors
+	  de l'ex�cution du script configure. Ceci vous permet de
+	  d�finir l'identifiant de groupe le plus bas possible qui sera
+	  autoris� � ex�cuter des programmes CGI/SSI, et est
+	  particuli�rement utile pour �carter les groupes "syst�me".
+        </p>
+      </li>
+
+      <li>
+        <strong>Le conteneur peut-il obtenir avec succ�s l'identit�
+	des utilisateur et groupe cibles ?</strong>
+
+        <p class="indent">
+          C'est ici que le programme obtient l'identit� des utilisateur
+	  et groupe cibles via des appels � setuid et setgid. De m�me,
+	  la liste des acc�s groupe est initialis�e avec tous les
+	  groupes auxquels l'utilisateur cible appartient.
+        </p>
+      </li>
+
+      <li>
+        <strong>Peut-on se positionner dans le r�pertoire dans dequel
+	sont situ�s les programmes CGI/SSI ?</strong>
+
+        <p class="indent">
+          S'il n'existe pas, il ne peut pas contenir de fichier. Et si
+	  l'on ne peut pas s'y positionner, il n'existe probablement
+	  pas.
+        </p>
+      </li>
+
+      <li>
+        <strong>Le r�pertoire est-il dans l'espace web
+	de httpd ?</strong>
+
+        <p class="indent">
+          Si la requ�te concerne une portion de la racine du serveur,
+	  le r�pertoire demand� est-il dans la hi�rarchie de la racine
+	  des documents de suEXEC ? Si la requ�te concerne un
+	 <code class="directive"><a href="./mod/mod_userdir.html#userdir">UserDir</a></code>, le r�pertoire demand� est-il dans
+	  la hi�rarchie du r�pertoire d�fini comme le r�pertoire
+	  utilisateur de suEXEC (voir les
+	  <a href="#install">options de configuration de suEXEC</a>) ?
+        </p>
+      </li>
+
+      <li>
+        <strong>L'�criture dans le r�pertoire est-elle interdite pour
+	un utilisateur autre que le propri�taire </strong>
+
+        <p class="indent">
+          Le r�pertoire ne doit pas �tre ouvert aux autres
+	  utilisateurs ; seul l'utilisateur propri�taire doit pouvoir
+	  modifier le contenu du r�pertoire.
+        </p>
+      </li>
+
+      <li>
+        <strong>Le programme CGI/SSI cible existe-t-il ?</strong>
+
+        <p class="indent">
+          S'il n'existe pas, il ne peut pas �tre ex�cut�.
+        </p>
+      </li>
+
+      <li>
+        <strong>Les utilisateurs autres que le propri�taire n'ont-ils
+	<em>PAS</em> de droits en �criture sur le programme
+	CGI/SSI ?</strong>
+
+        <p class="indent">
+          Les utilisateurs autres que le propri�taire ne doivent pas
+	  pouvoir modifier le programme CGI/SSI.
+        </p>
+      </li>
+
+      <li>
+        <strong>Le programme CGI/SSI n'est-il <em>PAS</em> setuid ou
+	setgid ?</strong>
+
+        <p class="indent">
+          Les programmes cibles ne doivent pas pouvoir modifier �
+	  nouveau les identifiants utilisateur/groupe.
+        </p>
+      </li>
+
+      <li>
+        <strong>Le couple utilisateur/groupe cible est-il le m�me que
+	celui du programme ?</strong>
+
+        <p class="indent">
+          L'utilisateur est-il le propri�taire du fichier ?
+        </p>
+      </li>
+
+      <li>
+        <strong>Peut-on nettoyer avec succ�s l'environnement des
+	processus afin de garantir la s�ret� des op�rations ?</strong>
+
+        <p class="indent">
+          suExec nettoie l'environnement des processus en �tablissant
+	  un chemin d'ex�cution s�r (d�fini lors de la configuration),
+	  et en ne passant que les variables dont les noms font partie
+	  de la liste de l'environnement s�r (cr��e de m�me lors de la
+	  configuration).
+        </p>
+      </li>
+
+      <li>
+        <strong>Le conteneur peut-il avec succ�s se substituer au
+	programme CGI/SSI cible et s'ex�cuter ?</strong>
+
+        <p class="indent">
+          C'est l� o� l'ex�cution de suEXEC s'arr�te et o� commence
+	  celle du programme CGI/ssi cible.
+        </p>
+      </li>
+    </ol>
+
+    <p>Ce sont les op�rations standards effectu�es par le mod�le de
+    s�curit� du conteneur suEXEC. Il peut para�tre strict et est
+    susceptible d'imposer de nouvelles limitations et orientations
+    dans la conception des programmes CGI/SSI, mais il a �t� d�velopp�
+    avec le plus grand soin, �tape par �tape, en se focalisant sur
+    la s�curit�.</p>
+
+    <p>Pour plus d'informations sur la mesure dans laquelle ce mod�le
+    de s�curit� peut limiter vos possibilit�s au regard de la
+    configuration du serveur, ainsi que les risques de s�curit� qui
+    peuvent �tre �vit�s gr�ce � une configuration appropri�e de suEXEC,
+    se r�f�rer � la section <a href="#jabberwock">"Avis � la population !"</a> de ce document.</p>
+</div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="install" id="install">Configurer et installer suEXEC</a></h2>
+
+    <p>C'est ici que nous entrons dans le vif du sujet.</p>
+
+    <p><strong>Options de configuration de suEXEC</strong><br />
+    </p>
+
+    <dl>
+      <dt><code>--enable-suexec</code></dt>
+
+      <dd>Cette option active la fonctionnalit� suEXEC qui n'est
+      jamais install�e ou activ�e par d�faut. Au moins une option
+      <code>--with-suexec-xxxxx</code> doit accompagner l'option
+      <code>--enable-suexec</code> pour qu'APACI (l'utilitaire de
+      configuration de la compilation d'Apache) accepte votre demande
+      d'utilisation de la fonctionnalit� suEXEC.</dd>
+
+      <dt><code>--with-suexec-bin=<em>PATH</em></code></dt>
+
+      <dd>Le chemin du binaire <code>suexec</code> doit �tre cod� en
+      dur dans le serveur pour des raisons de s�curit�. Cette option
+      vous permet de modifier le chemin par d�faut.
+      <em>Par exemple</em>
+      <code>--with-suexec-bin=/usr/sbin/suexec</code></dd>
+
+      <dt><code>--with-suexec-caller=<em>UID</em></code></dt>
+
+      <dd>L'<a href="mod/mpm_common.html#user">utilisateur</a> sous
+      lequel httpd s'ex�cute habituellement. C'est le seul utilisateur
+      autoris� � ex�cuter le wrapper suEXEC.</dd>
+
+      <dt><code>--with-suexec-userdir=<em>DIR</em></code></dt>
+
+      <dd>Cette option d�finit le sous-r�pertoire de la hi�rarchie des
+      r�pertoires utilisateurs dans lequel l'utilisation
+      de suEXEC sera autoris�e. Tous les ex�cutables situ�s dans ce
+      r�pertoire seront ex�cutables par suEXEC sous l'utilisateur
+      cible ; ces programmes doivent donc �tre s�rs. Si vous utilisez
+      une directive <code class="directive"><a href="./mod/mod_userdir.html#userdir">UserDir</a></code>
+      "simple" (c'est � dire ne contenant pas de
+      "*"), l'option --with-suexec-userdir
+      devra contenir la m�me valeur. SuEXEC ne fonctionnera pas
+      correctement si la directive <code class="directive"><a href="./mod/mod_userdir.html#userdir">UserDir</a></code> contient une valeur
+      diff�rente du r�pertoire home de l'utilisateur tel qu'il est
+      d�fini dans le fichier <code>passwd</code>. la valeur par d�faut
+      est "<code>public_html</code>".<br />
+      Si vous avez plusieurs h�tes virtuels avec une directive
+      <code class="directive"><a href="./mod/mod_userdir.html#userdir">UserDir</a></code> diff�rente
+      pour chacun d'entre eux, vous devrez faire en sorte que chaque
+      UserDir poss�de un r�pertoire parent commun ; donnez alors �
+      l'option --with-suexec-userdir le nom
+      de ce r�pertoire commun. <strong>Si tout ceci n'est pas d�fini
+      correctement, les requ�tes CGI "~userdir" ne fonctionneront
+      pas !</strong></dd>
+
+      <dt><code>--with-suexec-docroot=<em>DIR</em></code></dt>
+
+      <dd>Cette option fonctionne comme la directive DocumentRoot pour
+      httpd. Il s'agit de la seule hi�rarchie (en dehors des directives
+      <code class="directive"><a href="./mod/mod_userdir.html#userdir">UserDir</a></code>) dans laquelle la fonctionnalit� suEXEC
+      pourra �tre utilis�e. La valeur par d�faut est la valeur de
+      <code>--datadir</code> accompagn�e du suffixe
+      "<code>/htdocs</code>" ;
+      <em>Par exemple</em>, si vous ex�cutez configure avec
+      "<code>--datadir=/home/apache</code>", la valeur
+      "<code>/home/apache/htdocs</code>" sera utilis�e par d�faut comme
+      racine des documents pour le conteneur suEXEC.</dd>
+
+      <dt><code>--with-suexec-uidmin=<em>UID</em></code></dt>
+
+      <dd>Cette option d�finit l'identifiant utilisateur le plus bas
+      avec lequel un utilisateur pourra �tre la cible de
+      suEXEC. 500 ou 100 sont des valeurs courantes sur la plupart des
+      syst�mes. la valeur par d�faut est 100.</dd>
+
+      <dt><code>--with-suexec-gidmin=<em>GID</em></code></dt>
+
+      <dd>Cette option d�finit l'identifiant de groupe le plus bas
+      avec lequel un utilisateur pourra �tre la cible de
+      suEXEC. 100 est une valeur courante sur la plupart des
+      syst�mes et est par cons�quent la valeur par d�faut.</dd>
+
+      <dt><code>--with-suexec-logfile=<em>FILE</em></code></dt>
+
+      <dd>Cette option permet de d�finir le fichier dans lequel
+      toutes les transactions et erreurs de suEXEC seront journalis�es
+      (� des fins d'analyse ou de d�bogage). Par d�faut, le fichier
+      journal se nomme "<code>suexec_log</code>" et se trouve dans votre
+      r�pertoire standard des fichiers journaux d�fini par
+      <code>--logfiledir</code></dd>
+
+      <dt><code>--with-suexec-safepath=<em>PATH</em></code></dt>
+
+      <dd>Cette option permet de d�finir une variable d'environnement
+      PATH s�re � passer aux ex�cutables CGI. La valeur par d�faut
+      est "<code>/usr/local/bin:/usr/bin:/bin</code>".</dd>
+    </dl>
+
+    <h3>Compilation et installation du conteneur suEXEC</h3>
+      
+
+    <p>Si vous avez activ� la fonctionnalit� suEXEC � l'aide de
+     l'option <code>--enable-suexec</code>, le binaire
+     <code>suexec</code> sera automatiquement construit (en m�me temps
+     que httpd) lorsque vous ex�cuterez la commande
+     <code>make</code>.</p>
+
+     <p>Lorsque tous les composants auront �t� construits, vous pourrez
+     ex�cuter la commande <code>make install</code> afin de les
+     installer. Le binaire <code>suexec</code> sera install� dans le
+     r�pertoire d�fini � l'aide de l'option <code>--sbindir</code>. La
+     localisation par d�faut est "/usr/local/apache2/bin/suexec".</p>
+     <p>Veuillez noter que vous aurez besoin des
+     <strong><em>privil�ges root</em></strong> pour passer l'�tape de
+     l'installation. Pour que le conteneur puisse changer
+     l'identifiant utilisateur, il doit avoir comme propri�taire
+     <code><em>root</em></code>, et les droits du fichier doivent
+     inclure le bit d'ex�cution setuserid.</p>
+   
+
+   <h3>&gt;Mise en place de permissions pour
+    parano�aque</h3>
+	
+    <p>Bien que le conteneur suEXEC v�rifie que l'utilisateur qui
+    l'appelle correspond bien � l'utilisateur sp�cifi� � l'aide de
+    l'option <code>--with-suexec-caller</code> du programme
+    <code class="program"><a href="./programs/configure.html">configure</a></code>, il subsiste toujours le risque qu'un
+    appel syst�me ou une biblioth�que fasse appel � suEXEC avant que
+    cette v�rification ne soit exploitable sur votre syst�me. Pour
+    tenir compte de ceci, et parce que c'est en g�n�ral la meilleure
+    pratique, vous devez utiliser les permissions du syst�me de
+    fichiers afin de vous assurer que seul le groupe sous lequel
+    s'ex�cute httpd puisse faire appel � suEXEC.</p>
+
+    <p>Si, par exemple, votre serveur web est configur� pour
+    s'ex�cuter en tant que :</p>
+
+<pre class="prettyprint lang-config">User www
+Group webgroup</pre>
+
+
+    <p>et <code class="program"><a href="./programs/suexec.html">suexec</a></code> se trouve �
+    "/usr/local/apache2/bin/suexec", vous devez ex�cuter les
+    commandes</p>
+
+<div class="example"><p><code>
+    chgrp webgroup /usr/local/apache2/bin/suexec<br />
+    chmod 4750 /usr/local/apache2/bin/suexec<br />
+</code></p></div>
+
+    <p>Ceci permet de s'assurer que seul le groupe sous lequel httpd
+    s'ex�cute (ici webgroup) puisse faire appel au conteneur
+    suEXEC.</p>
+  
+</div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="enable" id="enable">Activation et d�sactivation
+de suEXEC</a></h2>
+
+    <p>Au d�marrage, httpd v�rifie la pr�sence du fichier
+    <code class="program"><a href="./programs/suexec.html">suexec</a></code> dans le r�pertoire d�fini par
+    l'option <code>--sbindir</code> du script configure (le
+    r�pertoire par d�faut est "/usr/local/apache/sbin/suexec"). Si
+    httpd trouve un conteneur suEXEC correctement configur�, il
+    enregistrera le message suivant dans le journal des erreurs :</p>
+
+<div class="example"><p><code>
+    [notice] suEXEC mechanism enabled (wrapper: <var>/path/to/suexec</var>)
+</code></p></div>
+
+    <p>Si ce message n'est pas g�n�r� au d�marrage du serveur, ce
+    dernier ne trouve probablement pas le programme conteneur �
+    l'endroit o� il est sens� �tre, ou l'ex�cutable suexec n'est pas
+    install� en <em>setuid root</em>.</p>
+
+     <p>Si le serveur HTTP Apache est d�j� en cours d'ex�cution, et si
+     vous activez le m�canisme suEXEC pour la premi�re fois, vous
+     devez arr�ter et red�marrer httpd. Un red�marrage
+     � l'aide d'un simple signal HUP ou USR1 suffira. </p>
+     <p>Pour d�sactiver suEXEC, vous devez supprimer le fichier
+     <code class="program"><a href="./programs/suexec.html">suexec</a></code>, puis arr�ter et red�marrer
+     httpd.</p>
+</div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="usage" id="usage">Utilisation de suEXEC</a></h2>
+
+    <p>Les requ�tes pour des programmes CGI ne feront appel au
+    conteneur suEXEC que si elles concernent un h�te virtuel
+    contenant une directive <code class="directive"><a href="./mod/mod_suexec.html#suexecusergroup">SuexecUserGroup</a></code>, ou si elles sont
+    trait�es par <code class="module"><a href="./mod/mod_userdir.html">mod_userdir</a></code>.</p>
+
+    <p><strong>H�tes virtuels :</strong><br /> Une des m�thodes
+    d'utilisation du conteneur suEXEC consiste � ins�rer une
+    directive <code class="directive"><a href="./mod/mod_suexec.html#suexecusergroup">SuexecUserGroup</a></code> dans une section
+    <code class="directive"><a href="./mod/core.html#virtualhost">VirtualHost</a></code>. En d�finissant
+    des valeurs diff�rentes de celles du serveur principal, toutes les
+    requ�tes pour des ressources CGI seront ex�cut�es sous
+    les <em>User</em> et <em>Group</em> d�finis pour cette section
+    <code class="directive"><a href="./mod/core.html#virtualhost">&lt;VirtualHost&gt;</a></code>. Si cette
+    directive est absente de la section <code class="directive"><a href="./mod/core.html#virtualhost">&lt;VirtualHost&gt;</a></code>, l'utilisateur du
+    serveur principal sera pris par d�faut</p>
+
+    <p><strong>R�pertoires des utilisateurs :</strong><br /> Avec
+    cette m�thode, les
+    requ�tes trait�es par <code class="module"><a href="./mod/mod_userdir.html">mod_userdir</a></code> appelleront le
+    conteneur suEXEC pour ex�cuter le programme CGI sous l'identifiant
+    utilisateur du r�pertoire utilisateur concern�. Seuls pr�requis
+    pour pouvoir acc�der � cette fonctionnalit� : l'ex�cution des CGI
+    doit �tre activ�e pour l'utilisateur concern�, et le script doit
+    passer avec succ�s le test des <a href="#model">v�rifications de
+    s�curit�</a> d�crit plus haut. Voir aussi l'
+    <a href="#install">option de compilation</a>
+    <code>--with-suexec-userdir</code>.</p> </div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="debug" id="debug">D�bogage de suEXEC</a></h2>
+
+    <p>Le conteneur suEXEC va �crire ses informations de journalisation
+    dans le fichier d�fini par l'option de compilation
+    <code>--with-suexec-logfile</code> comme indiqu� plus haut. Si vous
+    pensez avoir configur� et install� correctement le conteneur,
+    consultez ce journal, ainsi que le journal des erreurs du serveur
+    afin de d�terminer l'endroit o� vous avez fait fausse route.</p>
+
+</div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="jabberwock" id="jabberwock">Avis � la population !
+    Avertissements et exemples</a></h2>
+
+    <p><strong>NOTE !</strong> Cette section est peut-�tre incompl�te.
+    Pour en consulter la derni�re r�vision, voir la version de la <a href="http://httpd.apache.org/docs/2.4/suexec.html">Documentation en ligne</a>.</p>
+
+    <p>Quelques points importants du conteneur peuvent
+    imposer des contraintes du point de vue de la configuration du
+    serveur. Veuillez en prendre connaissance avant de soumettre un
+    rapport de bogue � propos de suEXEC.</p>
+
+    <ul>
+      <li><strong>Points importants de suEXEC</strong></li>
+
+      <li>
+        Limitations concernant la hi�rarchie.
+
+        <p class="indent">
+          Pour des raisons de s�curit� et d'efficacit�, toutes les
+	  requ�tes suEXEC ne doivent concerner que des ressources
+	  situ�es dans la racine des documents d�finie pour les
+	  requ�tes concernant un h�te virtuel, ou des ressources
+	  situ�es dans la racine des documents d�finies pour les
+	  requ�tes concernant un r�pertoire utilisateur. Par exemple,
+	  si vous avez configur� quatre h�tes virtuels, vous devrez
+	  d�finir la structure des racines de documents de vos h�tes
+	  virtuels en dehors d'une hi�rarchie de documents principale
+	  de httpd, afin de tirer parti de suEXEC dans le contexte des
+	  h�tes virtuels (Exemple � venir).
+        </p>
+      </li>
+
+      <li>
+        La variable d'environnement PATH de suEXEC
+
+        <p class="indent">
+          Modifier cette variable peut s'av�rer dangereux. Assurez-vous
+	  que tout chemin que vous ajoutez � cette variable est un
+	  r�pertoire <strong>de confiance</strong>. Vous n'avez
+	  probablement pas l'intention d'ouvrir votre serveur de fa�on
+	  � ce que l'on puisse y ex�cuter un cheval de Troie.
+        </p>
+      </li>
+
+      <li>
+        Modification de suEXEC
+
+        <p class="indent">
+          Encore une fois, ceci peut vous causer de
+	  <strong>graves ennuis</strong> si vous vous y essayez sans
+	  savoir ce que vous faites. Evitez de vous y risquer dans la
+	  mesure du possible.
+        </p>
+      </li>
+    </ul>
+
+</div></div>
+<div class="bottomlang">
+<p><span>Langues Disponibles: </span><a href="./en/suexec.html" hreflang="en" rel="alternate" title="English">&nbsp;en&nbsp;</a> |
+<a href="./fr/suexec.html" title="Fran�ais">&nbsp;fr&nbsp;</a> |
+<a href="./ja/suexec.html" hreflang="ja" rel="alternate" title="Japanese">&nbsp;ja&nbsp;</a> |
+<a href="./ko/suexec.html" hreflang="ko" rel="alternate" title="Korean">&nbsp;ko&nbsp;</a> |
+<a href="./tr/suexec.html" hreflang="tr" rel="alternate" title="T�rk�e">&nbsp;tr&nbsp;</a></p>
+</div><div class="top"><a href="#page-header"><img src="./images/up.gif" alt="top" /></a></div><div class="section"><h2><a id="comments_section" name="comments_section">Commentaires</a></h2><div class="warning"><strong>Notice:</strong><br />This is not a Q&amp;A section. Comments placed here should be pointed towards suggestions on improving the documentation or server, and may be removed again by our moderators if they are either implemented or considered invalid/off-topic. Questions on how to manage the Apache HTTP Server should be directed at either our IRC channel, #httpd, on Freenode, or sent to our <a href="http://httpd.apache.org/lists.html">mailing lists</a>.</div>
+<script type="text/javascript"><!--//--><![CDATA[//><!--
+var comments_shortname = 'httpd';
+var comments_identifier = 'http://httpd.apache.org/docs/2.4/suexec.html';
+(function(w, d) {
+    if (w.location.hostname.toLowerCase() == "httpd.apache.org") {
+        d.write('<div id="comments_thread"><\/div>');
+        var s = d.createElement('script');
+        s.type = 'text/javascript';
+        s.async = true;
+        s.src = 'https://comments.apache.org/show_comments.lua?site=' + comments_shortname + '&page=' + comments_identifier;
+        (d.getElementsByTagName('head')[0] || d.getElementsByTagName('body')[0]).appendChild(s);
+    }
+    else { 
+        d.write('<div id="comments_thread">Comments are disabled for this page at the moment.<\/div>');
+    }
+})(window, document);
+//--><!]]></script></div><div id="footer">
+<p class="apache">Copyright 2017 The Apache Software Foundation.<br />Autoris� sous <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p>
+<p class="menu"><a href="./mod/">Modules</a> | <a href="./mod/directives.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="./glossary.html">Glossaire</a> | <a href="./sitemap.html">Plan du site</a></p></div><script type="text/javascript"><!--//--><![CDATA[//><!--
+if (typeof(prettyPrint) !== 'undefined') {
+    prettyPrint();
+}
+//--><!]]></script>
+</body></html>
\ No newline at end of file
diff --git a/docs/manual/suexec.html.ja.utf8 b/docs/manual/suexec.html.ja.utf8
new file mode 100644
index 0000000..31fd90d
--- /dev/null
+++ b/docs/manual/suexec.html.ja.utf8
@@ -0,0 +1,643 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" lang="ja" xml:lang="ja"><head>
+<meta content="text/html; charset=UTF-8" http-equiv="Content-Type" />
+<!--
+        XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+              This file is generated from xml source: DO NOT EDIT
+        XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+      -->
+<title>suEXEC サポート - Apache HTTP サーバ バージョン 2.4</title>
+<link href="./style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" />
+<link href="./style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" />
+<link href="./style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" /><link rel="stylesheet" type="text/css" href="./style/css/prettify.css" />
+<script src="./style/scripts/prettify.min.js" type="text/javascript">
+</script>
+
+<link href="./images/favicon.ico" rel="shortcut icon" /></head>
+<body id="manual-page"><div id="page-header">
+<p class="menu"><a href="./mod/">モジュール</a> | <a href="./mod/directives.html">ディレクティブ</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="./glossary.html">用語</a> | <a href="./sitemap.html">サイトマップ</a></p>
+<p class="apache">Apache HTTP サーバ バージョン 2.4</p>
+<img alt="" src="./images/feather.png" /></div>
+<div class="up"><a href="./"><img title="&lt;-" alt="&lt;-" src="./images/left.gif" /></a></div>
+<div id="path">
+<a href="http://www.apache.org/">Apache</a> &gt; <a href="http://httpd.apache.org/">HTTP サーバ</a> &gt; <a href="http://httpd.apache.org/docs/">ドキュメンテーション</a> &gt; <a href="./">バージョン 2.4</a></div><div id="page-content"><div id="preamble"><h1>suEXEC サポート</h1>
+<div class="toplang">
+<p><span>翻訳済み言語: </span><a href="./en/suexec.html" hreflang="en" rel="alternate" title="English">&nbsp;en&nbsp;</a> |
+<a href="./fr/suexec.html" hreflang="fr" rel="alternate" title="Français">&nbsp;fr&nbsp;</a> |
+<a href="./ja/suexec.html" title="Japanese">&nbsp;ja&nbsp;</a> |
+<a href="./ko/suexec.html" hreflang="ko" rel="alternate" title="Korean">&nbsp;ko&nbsp;</a> |
+<a href="./tr/suexec.html" hreflang="tr" rel="alternate" title="Türkçe">&nbsp;tr&nbsp;</a></p>
+</div>
+<div class="outofdate">この日本語訳はすでに古くなっている
+            可能性があります。
+            最近更新された内容を見るには英語版をご覧下さい。
+        </div>
+
+    <p><strong>suEXEC</strong>
+    機能により、Apache ユーザは Web サーバを実行しているユーザ ID とは
+    異なるユーザ ID で <strong>CGI</strong> プログラムや <strong>SSI</strong> 
+    プログラムを実行することができます。CGI プログラムまたは SSI
+    プログラムを実行する場合、通常は web サーバと同じユーザで実行されます。
+    </p>
+
+    <p>適切に使用すると、この機能によりユーザが個別の CGI
+    や SSI プログラムを開発し実行することで生じるセキュリティ上の危険を、
+    かなり減らすことができます。しかし、suEXEC の設定が不適切だと、
+    多くの問題が生じ、あなたのコンピュータに新しいセキュリティホールを
+    作ってしまう可能性があります。あなたが <em>setuid root</em>
+    されたプログラムと、それらから生じるセキュリティ上の問題の管理に
+    詳しくないようなら、suEXEC の使用を検討しないように強く推奨します。
+    </p>
+  </div>
+<div id="quickview"><a href="https://www.apache.org/foundation/contributing.html" class="badge"><img src="https://www.apache.org/images/SupportApache-small.png" alt="Support Apache!" /></a><ul id="toc"><li><img alt="" src="./images/down.gif" /> <a href="#before">始める前に</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#model">suEXEC セキュリティモデル</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#install">suEXEC
+    の設定とインストール</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#enable">suEXEC
+    の有効化と無効化</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#usage">suEXEC の使用</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#debug">suEXEC のデバッグ</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#jabberwock">とかげに注意: 警告と事例</a></li>
+</ul><h3>参照</h3><ul class="seealso"><li><a href="#comments_section">コメント</a></li></ul></div>
+<div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="before" id="before">始める前に</a></h2>
+
+    <p>この文書の先頭に飛ぶ前に、Apache
+    グループとこの文書での仮定を知っておくべきでしょう。
+    </p>
+
+    <p>第 1 に、あなたが <strong>setuid</strong> と
+    <strong>setgid</strong> 操作が可能な UNIX
+    由来のオペレーティングシステムを使っていることを想定しています。
+    これは、すべてのコマンド例にあてはまります。
+    その他のプラットホームでは、もし suEXEC
+    がサポートされていたとしても設定は異なるかもしれません。</p>
+
+    <p>第 2 に、あなたが使用中のコンピュータの
+    セキュリティに関する基本的な概念と、それらの管理について詳しいことを
+    想定しています。これは、<strong>setuid/setgid</strong>
+    操作、あなたのシステム上でのその操作による様々な効果、
+    セキュリティレベルについてあなたが理解しているということを含みます。
+    </p>
+
+    <p>第 3 に、<strong>改造されていない</strong> suEXEC
+    コードの使用を想定しています。suEXEC のコードは、
+    多くのベータテスタだけでなく、開発者によっても注意深く精査され
+    テストされています。それらの注意により、簡潔で信頼できる安全な
+    コードの基盤が保証されます。このコードを改変することで、
+    予期されない問題や新しいセキュリティ上の危険が生じることがあります。
+    セキュリティプログラミングの詳細に通じていて、
+    今後の検討のために成果を Apache
+    グループと共有しようと思うのでなければ、suEXEC
+    コードは変えないことを <strong>強く</strong>推奨します。</p>
+
+    <p>第 4 に、これが最後ですが、suEXEC を Apache
+    のデフォルトインストールには<strong>含めない</strong>ことが
+    Apache グループで決定されています。これは、suEXEC
+    の設定には管理者の詳細にわたる慎重な注意が必要だからです。
+    suEXEC の様々な設定について検討が終われば、管理者は suEXEC
+    を通常のインストール方法でインストールすることができます。
+    これらの設定値は、suEXEC
+    機能の使用中にシステムセキュリティを適切に保つために、
+    管理者によって慎重に決定され指定されることが必要です。
+    この詳細な手順により、Apache グループは、suEXEC
+    のインストールについて、注意深く十分に検討してそれを使用することを
+    決定した場合に限っていただきたいと考えています。
+    </p>
+
+    <p>それでも進みますか? よろしい。では、先へ進みましょう!</p>
+  </div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="model" id="model">suEXEC セキュリティモデル</a></h2>
+
+    <p>suEXEC の設定とインストールを始める前に、
+    まず実装しようとしているセキュリティモデルについて論じておきます。
+    それには、suEXEC の内部で行なわれていること、
+    システムのセキュリティを保証するために警告されることを
+    よく理解しておいた方がよいでしょう。</p>
+
+    <p><strong>suEXEC</strong> は、Apache web
+    サーバから呼び出される setuid された "wrapper"
+    プログラムが基本となっています。設計した CGI、または SSI
+    プログラムへの HTTP リクエストがあると、この wrapper
+    が呼び出されます。このようなリクエストがあると、Apache
+    はそのプログラムが実行される際のプログラム名とユーザ ID とグループ
+    ID を指定して suEXEC wrapper を実行します。
+    </p>
+
+    <p>それから、wrapper は成功または失敗を決定するため
+    以下の処理を行ないます。これらの状態のうち一つでも失敗した場合、
+    プログラムは失敗をログに記録してエラーで終了します。
+    そうでなければ、後の処理が続けられます。</p>
+
+    <ol>
+      <li>
+        <strong>wrapper
+        を実行しているユーザはこのシステムの正当なユーザか?</strong>
+
+        <p class="indent">
+          これは、wrapper を実行しているユーザが
+          本当にシステムの利用者であることを保証するためです。
+        </p>
+      </li>
+
+
+     <li>
+        <strong>wrapper が適切な数の引数で呼び出されたか?</strong>
+
+
+        <p class="indent">
+          wrapper は適切な数の引数が与えられた場合にのみ実行されます。
+          適切な引数のフォーマットは Apache Web サーバに解釈されます。
+          適切な数の引数を受け取らなければ、攻撃をされたか
+          あなたの Apache バイナリの suEXEC の部分が
+          どこかおかしい可能性があります。
+        </p>
+      </li>
+
+      <li>
+        <strong>この正当なユーザは wrapper
+        の実行を許可されているか?</strong>
+
+        <p class="indent">
+          このユーザは wrapper 実行を許可されたユーザですか?
+          ただ一人のユーザ (Apache ユーザ) だけが、
+          このプログラムの実行を許可されます。
+        </p>
+      </li>
+
+      <li>
+        <strong>対象の CGI, SSI プログラムが安全でない階層の参照をしているか?
+        </strong>
+
+        <p class="indent">
+          対象の CGI, SSI プログラムが '/' から始まる、または
+          '..' による参照を行なっていますか? これらは許可されません。
+          対象のプログラムは suEXEC のドキュメントルート
+          (下記の <code>--with-suexec-docroot=<em>DIR</em></code> を参照)
+          内に存在しなければなりません。
+        </p>
+      </li>
+
+      <li>
+        <strong>対象となるユーザ名は正当なものか?</strong>
+
+        <p class="indent">
+          対象となるユーザ名は存在していますか?
+        </p>
+      </li>
+
+      <li>
+        <strong>対象となるグループ名は正当なものか?</strong>
+
+        <p class="indent">
+          対象となるグループ名は存在していますか?
+        </p>
+      </li>
+
+      <li>
+        <strong>目的のユーザはスーパーユーザでは<em>ない</em>か?
+        </strong>
+
+        <p class="indent">
+          今のところ、suEXEC は <code><em>root</em></code> による CGI/SSI
+          プログラムの実行を許可していません。
+        </p>
+      </li>
+
+      <li>
+        <strong>対象となるユーザ ID は、最小の ID
+        番号よりも<em>大きい</em>か?  </strong>
+
+        <p class="indent">
+          最小ユーザ ID 番号は設定時に指定されます。これは、
+          CGI/SSI プログラム実行を許可されるユーザ ID
+          のとりうる最小値です。これは
+          "system" 用のアカウントを閉め出すのに有効です。
+        </p>
+      </li>
+
+      <li>
+        <strong>対象となるグループはスーパーユーザのグループでは
+        <em>ない</em>か?</strong>
+
+        <p class="indent">
+         今のところ、suEXEC は 'root' グループによる CGI/SSI
+         プログラムの実行を許可していません。
+        </p>
+      </li>
+
+      <li>
+        <strong>対象となるグループ ID は最小の ID
+          番号よりも<em>大きい</em>か?</strong>
+
+        <p class="indent">
+          最小グループ ID 番号は設定時に指定されます。これは、
+          CGI/SSI プログラム実行を許可されるグループ
+          ID のとりうる最小値です。
+          これは "system" 用のグループを閉め出すのに有効です。
+        </p>
+      </li>
+
+      <li>
+        <strong>wrapper が正常に対象となるユーザとグループになれるか?
+        </strong>
+
+        <p class="indent">
+          ここで、setuid と setgid
+          の起動によりプログラムは対象となるユーザとグループになります。
+          グループアクセスリストは、
+          ユーザが属しているすべてのグループで初期化されます。
+        </p>
+      </li>
+
+      <li>
+        <strong>CGI/SSI プログラムが置かれているディレクトリに移動
+        (change directory) できるか?</strong>
+
+        <p class="indent">
+          ディレクトリが存在しないなら、そのファイルも存在しないかもしれません。
+          ディレクトリに移動できないのであれば、おそらく存在もしないでしょう。
+        </p>
+      </li>
+
+      <li>
+        <strong>ディレクトリが Apache のドキュメントツリー内にあるか?
+        </strong>
+
+        <p class="indent">
+          リクエストがサーバ内のものであれば、
+          要求されたディレクトリが suEXEC のドキュメントルート配下にありますか?
+          リクエストが UserDir のものであれば、要求されたディレクトリが suEXEC 
+          のユーザのドキュメントルート配下にありますか?
+          (<a href="#install">suEXEC 設定オプション</a> 参照)
+        </p>
+      </li>
+
+      <li>
+        <strong>ディレクトリを他のユーザが書き込めるようになって
+        <em>いない</em>か?</strong>
+
+        <p class="indent">
+          ディレクトリを他ユーザに開放しないようにします。
+          所有ユーザだけがこのディレクトリの内容を改変できるようにします。
+        </p>
+      </li>
+
+
+      <li>
+        <strong>対象となる CGI/SSI プログラムは存在するか?</strong>
+
+        <p class="indent">
+          存在しなければ実行できません。
+        </p>
+      </li>
+
+      <li>
+        <strong>対象となる CGI/SSI プログラムファイルが他アカウントから
+        書き込めるようになって<em>いない</em>か?</strong>
+
+        <p class="indent">
+          所有者以外には CGI/SSI プログラムを変更する権限は与えられません。
+        </p>
+      </li>
+
+
+      <li>
+        <strong>対象となる CGI/SSI プログラムが setuid または setgid 
+        されて<em>いない</em>か?</strong>
+
+        <p class="indent">
+          UID/GID を再度変更してのプログラム実行はしません
+        </p>
+      </li>
+
+
+      <li>
+        <strong>対象となるユーザ/グループがプログラムの
+        ユーザ/グループと同じか?</strong>
+
+        <p class="indent">
+          ユーザがそのファイルの所有者ですか?
+        </p>
+      </li>
+
+      <li>
+        <strong>安全な動作を保証するための環境変数クリアが可能か?
+        </strong>
+
+        <p class="indent">
+          suEXEC は、安全な環境変数のリスト
+          (これらは設定時に作成されます) 内の変数として渡される安全な
+          PATH 変数 (設定時に指定されます) を設定することで、
+          プロセスの環境変数をクリアします。
+        </p>
+      </li>
+
+
+      <li>
+        <strong>対象となる CGI/SSI プログラムを exec して実行できるか?</strong>
+
+
+        <p class="indent">
+          ここで suEXEC が終了し、対象となるプログラムが開始されます。
+        </p>
+      </li>
+    </ol>
+
+    <p>ここまでが suEXEC の wrapper
+    におけるセキュリティモデルの標準的な動作です。もう少し厳重に
+    CGI/SSI 設計についての新しい制限や規定を取り入れることもできますが、
+    suEXEC はセキュリティに注意して慎重に少しずつ開発されてきました。
+    </p>
+
+    <p>このセキュリティモデルを用いて
+    サーバ設定時にどのように許すことを制限するか、また、suEXEC
+    を適切に設定するとどのようなセキュリティ上の危険を避けられるかに
+    関するより詳しい情報については、<a href="#jabberwock">"とかげに注意"
+    (Beware the Jabberwock)</a> の章を参照してください。
+    </p>
+  </div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="install" id="install">suEXEC
+    の設定とインストール</a></h2>
+
+    <p>ここから楽しくなります。</p>
+
+    <p><strong>suEXEC
+    設定オプション</strong><br />
+    </p>
+
+    <dl>
+      <dt><code>--enable-suexec</code></dt>
+
+      <dd>このオプションは、デフォルトではインストールされず、
+      有効にはならない suEXEC 機能を有効にします。
+      suEXEC を使うように APACI に要求するには、<code>--enable-suexec</code>
+      オプションにあわせて少なくとも一つは <code>--with-suexec-xxxxx</code>
+      オプションが指定されなければなりません。</dd>
+
+      <dt><code>--with-suexec-bin=<em>PATH</em></code></dt>
+
+      <dd>セキュリティ上の理由により、<code>suexec</code> バイナリのパスはサーバに
+      ハードコードされている必要があります。デフォルトのパスを
+      変えたいときはこのオプションを使ってください。<em>例えば</em>、
+      <code>--with-suexec-bin=/usr/sbin/suexec</code> のように。</dd>
+
+      <dt><code>--with-suexec-caller=<em>UID</em></code></dt>
+
+      <dd>Apache を通常動作させる<a href="mod/mpm_common.html#user">ユーザ名</a>を指定します。
+      このユーザだけが suexec の実行を許可されたユーザになります。</dd>
+
+      <dt><code>--with-suexec-userdir=<em>DIR</em></code></dt>
+
+      <dd>suEXEC がアクセスを許されるユーザホームディレクトリ配下の
+      サブディレクトリを指定します。
+      このディレクトリ以下の全実行ファイルは、"安全な"プログラムになるよう、
+      suEXEC がそのユーザとして実行できるようにします。
+      "単純な" UserDir ディレクティブを使っている場合 
+      (すなわち "*" を含まないもの)、これと同じ値を設定すべきです。
+      Userdir ディレクティブがそのユーザのパスワードファイル内の
+      ホームディレクトリと同じ場所を指していなければ、
+      suEXEC は適切に動作しません。デフォルトは "public_html" です。
+      <br />
+      各 UserDir が異なった仮想ホストを設定している場合、
+      それらを全て一つの親ディレクトリに含めて、
+      その親ディレクトリの名前をここで指定する必要があります。
+      <strong>このように指定されなければ "~userdir" cgi
+      へのリクエストが動作しません。</strong></dd>
+
+      <dt><code>--with-suexec-docroot=<em>DIR</em></code></dt>
+
+      <dd>Apache のドキュメントルートを設定します。これが suEXEC
+      の動作で使用する唯一のディレクトリ階層になります (UserDir
+      の指定は別)。デフォルトでは <code>--datedir</code> に "/htdocs"
+      というサフィックスをつけたものです。
+      "<code>--datadir=/home/apache</code>" として設定すると、
+      suEXEC wrapper にとって "/home/apache/htdocs"
+      がドキュメントルートとして使われます。</dd>
+
+      <dt><code>--with-suexec-uidmin=<em>UID</em></code></dt>
+
+      <dd>suEXEC の対象ユーザとして許される UID の最小値を指定します。
+      大抵のシステムでは 500 か 100 が一般的です。
+      デフォルト値は 100 です。</dd>
+
+      <dt><code>--with-suexec-gidmin=<em>GID</em></code></dt>
+
+      <dd>suEXEC の対象グループとして許される GID
+      の最小値を指定します。大抵のシステムでは 100 が一般的なので、
+      デフォルト値としても 100 が使われています。</dd>
+
+      <dt><code>--with-suexec-logfile=<em>FILE</em></code></dt>
+
+      <dd>suEXEC の処理とエラーが記録されるファイル名を指定します。
+      (監査やデバッグ目的に有用)
+      デフォルトではログファイルは "suexec_log" という名前で、
+      標準のログファイルディレクトリ (<code>--logfiledir</code>) に置かれます。
+      </dd>
+
+      <dt><code>--with-suexec-safepath=<em>PATH</em></code></dt>
+
+      <dd>CGI 実行ファイルに渡される安全な PATH 環境変数です。
+      デフォルト値は "/usr/local/bin:/usr/bin:/bin" です。
+      </dd>
+    </dl>
+
+    <p><strong>suEXEC wrapper
+    のコンパイルとインストール</strong><br />
+    <code>--enable-suexec</code> オプションで suEXEC 機能を有効にすると、
+    "make" コマンドを実行した時に <code>suexec</code> のバイナリ (Apache 自体も)
+    が自動的に作成されます。
+    <br />
+    すべての構成要素が作成されると、それらのインストールには
+    <code>make install</code> コマンドが実行できます。バイナリイメージの <code>suexec</code>
+    は <code>--sbindir</code> オプションで指定されたディレクトリにインストールされます。
+    デフォルトの場所は "/usr/local/apache/bin/suexec" です。<br />
+    インストール時には <strong><em>root</em></strong>
+    権限が必要なので注意してください。wrapper がユーザ ID
+    を設定するために、所有者 <code><em>root</em></code>
+    でのセットユーザ ID
+    ビットをそのファイルのモードに設定しなければなりません。
+    </p>
+
+    <p><strong>安全なパーミッションを設定する</strong><br />
+    suEXEC ラッパーは、<code>--with-suexec-caller</code> <code class="program"><a href="./programs/configure.html">configure</a></code> 
+    オプションで指定した正しいユーザで起動されていることを確認しますが、
+    システム上でこのチェックが行なわれる前に、
+    suEXEC が呼ぶシステムやライブラリが脆弱である可能性は残ります。対抗策として、
+    一般に良い習慣ともされいますが、
+    ファイルシステムパーミッションを使って
+    Apache の実行時のグループのみが suEXEC を実行できるように
+    するのが良いでしょう。</p>
+
+    <p>たとえば、次のようにサーバが設定されていたとします。</p>
+
+<div class="example"><p><code>
+    User www<br />
+    Group webgroup<br />
+</code></p></div>
+
+    <p><code class="program"><a href="./programs/suexec.html">suexec</a></code> が "/usr/local/apache2/bin/suexec" 
+    にインストールされていた場合、次のように設定する必要があります。</p>
+
+<div class="example"><p><code>
+    chgrp webgroup /usr/local/apache2/bin/suexec<br />
+    chmod 4750 /usr/local/apache2/bin/suexec<br />
+</code></p></div>
+
+    <p>これで Apache が実行されるグループのみが 
+    suEXEC ラッパーを実行できるということを
+    確証します。</p>
+  </div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="enable" id="enable">suEXEC
+    の有効化と無効化</a></h2>
+
+    <p>起動時に、Apache は <code>--sbindir</code>
+    オプションで設定されたディレクトリで
+    <code>suexec</code> を探します
+    (デフォルトは "/usr/local/apache/sbin/suexec") 。
+    適切に設定された suEXEC がみつかると、
+    エラーログに以下のメッセージが出力されます。</p>
+
+<div class="example"><p><code>
+    [notice] suEXEC mechanism enabled (wrapper: <var>/path/to/suexec</var>)
+</code></p></div>
+
+    <p>サーバ起動時にこのメッセージが出ない場合、
+    大抵はサーバが想定した場所で wrapper プログラムが見つからなかったか、
+    <em>setuid root</em> としてインストールされていないかです。</p>
+
+    <p>suEXEC の仕組みを使用するのが初めてで、Apache が既に動作中であれば、
+    Apache を kill して、再起動しなければなりません。HUP シグナルや
+    USR1 シグナルによる単純な再起動では不十分です。</p>
+    <p>suEXEC を無効にする場合は、<code>suexec</code> ファイルを削除してから
+    Apache を kill して再起動します。
+    </p>
+  </div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="usage" id="usage">suEXEC の使用</a></h2>
+
+    <p>CGI プログラムへのリクエストが suEXEC ラッパーを呼ぶのは、
+    <code class="directive"><a href="./mod/mod_suexec.html#suexecusergroup">SuexecUserGroup</a></code> ディレクティブを
+    含むバーチャルホストへのリクエストか、<code class="module"><a href="./mod/mod_userdir.html">mod_userdir</a></code> により
+    処理されたリクエストの場合に限ります。</p>
+
+    <p><strong>仮想ホスト:</strong><br />
+    suEXEC wrapper の使い方として、
+    <code class="directive"><a href="./mod/core.html#virtualhost">VirtualHost</a></code> 設定での
+    <code class="directive"><a href="./mod/mod_suexec.html#suexecusergroup">SuexecUserGroup</a></code>
+    ディレクティブを通したものがあります。
+    このディレクティブをメインサーバのユーザ ID
+    と異なるものにすると、CGI リソースへのすべてのリクエストは、その
+    <code class="directive"><a href="./mod/core.html#virtualhost">&lt;VirtualHost&gt;</a></code> で指定された <em>User</em> と
+    <em>Group</em> として実行されます。<code class="directive"><a href="./mod/core.html#virtualhost">&lt;VirtualHost&gt;</a></code>
+    でこのディレクティブが指定されていない場合、
+    メインサーバのユーザ ID が想定されます。</p>
+
+    <p><strong>ユーザディレクトリ:</strong><br />
+    <code class="module"><a href="./mod/mod_userdir.html">mod_userdir</a></code> により処理されたリクエストは
+    リクエストされたユーザディレクトリのユーザ ID で CGI プログラムを
+    実行するために suEXEC ラッパーを呼びます。
+    この機能を動作させるために必要なことは、CGI
+    をそのユーザで実行できること、そのスクリプトが上記の<a href="#model">セキュリティ検査</a>をパスできることです。
+    <a href="#install">コンパイル
+     時のオプション</a> <code>--with-suexec-userdir</code> も参照してください。</p>
+  </div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="debug" id="debug">suEXEC のデバッグ</a></h2>
+
+    <p>suEXEC wrapper は、上記で述べた <code>--with-suexec-logfile</code>
+    オプションで指定されたファイルにログ情報を記録します。
+    wrapper を適切に設定、インストールできていると思う場合、
+    どこで迷っているか見ようとするならこのログとサーバの
+    エラーログを見るとよいでしょう。</p>
+  </div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="jabberwock" id="jabberwock">とかげに注意: 警告と事例</a></h2>
+
+    <p><strong>注意!</strong>
+    この章は完全ではありません。この章の最新改訂版については、
+    Apache グループの<a href="http://httpd.apache.org/docs/2.4/suexec.html">
+    オンラインドキュメント</a>版を参照してください。
+    </p>
+
+    <p>サーバの設定に制限をもうける wrapper について、
+    いくつか興味深い点があります。suEXEC に関する "バグ"
+    を報告する前にこれらを確認してください。</p>
+
+    <ul>
+      <li><strong>suEXEC の興味深い点</strong></li>
+
+      <li>階層構造の制限
+
+
+        <p class="indent">
+          セキュリティと効率の理由から、<code>suEXEC</code> の全てのリクエストは
+          仮想ホストへのリクエストにおける最上位のドキュメントルート内か、
+          ユーザディレクトリへのリクエストにおける個々のユーザの最上位の
+          ドキュメントルート内に残らなければなりません。
+          例えば、四つの仮想ホストを設定している場合、
+          仮想ホストの suEXEC に有利なように、メインの Apache
+          ドキュメント階層の外側に全ての仮想ホストのドキュメントルートを
+          構築する必要があります。(例は後日記載)
+        </p>
+      </li>
+
+      <li>suEXEC の PATH 環境変数
+
+
+        <p class="indent">
+          これを変更するのは危険です。この指定に含まれる各パスが
+          <strong>信頼できる</strong>
+          ディレクトリであることを確認してください。
+          世界からのアクセスにより、誰かがホスト上でトロイの木馬
+          を実行できるようにはしたくないでしょう。
+        </p>
+      </li>
+
+      <li>suEXEC コードの改造
+
+
+        <p class="indent">
+          繰り返しますが、何をやろうとしているか把握せずにこれをやると
+          <strong>大きな問題</strong>を引き起こしかねません。
+          可能な限り避けてください。
+        </p>
+      </li>
+    </ul>
+</div></div>
+<div class="bottomlang">
+<p><span>翻訳済み言語: </span><a href="./en/suexec.html" hreflang="en" rel="alternate" title="English">&nbsp;en&nbsp;</a> |
+<a href="./fr/suexec.html" hreflang="fr" rel="alternate" title="Français">&nbsp;fr&nbsp;</a> |
+<a href="./ja/suexec.html" title="Japanese">&nbsp;ja&nbsp;</a> |
+<a href="./ko/suexec.html" hreflang="ko" rel="alternate" title="Korean">&nbsp;ko&nbsp;</a> |
+<a href="./tr/suexec.html" hreflang="tr" rel="alternate" title="Türkçe">&nbsp;tr&nbsp;</a></p>
+</div><div class="top"><a href="#page-header"><img src="./images/up.gif" alt="top" /></a></div><div class="section"><h2><a id="comments_section" name="comments_section">コメント</a></h2><div class="warning"><strong>Notice:</strong><br />This is not a Q&amp;A section. Comments placed here should be pointed towards suggestions on improving the documentation or server, and may be removed again by our moderators if they are either implemented or considered invalid/off-topic. Questions on how to manage the Apache HTTP Server should be directed at either our IRC channel, #httpd, on Freenode, or sent to our <a href="http://httpd.apache.org/lists.html">mailing lists</a>.</div>
+<script type="text/javascript"><!--//--><![CDATA[//><!--
+var comments_shortname = 'httpd';
+var comments_identifier = 'http://httpd.apache.org/docs/2.4/suexec.html';
+(function(w, d) {
+    if (w.location.hostname.toLowerCase() == "httpd.apache.org") {
+        d.write('<div id="comments_thread"><\/div>');
+        var s = d.createElement('script');
+        s.type = 'text/javascript';
+        s.async = true;
+        s.src = 'https://comments.apache.org/show_comments.lua?site=' + comments_shortname + '&page=' + comments_identifier;
+        (d.getElementsByTagName('head')[0] || d.getElementsByTagName('body')[0]).appendChild(s);
+    }
+    else { 
+        d.write('<div id="comments_thread">Comments are disabled for this page at the moment.<\/div>');
+    }
+})(window, document);
+//--><!]]></script></div><div id="footer">
+<p class="apache">Copyright 2017 The Apache Software Foundation.<br />この文書は <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a> のライセンスで提供されています。.</p>
+<p class="menu"><a href="./mod/">モジュール</a> | <a href="./mod/directives.html">ディレクティブ</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="./glossary.html">用語</a> | <a href="./sitemap.html">サイトマップ</a></p></div><script type="text/javascript"><!--//--><![CDATA[//><!--
+if (typeof(prettyPrint) !== 'undefined') {
+    prettyPrint();
+}
+//--><!]]></script>
+</body></html>
\ No newline at end of file
diff --git a/docs/manual/suexec.html.ko.euc-kr b/docs/manual/suexec.html.ko.euc-kr
new file mode 100644
index 0000000..0e8df7a
--- /dev/null
+++ b/docs/manual/suexec.html.ko.euc-kr
@@ -0,0 +1,564 @@
+<?xml version="1.0" encoding="EUC-KR"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" lang="ko" xml:lang="ko"><head>
+<meta content="text/html; charset=EUC-KR" http-equiv="Content-Type" />
+<!--
+        XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+              This file is generated from xml source: DO NOT EDIT
+        XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+      -->
+<title>suEXEC ���� - Apache HTTP Server Version 2.4</title>
+<link href="./style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" />
+<link href="./style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" />
+<link href="./style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" /><link rel="stylesheet" type="text/css" href="./style/css/prettify.css" />
+<script src="./style/scripts/prettify.min.js" type="text/javascript">
+</script>
+
+<link href="./images/favicon.ico" rel="shortcut icon" /></head>
+<body id="manual-page"><div id="page-header">
+<p class="menu"><a href="./mod/">���</a> | <a href="./mod/directives.html">���þ��</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="./glossary.html">���</a> | <a href="./sitemap.html">����Ʈ��</a></p>
+<p class="apache">Apache HTTP Server Version 2.4</p>
+<img alt="" src="./images/feather.png" /></div>
+<div class="up"><a href="./"><img title="&lt;-" alt="&lt;-" src="./images/left.gif" /></a></div>
+<div id="path">
+<a href="http://www.apache.org/">Apache</a> &gt; <a href="http://httpd.apache.org/">HTTP Server</a> &gt; <a href="http://httpd.apache.org/docs/">Documentation</a> &gt; <a href="./">Version 2.4</a></div><div id="page-content"><div id="preamble"><h1>suEXEC ����</h1>
+<div class="toplang">
+<p><span>������ ���: </span><a href="./en/suexec.html" hreflang="en" rel="alternate" title="English">&nbsp;en&nbsp;</a> |
+<a href="./fr/suexec.html" hreflang="fr" rel="alternate" title="Fran&#231;ais">&nbsp;fr&nbsp;</a> |
+<a href="./ja/suexec.html" hreflang="ja" rel="alternate" title="Japanese">&nbsp;ja&nbsp;</a> |
+<a href="./ko/suexec.html" title="Korean">&nbsp;ko&nbsp;</a> |
+<a href="./tr/suexec.html" hreflang="tr" rel="alternate" title="T&#252;rk&#231;e">&nbsp;tr&nbsp;</a></p>
+</div>
+<div class="outofdate">�� ������ �ֽ��� ������ �ƴմϴ�.
+            �ֱٿ� ����� ������ ���� ������ �����ϼ���.</div>
+
+    <p><strong>suEXEC</strong> ����� ����ġ�� <strong>CGI</strong>��
+    <strong>SSI</strong> ���α׷��� �������� ������ ����� ID��
+    �ƴ� �ٸ� ����� ID�� �����ϵ��� �Ѵ�. ���� CGI�� SSI ���α׷���
+    �����ϸ� �������� ������ ����ڿ� ���� ����ڷ� �����Ѵ�.</p>
+
+    <p>�� ����� ������ ����ϸ� ����ڰ� ���� CGI�� SSI ���α׷���
+    �����ϰ� �����Ҷ� �߻��� �� �ִ� ���������� ����� ����
+    �� �ִ�. �׷��� suEXEC�� �������ϰ� �����Ǹ� ���� ������
+    ��ǻ�Ϳ� ���ο� ���� ������ ���� �� �ִ�. ���� <em>setuid root</em>
+    ���α׷��� �̷� ���α׷��� ���� ������ �����ϴٸ� suEXEC��
+    ��������ʱ� �������� �ٶ���.</p>
+  </div>
+<div id="quickview"><a href="https://www.apache.org/foundation/contributing.html" class="badge"><img src="https://www.apache.org/images/SupportApache-small.png" alt="Support Apache!" /></a><ul id="toc"><li><img alt="" src="./images/down.gif" /> <a href="#before">�����ϱ� ����</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#model">suEXEC ���ȸ�</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#install">suEXEC ������ ��ġ</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#enable">suEXEC �� ���</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#usage">suEXEC ����ϱ�</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#debug">suEXEC ������ϱ�</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#jabberwock">�ٽ� �ѹ� �����϶�: ���� ����</a></li>
+</ul><h3>����</h3><ul class="seealso"><li><a href="#comments_section">Comments</a></li></ul></div>
+<div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="before" id="before">�����ϱ� ����</a></h2>
+
+    <p>�����ϱ� ���� �켱 ����ġ�׷�� �� ������ ������ ������.</p>
+
+    <p>���� <strong>setuid</strong>�� <strong>setgid</strong>
+    ����� ������ ���н��� �ü���� ����Ѵٰ� �����Ѵ�. ���
+    ��ɾ� ���鵵 ���� ������ �Ѵ�. suEXEC�� �����ϴ� �ٸ� �÷�����
+    ����ϴٸ� ������ �ٸ� �� �ִ�.</p>
+
+    <p>�ι�°, ����� ��ǻ�� ������ �⺻ ����� ������ �ͼ��ϴٰ�
+    �����Ѵ�. ���⿡�� <strong>setuid/setgid</strong> ��ɰ�
+    �̵��� �ý��۰� ���ȿ� ��ġ�� ���� ���⿡ ���� ���ذ� ���Եȴ�.</p>
+
+    <p>����°, suEXEC �ڵ��� <strong>������������</strong>
+    ������ ����Ѵٰ� �����Ѵ�. �����ڿ� ���� ��Ÿ�׽��͵���
+    suEXEC�� ���õ� ��� �ڵ带 ���ɽ����� �����ϰ� �˻��ߴ�.
+    �ڵ带 �����ϰ� �ϰ� Ȯ���� ������ �����ϱ����� ��� ���Ǹ�
+    ��￴��. �� �ڵ带 �����ϸ� ����ġ���� ������ ���ο� ����
+    ������ �߻��� �� �ִ�. ���� ���α׷��ֿ� ���� �ſ� �� �˰�
+    �ڵ带 ���캸������ ����ġ�׷�� �۾��� ������ �ǻ簡 ���ٸ�
+    suEXEC �ڵ带 ���������ʱ� <strong>������</strong> ���Ѵ�.</p>
+
+    <p>�׹�°���� ����������, ����ġ�׷��� suEXEC�� ����ġ
+    �⺻��ġ�� �������� <strong>�ʱ��</strong> �����ߴ�. �ᱹ
+    �����ڰ� ���Ǹ� ��￩�� suEXEC�� �����ؾ� �Ѵ�. suEXEC��
+    ���� ������ �� ������� �����ڴ� �Ϲ����� ��ġ����� suEXEC��
+    ��ġ�� �� �ִ�. suEXEC ����� ����ϴ� �ý����� ������ å������
+    �����ڴ� �� ���������� �����ְ� ���캸�� �����ؾ� �Ѵ�.
+    �̷� ���� ������ suEXEC�� ����Ҹ�ŭ �����ְ� ��ȣ�� 
+    ������� suEXEC�� ����ϵ��� ����ġ�׷��� ���ϱ� �����̴�.</p>
+
+    <p>������ ����ϱ� ���ϴ°�? �׷���? ����. ���� ��������!</p>
+</div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="model" id="model">suEXEC ���ȸ�</a></h2>
+
+    <p>suEXEC�� �����ϰ� ��ġ�ϱ� ���� �츮�� ���ȸ��� ����
+    �����Ѵ�. �̸� ���� ��Ȯ�� suEXEC �ȿ����� ���� ���� �Ͼ��
+    �ý����� ������ ���� ������ �����ؾ� ���� �� �� ������ ��
+    �ִ�.</p>
+
+    <p><strong>suEXEC</strong>�� ����ġ �������� �θ��� setuid
+    "wrapper" ���α׷��� ������� �Ѵ�. �� wrapper�� �����ڰ�
+    �ּ����� �ٸ� userid�� �����ϵ��� ������ CGI�� SSI ���α׷���
+    HTTP ��û�� ���� �Ҹ���. �̷� ��û�� ���� ����ġ�� suEXEC
+    wrapper���� ���α׷���� ���α׷��� ������ ����ڿ� �׷�
+    ID�� �����Ѵ�.</p>
+
+    <p>�׷��� wrapper�� ���� ������ ���� ������ ���и� �����Ѵ�.
+    �� ������ �ϳ��� �����ϸ� ���α׷��� ���з� ��ϵǰ� ������
+    ���� �����Ѵ�. �������� ������ ������ ����Ѵ�:</p>
+
+    <ol>
+      <li>
+        <strong>wrapper�� �����ϴ� ����ڰ� �ý����� ��������
+        �������</strong> 
+
+        <p class="indent">
+          wrapper�� �����ϴ� ����ڰ� ������ �ý����� ���������
+          Ȯ���Ѵ�.
+        </p>
+     </li>
+
+     <li>
+        <strong>������ ���� �ƱԸ�Ʈ�� wrapper�� �����ϴ°�?</strong>
+
+        <p class="indent">
+          wrapper�� ������ ���� �ƱԸ�Ʈ�� �־�߸� ����ȴ�.
+          ����ġ �������� �� ������ �ȴ�. wrapper�� ������ ����
+          �ƱԸ�Ʈ�� �������ϸ� ��ŷ�Ǿ��ų� ����ġ�� suEXEC��
+          ���� ������ �ִ� ���̴�.
+        </p>
+      </li>
+
+      <li>
+        <strong>�� ����ڰ� wrapper�� �����ϵ��� ���Ǿ���?</strong> 
+
+        <p class="indent">
+          �� ����ڰ� wrapper�� �����ϵ��� ���Ǿ���? ����
+          �� �����(����ġ �����)���� �� ���α׷��� ������
+          �� �ִ�.
+        </p>
+      </li>
+
+      <li>
+        <strong>������ CGI�� SSI ���α׷��� ������������ ����������
+        �����°�?</strong>
+
+        <p class="indent">
+          ������ CGI�� SSI ���α׷��� '/'�� �����ϰų� ������
+          '..'�� �����°�? �̵��� ����� �� ����. ������ CGI/SSI
+          ���α׷��� suEXEC ���� root (�Ʒ�
+          <code>--with-suexec-docroot=<em>DIR</em></code> ����)
+          ���� �־�� �Ѵ�.
+        </p>
+      </li>
+
+      <li>
+        <strong>������ ����ڸ��� ��ȿ�Ѱ�?</strong> 
+
+        <p class="indent">
+          ������ ����ڰ� �����ϴ°�?
+        </p>
+      </li>
+
+      <li>
+        <strong>������ �׷���� ��ȿ�Ѱ�?</strong> 
+
+        <p class="indent">
+          ������ �׷��� �����ϴ°�?
+        </p>
+      </li>
+
+      <li>
+        <strong>������ ����ڰ� superuser�� <em>�ƴѰ�</em>?</strong>
+        
+
+        <p class="indent">
+          ���� suEXEC�� <code><em>root</em></code>�� CGI/SSI
+          ���α׷��� ������ �� ������ �Ѵ�.
+        </p>
+      </li>
+
+      <li>
+        <strong>������ userid�� �ּ� ID ���ں��� <em>ū��</em>?</strong>
+
+        <p class="indent">
+          �������� �ּ� ����� ID ���ڸ� �����Ѵ�. �׷��� CGI/SSI
+          ���α׷��� ������ �� �ִ� userid�� �ּ�ġ�� ������
+          �� �ִ�. "�ý��ۿ�" ������ �����Ҷ� �����ϴ�.
+        </p>
+      </li>
+
+      <li>
+        <strong>������ �׷��� superuser �׷��� <em>�ƴѰ�</em>?</strong> 
+
+        <p class="indent">
+          ���� suEXEC�� <code><em>root</em></code> �׷��� CGI/SSI
+          ���α׷��� ������ �� ������ �Ѵ�.
+        </p>
+      </li>
+
+      <li>
+        <strong>������ groupid�� �ּ� ID ���ں��� <em>ū��</em>?</strong> 
+
+        <p class="indent">
+          �������� �ּ� �׷� ID ���ڸ� �����Ѵ�. �׷��� CGI/SSI
+          ���α׷��� ������ �� �ִ� groupid�� �ּ�ġ�� ������
+          �� �ִ�. "�ý��ۿ�" �׷��� �����Ҷ� �����ϴ�.
+        </p>
+      </li>
+
+      <li>
+        <strong>wrapper�� ���������� ������ ����ڿ� �׷���
+        �� �� �ִ°�?</strong>
+
+        <p class="indent">
+          �� �ܰ迡�� ���α׷��� setuid�� setgid ȣ���� �Ͽ�
+          ������ ����ڿ� �׷��� �ȴ�. ��, �׷� ���ٸ����
+          ����ڰ� �ش�� ��� �׷����� �ʱ�ȭ�ȴ�.
+        </p>
+      </li>
+
+      <li>
+        <strong>CGI/SSI ���α׷��� �ִ� ���丮�� ���丮��
+        ������ �� �ִ°�?</strong>
+
+        <p class="indent">
+          ���丮�� �������� �ʴٸ� ������ ���� �� ����. �̰�����
+          ���丮�� ������ �� ���ٸ� ���丮�� �������� ����
+          ���̴�.
+        </p>
+      </li>
+
+      <li>
+        <strong>���丮�� ����ġ ������ �ȿ� �ִ°�?</strong>
+
+        <p class="indent">
+          ������ �Ϲ����� �κ��� ��û�� ��� ��û�ϴ� ���丮��
+          suEXEC ���� root �Ʒ� �ִ°�? UserDir�� ��û�� ���
+          ��û�ϴ� ���丮�� suEXEC userdir�� ������ (<a href="#install">suEXEC ���� �ɼ�</a> ����) ���丮
+          �Ʒ��� �ִ°�?
+        </p>
+      </li>
+
+      <li>
+        <strong>�ٸ� ������ ���丮�� ��������� <em>���°�</em>?</strong>
+
+        <p class="indent">
+          ���丮�� �ٸ� ������� ����α� �������ʴ´�. ����
+          �����ڸ��� ���丮 ������ ������ �� �ִ�.
+        </p>
+      </li>
+
+      <li>
+        <strong>������ CGI/SSI ���α׷��� �����ϴ°�?</strong> 
+
+        <p class="indent">
+          ���������ʴٸ� ������ ���� ����.
+        </p>
+      </li>
+
+      <li>
+        <strong>�ٸ� ������ ������ CGI/SSI ���α׷��� ���������
+        <em>���°�</em>?</strong>
+
+        <p class="indent">
+          �����ڿ� ������ CGI/SSI ���α׷��� �����ϱ� �������ʴ´�.
+        </p>
+      </li>
+
+      <li>
+        <strong>������ CGI/SSI ���α׷��� setuid�� setgid��
+        <em>�ƴѰ�</em>?</strong>
+
+        <p class="indent">
+          �츮�� ���α׷��� �ٽ� UID/GID�� �����ϱ� �������ʴ´�.
+        </p>
+      </li>
+
+      <li>
+        <strong>������ �����/�׷��� ���α׷��� �����/�׷�� ������?</strong>
+
+        <p class="indent">
+          ����ڰ� ������ �������ΰ�?
+        </p>
+      </li>
+
+      <li>
+        <strong>������ ������ ���� ���μ����� ȯ�溯���� û����
+        �� �ִ°�?</strong>
+
+        <p class="indent">
+          suEXEC�� (�������� ������) ������ ���� PATH�� ���,
+          (�̰͵� �������� ����) ������ ȯ�溯�� ��Ͽ� ���ŵ�
+          ������ ����� ���μ����� ȯ�溯���� �����.
+        </p>
+      </li>
+
+      <li>
+        <strong>���������� ������ CGI/SSI ���α׷��� ������
+        �� �ִ°�?</strong> 
+
+        <p class="indent">
+          ���⼭ suEXEC�� ������ ������ CGI/SSI ���α׷��� �����Ѵ�.
+        </p>
+      </li>
+    </ol>
+
+    <p>�̰��� suEXEC wrapper ���ȸ��� ǥ�� �����̴�. �ټ�
+    �����ϰ� CGI/SSI ���迡 ���ο� ������ ������, ������ ���ο�
+    �ΰ� �Ѵܰ辿 ���ɽ����� ���������.</p>
+
+    <p>�� ���� ���� ���� ������ � ������ �ִ����� ������
+    suEXEC �������� � ���� ������ ���� �� �ִ����� ���� ��
+    ������ <a href="#jabberwock">"�ٽ� �ѹ� �����϶�"</a> ����
+    �����϶�.</p>
+</div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="install" id="install">suEXEC ������ ��ġ</a></h2>
+
+    <p>���� ����ִ� ������ �����Ѵ�.</p>
+
+    <p><strong>suEXEC ���� �ɼ�</strong><br />
+    </p>
+
+    <dl>
+      <dt><code>--enable-suexec</code></dt>
+
+      <dd>�� �ɼ��� �⺻������ ��ġ�ǰų� Ȱ��ȭ�����ʴ� suEXEC
+      ����� Ȱ��ȭ�Ѵ�. APACI�� suEXEC�� �޾Ƶ��̷���
+      <code>--enable-suexec</code> �ɼǿܿ�
+      <code>--with-suexec-xxxxx</code> �ɼ��� �ּ��� �Ѱ�
+      �ʿ��ϴ�.</dd>
+
+      <dt><code>--with-suexec-bin=<em>PATH</em></code></dt>
+
+      <dd><code>suexec</code> ���̳ʸ� ��δ� ���Ȼ� ������
+      ������ ��ϵǾ� �Ѵ�. ��� �⺻���� �����Ϸ��� �� �ɼ���
+      ����Ѵ�. <em>���� ���</em>
+      <code>--with-suexec-bin=/usr/sbin/suexec</code></dd>
+
+      <dt><code>--with-suexec-caller=<em>UID</em></code></dt>
+
+      <dd>���� ����ġ�� �����ϴ� <a href="mod/mpm_common.html#user">����ڸ�</a>. ���α׷���
+      ������ �� �ִ� ������ ����ڴ�.</dd>
+
+      <dt><code>--with-suexec-userdir=<em>DIR</em></code></dt>
+
+      <dd>suEXEC ������ ���Ǵ� ����� Ȩ���丮�� �������丮��
+      �����Ѵ�. �� ���丮�� �ִ� ��� ���������� �������
+      suEXEC�� ����Ƿ�, ��� ���α׷��� "�����ؾ�" �Ѵ�. (����
+      ���, ���� "*"�� ����) "������" UserDir ���þ ����Ѵٸ�
+      ���� ���� �����ؾ� �Ѵ�. UserDir ���þ passwd ���Ͽ�
+      ���� ����� Ȩ���丮�� �ٸ��� suEXEC�� ����������
+      �۵����� �ʴ´�. �⺻���� "public_html"�̴�.<br />
+      ����ȣ��Ʈ���� ���� �ٸ� UserDir�� ����Ѵٸ� ��� ��
+      �θ� ���丮 �ȿ� �ֵ��� �����ؾ� �ϰ�, �� �θ� ���丮����
+      ���� ���´�. <strong>�̷��� �������� ������, "~userdir"
+      cgi ��û�� �۵����� �ʴ´�!</strong></dd>
+
+      <dt><code>--with-suexec-docroot=<em>DIR</em></code></dt>
+
+      <dd>����ġ�� DocumentRoot�� �����Ѵ�. �̴� suEXEC�� �����
+      �� �ִ� (UserDirs�� ������) ������ �����̴�. �⺻ ���丮��
+      <code>--datadir</code> ���� "/htdocs"�� ���� ���̴�.
+      <em>���� ���</em> "<code>--datadir=/home/apache</code>"��
+      �����ߴٸ� suEXEC wrapper�� document root��
+      "/home/apache/htdocs" ���丮�� ����Ѵ�.</dd>
+
+      <dt><code>--with-suexec-uidmin=<em>UID</em></code></dt>
+
+      <dd>suEXEC���� ���������� ������� �ּ� UID�� �����Ѵ�.
+      ��κ��� �ý��ۿ��� 500�̳� 100�� �����ϴ�. �⺻����
+      100�̴�.</dd>
+
+      <dt><code>--with-suexec-gidmin=<em>GID</em></code></dt>
+
+      <dd>suEXEC���� ���������� �׷��� �ּ� GID�� �����Ѵ�.
+      ��κ��� �ý��ۿ��� 100�� �����ϹǷ� �� ���� �⺻���̴�.</dd>
+
+      <dt><code>--with-suexec-logfile=<em>FILE</em></code></dt>
+
+      <dd>��� suEXEC �۵��� ������ (���ó� ����� ������ ������)
+      ����� �α����ϸ��� �����Ѵ�. �⺻������ �α������� �̸���
+      "suexec_log"�̰� ǥ�� �α����� ���丮��
+      (<code>--logfiledir</code>) ��ġ�Ѵ�.</dd>
+
+      <dt><code>--with-suexec-safepath=<em>PATH</em></code></dt>
+
+      <dd>CGI �������Ͽ� �Ѱ��� ������ PATH ȯ�溯���� �����Ѵ�.
+      �⺻���� "/usr/local/bin:/usr/bin:/bin"�̴�.</dd>
+    </dl>
+
+    <p><strong>suEXEC wrapper�� �������ϰ� ��ġ�ϱ�</strong><br />
+    <code>--enable-suexec</code> �ɼ����� suEXEC ����� �����ϰ���
+    ��� <code>make</code> ��ɾ �����ϸ� <code>suexec</code>
+    ���������� (����ġ�� �Բ�) �ڵ����� ���������.<br />
+    ������ �������� �� <code>make install</code> ��ɾ
+    �����Ͽ� ��ġ�� �� �ִ�. ���̳ʸ����� <code>suexec</code>��
+    <code>--sbindir</code> �ɼ����� ������ ���丮�� ��ġ�ȴ�.
+    �⺻ ��ġ�� "/usr/local/apache2/sbin/suexec"�̴�.<br />
+    ��ġ ������ <strong><em>root ����</em></strong>�� �ʿ�����
+    �����϶�. wrapper�� ����� ID�� �����ϱ����ؼ��� �����ڰ�
+    <code><em>root</em></code>�̰� ���ϸ��� setuserid �����Ʈ��
+    �����Ǿ� �Ѵ�.</p>
+
+    <p><strong>���������� ���Ѽ���</strong><br />
+    suEXEC wrapper�� �ڽ��� ������ ����ڰ� ���� �ɼ�
+    <code>--with-suexec-caller</code>�� ������ �ùٸ� ���������
+    Ȯ���� ������, �� �˻� ������ suEXEC�� ����ϴ� �ý���ȣ��
+    Ȥ�� ���̺귯�� �Լ��� ���۵Ǿ��� �� �ִ�. �̸� ����ϸ�
+    �Ϲ������� ���� �����̹Ƿ� ���� ����ġ�� �����ϴ� �׷츸��
+    suEXEC�� ������ �� �ֵ��� ���Ͻý��� ������ �����ؾ� �Ѵ�.</p>
+
+    <p>���� ���, �������� ������ ���� �����ϰ�:</p>
+