Merge ~nacc/ubuntu/+source/apache2:lp1702582 into ~usd-import-team/ubuntu/+source/apache2:debian/sid

[Nish Aravamudan]

[Nish Aravamudan (nacc)]

Note that the below diff appears to be huge, but is actually incorrect.

pkg=apache2; git ubuntu clone $pkg; cd $pkg; git ubuntu remote add nacc

Will result in a repository locally that will allow for review

[Andreas Hasenack (ahasenack)]

libnghttp2-dev is still in universe, shouldn't it have been dropped from d/control's build-depends? In fact, that used to be our delta at least up to 2.4.25-3ubuntu3.

It was dropped in 2.4.25-3ubuntu3, then 2.4.25-4 was a debian build with CVEs, and this branch introduces 2.4.25-4ubuntu1 with no mention of keeping the drop in remaining merges.

review: Needs Information

[Nish Aravamudan (nacc)]

On Fri, Jul 14, 2017 at 1:53 PM, Andreas Hasenack <email address hidden> wrote:
> Review: Needs Information
>
> libnghttp2-dev is still in universe, shouldn't it have been dropped from d/control's build-depends? In fact, that used to be our delta at least up to 2.4.25-3ubuntu3.
>

No, I think you misunderstand the history a bit. 2.4.25-3ubuntu3 is
stuck in proposed specifically because of the above, because I
re-dropped the delta (it is *not* present i 2.4.25-3ubuntu3). A MIR is
filed and pending review.

> It was dropped in 2.4.25-3ubuntu3, then 2.4.25-4 was a debian build with CVEs, and this branch introduces 2.4.25-4ubuntu1 with no mention of keeping the drop in remaining merges.
>

Right, it was *dropped* in 2.4.25-3ubuntu3, which means it is no
longer part of the delta. It would not be documented in a subsequent
merge, as it the drop was removal of delta.

[Andreas Hasenack (ahasenack)]

Ok, I see. So this new upload's fate is to also remain stuck in proposed, since it requires libnghttp2-dev which is still in universe, rght?

For reference, the MIR: https://bugs.launchpad.net/ubuntu/+source/nghttp2/+bug/1687454

This MP looks good:
- package builds, installs, upgrades
- confirmed the remaining delta with what's mentioned in d/changelog
- http2 works over ssl:
$ nghttp -nv https://artful-apache.lxd/
[ 0.003] Connected
The negotiated protocol: h2
(...)
- server logs confirm:
10.0.100.1 - - [17/Jul/2017:13:40:29 +0000] "GET / HTTP/2.0" 200 3138 "-" "nghttp2/1.7.1"

Thanks!

review: Approve

[Nish Aravamudan (nacc)]

Thanks for the review, Andreas. A new version is in Debian already and I'm going to superseded this with that merge. Please re-review.

Unmerged commits

6e859d2... by Nish Aravamudan on 2017-07-05

update-maintainer

f0b4fa6... by Nish Aravamudan on 2017-07-05

reconstruct-changelog

e63c753... by Nish Aravamudan on 2017-07-05

merge-changelogs

5d78d39... by Nish Aravamudan on 2016-12-09

      + d/apache2.install: place the apache2-systemd.conf file in the
        correct location.

f3364d3... by Nish Aravamudan on 2016-12-09

    - Correct systemd-sysv-generator behavior by customizing some
      parameters:
      + d/apache2-systemd.conf: add a drop-in file to specify some
        parameters for the systemd unit (type=Forking and
        RemainsAfterExit=no), this allow a correct state synchronisation
        between systemctl status and actual state of apache2 daemon.

d3ac006... by Nish Aravamudan on 2016-12-09

      + d/source/include-binaries: add Ubuntu icon file

70abf4c... by Nish Aravamudan on 2016-12-09

    - d/index.html, d/icons/ubuntu-logo.png, d/apache2.postrm: replace
      Debian with Ubuntu on default page.

061c2e4... by Nish Aravamudan on 2016-12-09

    - debian/patches/086_svn_cross_compiles: Backport several cross
      fixes from upstream

9052ec1... by Nish Aravamudan on 2016-12-09

    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.

ac90c0c... by Nish Aravamudan on 2016-12-09

    - debian/{control, apache2.install, apache2-utils.ufw.profile,
      apache2.dirs}: Add ufw profiles.

diff --git a/debian/apache2-bin.install b/debian/apache2-bin.install
index 63c573f..3d1bdf1 100644
--- a/debian/apache2-bin.install
+++ b/debian/apache2-bin.install
@@ -1,2 +1,3 @@
 /usr/lib/apache2/modules/
 /usr/sbin/apache2
+debian/apache2.py usr/share/apport/package-hooks
diff --git a/debian/apache2-systemd.conf b/debian/apache2-systemd.conf
new file mode 100644
index 0000000..b031203
--- /dev/null
+++ b/debian/apache2-systemd.conf
@@ -0,0 +1,3 @@
+[Service]
+Type=forking
+RemainAfterExit=no
diff --git a/debian/apache2-utils.ufw.profile b/debian/apache2-utils.ufw.profile
new file mode 100644
index 0000000..974a655
--- /dev/null
+++ b/debian/apache2-utils.ufw.profile
@@ -0,0 +1,14 @@
+[Apache]
+title=Web Server
+description=Apache v2 is the next generation of the omnipresent Apache web server.
+ports=80/tcp
+
+[Apache Secure]
+title=Web Server (HTTPS)
+description=Apache v2 is the next generation of the omnipresent Apache web server.
+ports=443/tcp
+
+[Apache Full]
+title=Web Server (HTTP,HTTPS)
+description=Apache v2 is the next generation of the omnipresent Apache web server.
+ports=80,443/tcp
diff --git a/debian/apache2.dirs b/debian/apache2.dirs
index 531c08f..86327c4 100644
--- a/debian/apache2.dirs
+++ b/debian/apache2.dirs
@@ -10,3 +10,4 @@ var/cache/apache2/mod_cache_disk
 var/log/apache2
 var/www/html
 usr/share/bug/apache2
+/etc/ufw/applications.d/apache2
diff --git a/debian/apache2.install b/debian/apache2.install
index 798d2f0..eafb48a 100644
--- a/debian/apache2.install
+++ b/debian/apache2.install
@@ -8,3 +8,5 @@ debian/apache2ctl				/usr/sbin
 debian/a2query					/usr/sbin
 debian/ask-for-passphrase			/usr/share/apache2/
 debian/debhelper/apache2-maintscript-helper	/usr/share/apache2/
+debian/apache2-utils.ufw.profile /etc/ufw/applications.d/
+debian/apache2-systemd.conf /lib/systemd/system/apache2.service.d/
diff --git a/debian/apache2.postrm b/debian/apache2.postrm
index a68583c..b0e5d7b 100644
--- a/debian/apache2.postrm
+++ b/debian/apache2.postrm
@@ -33,6 +33,7 @@ is_default_index_html () {
 		776221a94e5a174dc2396c0f3f6b6a74
 		c481228d439cbb54bdcedbaec5bbb11a
 		e2620d4a5a0f8d80dd4b16de59af981f
+		3526531ccd6c6a1d2340574a305a18f8
 	EOF
 }
 
diff --git a/debian/apache2.py b/debian/apache2.py
new file mode 100644
index 0000000..a9fb9d8
--- /dev/null
+++ b/debian/apache2.py
@@ -0,0 +1,48 @@
+#!/usr/bin/python
+
+'''apport hook for apache2
+
+(c) 2010 Adam Sommer.
+Author: Adam Sommer <[e-mail]>
+
+This program is free software; you can redistribute it and/or modify it
+under the terms of the GNU General Public License as published by the
+Free Software Foundation; either version 2 of the License, or (at your
+option) any later version.  See http://www.gnu.org/copyleft/gpl.html for
+the full text of the license.
+'''
+
+from apport.hookutils import *
+import os
+
+SITES_ENABLED_DIR = '/etc/apache2/sites-enabled/'
+
+def add_info(report, ui):
+    if os.path.isdir(SITES_ENABLED_DIR):
+        response = ui.yesno("The contents of your " + SITES_ENABLED_DIR + " directory "
+                            "may help developers diagnose your bug more "
+                            "quickly.  However, it may contain sensitive "
+                            "information.  Do you want to include it in your "
+                            "bug report?")
+
+        if response == None: # user cancelled
+            raise StopIteration
+
+        elif response == True:
+            # Attache config files in /etc/apache2/sites-enabled and listing of files in /etc/apache2/conf.d 
+            for conf_file in os.listdir(SITES_ENABLED_DIR):
+                attach_file_if_exists(report, SITES_ENABLED_DIR + conf_file, conf_file)
+
+    try:
+        report['Apache2ConfdDirListing'] = str(os.listdir('/etc/apache2/conf.d'))
+    except OSError:
+        report['Apache2ConfdDirListing'] = str(False)
+
+    # Attach default config files if changed.
+    attach_conffiles(report, 'apache2', conffiles=None)
+
+    # Attach the error.log file.
+    attach_file(report, '/var/log/apache2/error.log', key='error.log')
+
+    # Get loaded modules.
+    report['Apache2Modules'] = root_command_output(['/usr/sbin/apachectl', '-D DUMP_MODULES'])
diff --git a/debian/changelog b/debian/changelog
index dca7153..becfaa2 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,25 @@
+apache2 (2.4.25-4ubuntu1) artful; urgency=medium
+
+  * Merge with Debian unstable (LP: #1702582). Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - debian/patches/086_svn_cross_compiles: Backport several cross
+      fixes from upstream
+    - d/index.html, d/icons/ubuntu-logo.png, d/apache2.postrm: replace
+      Debian with Ubuntu on default page.
+      + d/source/include-binaries: add Ubuntu icon file
+    - Correct systemd-sysv-generator behavior by customizing some
+      parameters:
+      + d/apache2-systemd.conf: add a drop-in file to specify some
+        parameters for the systemd unit (type=Forking and
+        RemainsAfterExit=no), this allow a correct state synchronisation
+        between systemctl status and actual state of apache2 daemon.
+      + d/apache2.install: place the apache2-systemd.conf file in the
+        correct location.
+
+ -- Nishanth Aravamudan <[e-mail]>  Wed, 05 Jul 2017 16:39:47 -0700
+
 apache2 (2.4.25-4) unstable; urgency=high
 
   * Backport security fixes from 2.4.26:
@@ -9,6 +31,55 @@ apache2 (2.4.25-4) unstable; urgency=high
 
  -- Stefan Fritsch <[e-mail]>  Tue, 20 Jun 2017 21:31:51 +0200
 
+apache2 (2.4.25-3ubuntu3) artful; urgency=medium
+
+  * Re-Drop (LP: #1658469):
+    - Don't build experimental http2 module for LTS:
+     + debian/control: removed libnghttp2-dev Build-Depends (in universe).
+     + debian/config-dir/mods-available/http2.load: removed.
+     + debian/rules: removed proxy_http2 from configure.
+     + debian/apache2.maintscript: remove http2 conffile.
+
+ -- Nishanth Aravamudan <[e-mail]>  Mon, 01 May 2017 09:55:11 -0700
+
+apache2 (2.4.25-3ubuntu2) zesty; urgency=medium
+  * Undrop (LP 1658469):
+    - Don't build experimental http2 module for LTS:
+      + debian/control: removed libnghttp2-dev Build-Depends (in universe).
+      + debian/config-dir/mods-available/http2.load: removed.
+      + debian/rules: removed proxy_http2 from configure.
+      + debian/apache2.maintscript: remove http2 conffile.
+
+ -- Nishanth Aravamudan <[e-mail]>  Fri, 10 Feb 2017 08:53:43 -0800
+
+apache2 (2.4.25-3ubuntu1) zesty; urgency=medium
+
+  * Merge from Debian unstable (LP: #1663425). Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - debian/patches/086_svn_cross_compiles: Backport several cross
+      fixes from upstream
+    - d/index.html, d/icons/ubuntu-logo.png, d/apache2.postrm: replace
+      Debian with Ubuntu on default page.
+      + d/source/include-binaries: add Ubuntu icon file
+    - Correct systemd-sysv-generator behavior by customizing some
+      parameters:
+      + d/apache2-systemd.conf: add a drop-in file to specify some
+        parameters for the systemd unit (type=Forking and
+        RemainsAfterExit=no), this allow a correct state synchronisation
+        between systemctl status and actual state of apache2 daemon.
+      + d/apache2.install: place the apache2-systemd.conf file in the
+        correct location.
+   * Drop (LP: #1658469):
+     - Don't build experimental http2 module for LTS:
+      + debian/control: removed libnghttp2-dev Build-Depends (in universe).
+      + debian/config-dir/mods-available/http2.load: removed.
+      + debian/rules: removed proxy_http2 from configure.
+      + debian/apache2.maintscript: remove http2 conffile.
+
+ -- Nishanth Aravamudan <[e-mail]>  Thu, 09 Feb 2017 15:48:28 -0800
+
 apache2 (2.4.25-3) unstable; urgency=medium
 
   * Fix detection of systemd to fix 'apache2ctl start' on sysv-init.
@@ -70,6 +141,39 @@ apache2 (2.4.25-1) unstable; urgency=medium
 
  -- Stefan Fritsch <[e-mail]>  Wed, 21 Dec 2016 23:46:06 +0100
 
+apache2 (2.4.23-8ubuntu1) zesty; urgency=medium
+
+  * Merge from Debian unstable (LP: #). Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - debian/patches/086_svn_cross_compiles: Backport several cross
+      fixes from upstream
+    - d/index.html, d/icons/ubuntu-logo.png, d/apache2.postrm,
+      d/source/include-binaries: replace Debian with Ubuntu on default
+      page.
+      [ include-binaries change previously undocumented ]
+    - Don't build experimental http2 module for LTS:
+      + debian/control: removed libnghttp2-dev Build-Depends (in universe).
+      + debian/config-dir/mods-available/http2.load: removed.
+      + debian/rules: removed proxy_http2 from configure.
+      + debian/apache2.maintscript: remove http2 conffile.
+        [ Previously undocumented ]
+    - Correct systemd-sysv-generator behavior by customizing some
+      parameters:
+      + d/apache2-systemd.conf: add a drop-in file to specify some
+        parameters for the systemd unit (type=Forking and
+        RemainsAfterExit=no), this allow a correct state synchronisation
+        between systemctl status and actual state of apache2 daemon.
+      + d/apache2.install: place the apache2-systemd.conf file in the
+        correct location.
+  * Drop:
+    - debian/rules: Fix cross-building by passing
+      DEB_{HOST,BUILD}_GNU_TYPE to configure.
+    [ Incorrectly indicated as delta, fixed by Debian in 2.4.18-2 ]
+
+ -- Nishanth Aravamudan <[e-mail]>  Fri, 09 Dec 2016 11:02:38 +0100
+
 apache2 (2.4.23-8) unstable; urgency=medium
 
   * Move the mod_ssl_openssl.h header and the dependency on libssl-dev to a
@@ -80,6 +184,33 @@ apache2 (2.4.23-8) unstable; urgency=medium
 
  -- Stefan Fritsch <[e-mail]>  Sun, 20 Nov 2016 00:33:13 +0100
 
+apache2 (2.4.23-7ubuntu1) zesty; urgency=medium
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - debian/rules: Fix cross-building by passing
+      DEB_{HOST,BUILD}_GNU_TYPE to configure.
+    - debian/patches/086_svn_cross_compiles: Backport several cross
+      fixes from upstream
+    - d/index.html, d/icons/ubuntu-logo.png, d/apache2.postrm: replace
+      Debian with Ubuntu on default page.
+    - Don't build experimental http2 module for LTS:
+      + debian/control: removed libnghttp2-dev Build-Depends (in universe).
+      + debian/config-dir/mods-available/http2.load: removed.
+      + debian/rules: removed proxy_http2 from configure.
+    - Correct systemd-sysv-generator behavior by customizing some
+      parameters:
+      + d/apache2-systemd.conf: add a drop-in file to specify some
+        parameters for the systemd unit (type=Forking and
+        RemainsAfterExit=no), this allow a correct state synchronisation
+        between systemctl status and actual state of apache2 daemon.
+      + d/apache2.install: place the apache2-systemd.conf file in the
+        correct location.
+
+ -- Marc Deslauriers <[e-mail]>  Wed, 16 Nov 2016 09:17:24 -0500
+
 apache2 (2.4.23-7) unstable; urgency=medium
 
   * Make apache2-dev depend on openssl 1.0, too. Closes: #844160
@@ -194,6 +325,55 @@ apache2 (2.4.20-1) unstable; urgency=medium
 
  -- Stefan Fritsch <[e-mail]>  Sun, 10 Apr 2016 14:03:41 +0200
 
+apache2 (2.4.18-2ubuntu4) yakkety; urgency=medium
+
+  * SECURITY UPDATE: proxy request header vulnerability (httpoxy)
+    - debian/patches/CVE-2016-5387.patch: don't pass through HTTP_PROXY in
+      server/util_script.c.
+    - CVE-2016-5387
+
+ -- Marc Deslauriers <[e-mail]>  Mon, 18 Jul 2016 14:32:02 -0400
+
+apache2 (2.4.18-2ubuntu3) xenial; urgency=medium
+
+  [ Ryan Harper ]
+  * Drop /etc/apache2/mods-available/http2.load. This was inadvertently
+    introduced in 2.4.18-2ubuntu1. The intention is to not carry this at
+    all, since http2 support is intentionally disabled (see LP 1531864).
+  * d/apache2.maintscript: handle removal of http2.load conffile.
+
+  [ Robie Basak ]
+  * Re-write Ryan's changelog entry.
+
+ -- Robie Basak <[e-mail]>  Fri, 15 Apr 2016 18:00:57 +0000
+
+apache2 (2.4.18-2ubuntu2) xenial; urgency=medium
+
+  * Correct systemd-sysv-generator behavior by customizing some parameters (LP: #1488962)
+    - d/apache2-systemd.conf: add a drop-in file to specify some parameters for the systemd
+      unit (type=Forking and RemainsAfterExit=no), this allow a correct state synchronisation
+      between systemctl status and actual state of apache2 daemon.
+    - d/apache2.install: place the apache2-systemd.conf file in the correct location.
+
+ -- Pierre-André MOREY <[e-mail]>  Fri, 08 Apr 2016 11:48:00 +0200
+
+apache2 (2.4.18-2ubuntu1) xenial; urgency=medium
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - debian/rules: Fix cross-building by passing
+      DEB_{HOST,BUILD}_GNU_TYPE to configure.
+    - debian/patches/086_svn_cross_compiles: Backport several cross
+      fixes from upstream
+    - d/index.html: replace Debian with Ubuntu on default page.
+    - Don't build experimental http2 module for LTS:
+      + debian/control: removed libnghttp2-dev Build-Depends (in universe).
+      + debian/config-dir/mods-available/http2.load: removed.
+
+ -- Timo Aaltonen <[e-mail]>  Wed, 06 Apr 2016 00:18:31 +0300
+
 apache2 (2.4.18-2) unstable; urgency=low
 
   * htcacheclean:
@@ -219,6 +399,24 @@ apache2 (2.4.18-2) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Mon, 28 Mar 2016 21:58:54 +0200
 
+apache2 (2.4.18-1ubuntu1) xenial; urgency=medium
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - Add dep8 tests.
+    - debian/rules: Fix cross-building by passing
+      DEB_{HOST,BUILD}_GNU_TYPE to configure.
+    - debian/patches/086_svn_cross_compiles: Backport several cross
+      fixes from upstream
+    - d/index.html: replace Debian with Ubuntu on default page.
+    - Don't build experimental http2 module for LTS:
+      + debian/control: removed libnghttp2-dev Build-Depends (in universe).
+      + debian/config-dir/mods-available/http2.load: removed.
+
+ -- Marc Deslauriers <[e-mail]>  Thu, 21 Jan 2016 15:15:22 -0500
+
 apache2 (2.4.18-1) unstable; urgency=medium
 
   * New upstream release:
@@ -226,12 +424,48 @@ apache2 (2.4.18-1) unstable; urgency=medium
 
  -- Stefan Fritsch <[e-mail]>  Sat, 19 Dec 2015 09:26:14 +0100
 
+apache2 (2.4.17-3ubuntu1) xenial; urgency=medium
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - Add dep8 tests.
+    - debian/rules: Fix cross-building by passing
+      DEB_{HOST,BUILD}_GNU_TYPE to configure.
+    - debian/patches/086_svn_cross_compiles: Backport several cross
+      fixes from upstream
+    - d/index.html: replace Debian with Ubuntu on default page.
+    - Don't build experimental http2 module for LTS:
+      + debian/control: removed libnghttp2-dev Build-Depends (in universe).
+      + debian/config-dir/mods-available/http2.load: removed.
+
+ -- Marc Deslauriers <[e-mail]>  Thu, 03 Dec 2015 10:07:35 -0500
+
 apache2 (2.4.17-3) unstable; urgency=medium
 
   * mpm_prefork: Fix segfault if started with -X. Closes: #805737
 
  -- Stefan Fritsch <[e-mail]>  Mon, 23 Nov 2015 19:52:09 +0100
 
+apache2 (2.4.17-2ubuntu1) xenial; urgency=medium
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - Add dep8 tests.
+    - debian/rules: Fix cross-building by passing
+      DEB_{HOST,BUILD}_GNU_TYPE to configure.
+    - debian/patches/086_svn_cross_compiles: Backport several cross
+      fixes from upstream
+    - d/index.html: replace Debian with Ubuntu on default page.
+    - Don't build experimental http2 module for LTS:
+      + debian/control: removed libnghttp2-dev Build-Depends (in universe).
+      + debian/config-dir/mods-available/http2.load: removed.
+
+ -- Marc Deslauriers <[e-mail]>  Fri, 20 Nov 2015 09:11:52 -0500
+
 apache2 (2.4.17-2) unstable; urgency=medium
 
   * Revert REDIRECT_URL to pre-2.4.17 behavior for now. The change broke
@@ -242,6 +476,31 @@ apache2 (2.4.17-2) unstable; urgency=medium
 
  -- Stefan Fritsch <[e-mail]>  Sat, 31 Oct 2015 23:17:11 +0100
 
+apache2 (2.4.17-1ubuntu1) xenial; urgency=medium
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - Add dep8 tests.
+    - debian/rules: Fix cross-building by passing
+      DEB_{HOST,BUILD}_GNU_TYPE to configure.
+    - debian/patches/086_svn_cross_compiles: Backport several cross
+      fixes from upstream
+    - d/index.html: replace Debian with Ubuntu on default page.
+  * Drop patches (applied upstream):
+    - debian/patches/CVE-2015-3183.patch
+    - debian/patches/CVE-2015-3185.patch
+  * Drop changes (adopted in Debian):
+    - Allow "triggers-awaited" and "triggers-pending" states in addition
+      to "installed" when determining whether to defer actions or
+      process deferred actions.
+  * Don't build experimental http2 module for LTS
+    - debian/control: removed libnghttp2-dev Build-Depends (in universe).
+    - debian/config-dir/mods-available/http2.load: removed.
+
+ -- Marc Deslauriers <[e-mail]>  Fri, 30 Oct 2015 09:35:46 -0400
+
 apache2 (2.4.17-1) unstable; urgency=medium
 
   [ Stefan Fritsch ]
@@ -307,6 +566,49 @@ apache2 (2.4.16-1) unstable; urgency=medium
 
  -- Stefan Fritsch <[e-mail]>  Sun, 02 Aug 2015 00:44:07 +0200
 
+apache2 (2.4.12-2ubuntu2) wily; urgency=medium
+
+  * SECURITY UPDATE: request smuggling via chunked transfer encoding
+    - debian/patches/CVE-2015-3183.patch: refactor chunk parsing in
+      modules/http/http_filters.c.
+    - CVE-2015-3183
+  * SECURITY UPDATE: access restriction bypass via deprecated API
+    - debian/patches/CVE-2015-3185.patch: deprecate old API and add new one
+      in include/http_request.h, server/request.c.
+    - CVE-2015-3185
+
+ -- Marc Deslauriers <[e-mail]>  Fri, 24 Jul 2015 09:56:09 -0400
+
+apache2 (2.4.12-2ubuntu1) wily; urgency=medium
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - Add dep8 tests.
+    - debian/rules: Fix cross-building by passing
+      DEB_{HOST,BUILD}_GNU_TYPE to configure.
+    - debian/patches/086_svn_cross_compiles: Backport several cross
+      fixes from upstream
+    - d/index.html: replace Debian with Ubuntu on default page.
+    - Allow "triggers-awaited" and "triggers-pending" states in addition
+      to "installed" when determining whether to defer actions or
+      process deferred actions.
+  * Drop patches (applied upstream):
+    - d/p/split-logfile.patch
+    - d/p/CVE-2015-0228.patch
+  * Drop changes (superceded in Debian):
+    - Cherry-pick versioned build-depend on dpkg from Debian for correct
+      dpkg-maintscript-helper symlink_to_dir support.
+  * Drop changes (adopted in Debian):
+    - d/control, d/config-dir/mods-available/ssl.conf,
+      d/ask-for-passphrase, d/apache2.install: Plymouth aware passphrase
+      dialog program ask-for-passphrase.
+  * Fix cross-building configure line in d/rules, which had bit-rotted in
+    previous merges.
+
+ -- Robie Basak <[e-mail]>  Thu, 28 May 2015 16:34:00 +0000
+
 apache2 (2.4.12-2) unstable; urgency=medium
 
   [ Jean-Michel Nirgal Vourgère ]
@@ -356,6 +658,28 @@ apache2 (2.4.10-10) unstable; urgency=medium
 
  -- Stefan Fritsch <[e-mail]>  Sun, 15 Mar 2015 10:47:36 +0100
 
+apache2 (2.4.10-9ubuntu1) vivid; urgency=medium
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - d/control, d/config-dir/mods-available/ssl.conf,
+    - Add dep8 tests.
+    - debian/rules: Fix cross-building by passing
+      DEB_{HOST,BUILD}_GNU_TYPE to configure.
+    - debian/patches/086_svn_cross_compiles: Backport several cross
+      fixes from upstream
+    - d/index.html: replace Debian with Ubuntu on default page.
+    - d/p/split-logfile.patch: fix completely broken split-logfile
+      command.
+    - d/p/CVE-2015-0228.patch: fix logic in modules/lua/lua_request.c to fix a
+      denial of service in mod_lua via websockets PING
+  * debian/tests/ssl-passphrase: Add password responder for
+    systemd-ask-passphrase.
+
+ -- Martin Pitt <[e-mail]>  Mon, 09 Mar 2015 12:03:16 +0100
+
 apache2 (2.4.10-9) unstable; urgency=medium
 
   * CVE-2014-8109: mod_lua: Fix handling of the Require line when a
@@ -370,6 +694,54 @@ apache2 (2.4.10-9) unstable; urgency=medium
 
  -- Stefan Fritsch <[e-mail]>  Mon, 22 Dec 2014 20:24:36 +0100
 
+apache2 (2.4.10-8ubuntu3) vivid; urgency=medium
+
+  * SECURITY UPDATE: restriction bypass in mod_lua via multiple Require
+    directives
+    - debian/patches/CVE-2014-8109.patch: handle multiple Require
+      directives with different arguments in modules/lua/mod_lua.c.
+    - CVE-2014-8109
+  * SECURITY UPDATE: denial of service in mod_lua via websockets PING
+    - debian/patches/CVE-2015-0228.patch: fix logic in
+      modules/lua/lua_request.c.
+    - CVE-2015-0228
+
+ -- Marc Deslauriers <[e-mail]>  Thu, 05 Mar 2015 10:56:34 -0500
+
+apache2 (2.4.10-8ubuntu2) vivid; urgency=medium
+
+  * Allow "triggers-awaited" and "triggers-pending" states in addition to
+    "installed" when determining whether to defer actions or process
+    deferred actions (LP: #1393832).
+
+ -- Colin Watson <[e-mail]>  Wed, 26 Nov 2014 11:31:44 +0000
+
+apache2 (2.4.10-8ubuntu1) vivid; urgency=medium
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - d/control, d/config-dir/mods-available/ssl.conf,
+      d/ask-for-passphrase, d/apache2.install: Plymouth aware passphrase
+      dialog program ask-for-passphrase.
+    - Add dep8 tests.
+    - debian/rules: Fix cross-building by passing
+      DEB_{HOST,BUILD}_GNU_TYPE to configure.
+    - debian/patches/086_svn_cross_compiles: Backport several cross
+      fixes from upstream
+    - d/index.html: replace Debian with Ubuntu on default page.
+    - d/p/split-logfile.patch: fix completely broken split-logfile
+      command.
+  * Fixes from Debian included in merge:
+    - Crash caused by OCSP stapling code; this was erroneously
+      attributed to Debian in my previous merge, but actually only
+      appears in 2.4.10-8; with thanks to Stefan Fritsch (LP: #1366174).
+  * Cherry-pick versioned build-depend on dpkg from Debian for correct
+    dpkg-maintscript-helper symlink_to_dir support.
+
+ -- Robie Basak <[e-mail]>  Fri, 21 Nov 2014 15:15:58 +0000
+
 apache2 (2.4.10-8) unstable; urgency=medium
 
   * Bump dpkg Pre-Depends to version that supports relative symlinks in
@@ -384,6 +756,33 @@ apache2 (2.4.10-8) unstable; urgency=medium
 
  -- Stefan Fritsch <[e-mail]>  Tue, 18 Nov 2014 15:18:18 +0100
 
+apache2 (2.4.10-7ubuntu1) vivid; urgency=medium
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - d/control, d/config-dir/mods-available/ssl.conf,
+      d/ask-for-passphrase, d/apache2.install: Plymouth aware passphrase
+      dialog program ask-for-passphrase.
+    - Add dep8 tests.
+    - debian/rules: Fix cross-building by passing
+      DEB_{HOST,BUILD}_GNU_TYPE to configure.
+    - debian/patches/086_svn_cross_compiles: Backport several cross
+      fixes from upstream
+    - d/index.html: replace Debian with Ubuntu on default page.
+    - d/p/split-logfile.patch: fix completely broken split-logfile command.
+  * Fixes from Debian included in merge:
+    - Don't use a2query in preinst, as it may not be available yet
+      (LP: #1312533).
+    - Crash caused by OCSP stapling code (LP: #1366174).
+    - Disable SSLv3 in default config (LP: #1358305).
+    - If apache2 is not configured yet, defer actions executed via
+      apache2-maintscript-helper. This fixes installation failures if a
+      module package is configured first (LP: #1312854).
+
+ -- Robie Basak <[e-mail]>  Mon, 17 Nov 2014 18:04:40 +0000
+
 apache2 (2.4.10-7) unstable; urgency=medium
 
   * Handle transitions of doc dirs and symlinks correctly during upgrade.
@@ -467,6 +866,25 @@ apache2 (2.4.10-2) unstable; urgency=medium
 
  -- Stefan Fritsch <[e-mail]>  Sun, 21 Sep 2014 22:58:33 +0200
 
+apache2 (2.4.10-1ubuntu1) utopic; urgency=medium
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - d/control, d/config-dir/mods-available/ssl.conf, d/ask-for-passphrase,
+      d/apache2.install: Plymouth aware passphrase dialog program
+      ask-for-passphrase.
+    - Add dep8 tests.
+    - debian/rules: Fix cross-building by passing DEB_{HOST,BUILD}_GNU_TYPE to
+      configure.
+    - debian/patches/086_svn_cross_compiles: Backport several cross fixes from
+      upstream
+    - d/index.html: replace Debian with Ubuntu on default page.
+    - d/p/split-logfile.patch: fix completely broken split-logfile command.
+
+ -- Robie Basak <[e-mail]>  Thu, 24 Jul 2014 15:13:16 +0000
+
 apache2 (2.4.10-1) unstable; urgency=medium
 
   [ Arno Töll ]
@@ -514,6 +932,45 @@ apache2 (2.4.9-2) unstable; urgency=medium
 
  -- Stefan Fritsch <[e-mail]>  Sun, 08 Jun 2014 10:38:04 +0200
 
+apache2 (2.4.9-1ubuntu2) utopic; urgency=medium
+
+  * Revert 2.4.4-6ubuntu3 and build against lua 5.1 again, since Apache doesn't
+    yet support building against lua 5.2 (LP: #1323930).
+
+ -- Robie Basak <[e-mail]>  Wed, 28 May 2014 08:55:25 +0000
+
+apache2 (2.4.9-1ubuntu1) utopic; urgency=medium
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - d/control, d/config-dir/mods-available/ssl.conf, d/ask-for-passphrase,
+      d/apache2.install, d/tests/ssl-passphrase: Plymouth aware passphrase
+      dialog program ask-for-passphrase.
+    - debian/rules: Fix cross-building by passing DEB_{HOST,BUILD}_GNU_TYPE to
+      configure.
+    - debian/patches/086_svn_cross_compiles: Backport several cross fixes from
+      upstream
+    - Build using lua5.2.
+    - d/tests/chroot: dep8 test for ChrootDir case.
+    - d/tests/ssl-passphrase: update for new default path /var/www/html.
+    - d/tests/duplicate-module-load: check for duplicate module loads.
+    - d/index.html: replace Debian with Ubuntu on default page (LP: #1288690).
+    - d/p/split-logfile.patch: fix completely broken split-logfile command
+      (LP: #1299162). Thanks to Holger Mauermann.
+  * Drop changes (upstreamed):
+    - d/p/ignore-quilt-dir: adjust build system so that it does not use
+      files find inside the .pc directory. This stops a double module load
+      causing later havoc, including "ChrootDir" directive failure.
+    - debian/patches/CVE-2013-6438.patch: properly calculate correct length
+      in modules/dav/main/util.c.
+    - debian/patches/CVE-2014-0098.patch: properly parse tokens in
+      modules/loggers/mod_log_config.c.
+  * d/tests/control: adjust dep8 tests for new "breaks-testbed" facility.
+
+ -- Robie Basak <[e-mail]>  Fri, 09 May 2014 19:30:04 +0000
+
 apache2 (2.4.9-1) unstable; urgency=medium
 
   * New upstream version.
@@ -546,6 +1003,63 @@ apache2 (2.4.9-1) unstable; urgency=medium
 
  -- Stefan Fritsch <[e-mail]>  Sat, 29 Mar 2014 22:50:32 +0100
 
+apache2 (2.4.7-1ubuntu4) trusty; urgency=medium
+
+  * d/p/split-logfile.patch: fix completely broken split-logfile command
+    (LP: #1299162). Thanks to Holger Mauermann.
+
+ -- Robie Basak <[e-mail]>  Thu, 03 Apr 2014 11:21:22 +0000
+
+apache2 (2.4.7-1ubuntu3) trusty; urgency=medium
+
+  * SECURITY UPDATE: denial of service via mod_dav incorrect end of string
+    calculation
+    - debian/patches/CVE-2013-6438.patch: properly calculate correct length
+      in modules/dav/main/util.c.
+    - CVE-2013-6438
+  * SECURITY UPDATE: denial of service via truncated cookie and
+    mod_log_config
+    - debian/patches/CVE-2014-0098.patch: properly parse tokens in
+      modules/loggers/mod_log_config.c.
+    - CVE-2014-0098
+
+ -- Marc Deslauriers <[e-mail]>  Thu, 20 Mar 2014 08:34:10 -0400
+
+apache2 (2.4.7-1ubuntu2) trusty; urgency=medium
+
+  * d/index.html: replace Debian with Ubuntu on default page
+    (LP: #1288690).
+
+ -- Robie Basak <[e-mail]>  Wed, 19 Mar 2014 11:04:21 +0000
+
+apache2 (2.4.7-1ubuntu1) trusty; urgency=medium
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - d/control, d/config-dir/mods-available/ssl.conf,
+      d/ask-for-passphrase, d/apache2.install, d/tests/ssl-passphrase:
+      Plymouth aware passphrase dialog program ask-for-passphrase.
+    - debian/rules: Fix cross-building by passing DEB_{HOST,BUILD}_GNU_TYPE
+      to configure.
+    - debian/patches/086_svn_cross_compiles: Backport several cross fixes
+      from upstream
+    - Build using lua5.2.
+    - d/tests/chroot: dep8 test for ChrootDir case.
+    - d/p/ignore-quilt-dir: adjust build system so that it does not use
+      files find inside the .pc directory. This stops a double module load
+      causing later havoc, including "ChrootDir" directive failure.
+  * Drop changes:
+    - debian/{control, rules}: Enable PIE hardening: no longer required;
+      2.4.7-1 is already hardened.
+    - d/p/itk-rerun-configure.patch: no longer needed, as ITK support has moved
+      out of this package.
+  * d/tests/ssl-passphrase: update for new default path /var/www/html.
+  * d/tests/duplicate-module-load: check for duplicate module loads.
+
+ -- Robie Basak <[e-mail]>  Tue, 14 Jan 2014 17:23:47 +0000
+
 apache2 (2.4.7-1) unstable; urgency=low
 
   New upstream version
@@ -609,6 +1123,53 @@ apache2 (2.4.6-3) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Mon, 12 Aug 2013 20:15:38 +0200
 
+apache2 (2.4.6-2ubuntu4) trusty; urgency=low
+
+  * d/p/ignore-quilt-dir, d/p/itk-rerun-configure.patch: adjust build system so
+    that it does not use files find inside the .pc directory. This stops a
+    double module load causing later havoc, including "ChrootDir" directive
+    failure (LP: #1251939). Thanks to Stefan Fritsch.
+  * d/tests/chroot: dep8 test for ChrootDir case.
+
+ -- Robie Basak <[e-mail]>  Thu, 28 Nov 2013 16:21:51 +0000
+
+apache2 (2.4.6-2ubuntu3) trusty; urgency=low
+
+  * debian/apache2.install: Correct path for ufw.
+    (LP: #1252722) 
+
+ -- Chuck Short <[e-mail]>  Tue, 19 Nov 2013 08:59:54 -0500
+
+apache2 (2.4.6-2ubuntu2) saucy; urgency=low
+
+  * d/ask-for-passphrase: mark executable so that apache2 can run it. Fixes
+    passphrase prompting for SSL certificates that are passphrase protected.
+  * Add dep8 test for SSL passphrase prompting.
+
+ -- Robie Basak <[e-mail]>  Fri, 09 Aug 2013 13:08:52 +0000
+
+apache2 (2.4.6-2ubuntu1) saucy; urgency=low
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/{control, rules}: Enable PIE hardening.
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - debian/control, debian/config-dir/mods-available/ssl.conf,
+      debian/ask-for-passphrase, debian/apache2.install: Plymouth aware
+      passphrase dialog program ask-for-passphrase.
+    - debian/rules: Fix cross-building by passing DEB_{HOST,BUILD}_GNU_TYPE
+      to configure.
+    - debian/patches/086_svn_cross_compiles: Backport several cross fixes
+      from upstream
+  * Dropped changes:
+    - debian/patches/CVE-2013-1896.patch: upstream
+  * Fixed module dependencies (LP: #1205314)
+    - debian/config-dir/mods-available/lbmethod_*: properly specify
+      proxy_balancer, not mod_proxy_balancer.
+
+ -- Marc Deslauriers <[e-mail]>  Fri, 26 Jul 2013 08:31:33 -0400
+
 apache2 (2.4.6-2) unstable; urgency=low
 
   [ Stefan Fritsch ]
@@ -661,6 +1222,56 @@ apache2 (2.4.6-1) unstable; urgency=low
 
  -- Arno Töll <[e-mail]>  Sun, 21 Jul 2013 18:44:42 +0200
 
+apache2 (2.4.4-6ubuntu5) saucy; urgency=low
+
+  * SECURITY UPDATE: denial of service via MERGE request
+    - debian/patches/CVE-2013-1896.patch: make sure DAV is enabled for URI
+      in modules/dav/main/mod_dav.c.
+    - CVE-2013-1896
+
+ -- Marc Deslauriers <[e-mail]>  Thu, 18 Jul 2013 11:20:47 -0400
+
+apache2 (2.4.4-6ubuntu4) saucy; urgency=low
+
+  * d/apache2-{utils,bin}.install: move apport hook from apache2-utils to
+    apache2-bin. apache2-utils is only suggested by apache2, so may not
+    always be installed by bug reporters. However, apache2-bin will always
+    need to be installed for Apache to be functional, so this is a better
+    place for the apport hook. apache2-bin already Conflicts/Replaces
+    apache2.2-common, so this also fixes (LP: #1199318).
+  * d/apache2.py: adjust apport hook for new location of configuration
+    files in apache2 >= 2.4: they have moved from apache2.2-common to
+    apache2.
+
+ -- Robie Basak <[e-mail]>  Wed, 17 Jul 2013 17:54:22 +0000
+
+apache2 (2.4.4-6ubuntu3) saucy; urgency=low
+
+  * Build using lua5.2.
+
+ -- Matthias Klose <[e-mail]>  Wed, 17 Jul 2013 14:24:42 +0200
+
+apache2 (2.4.4-6ubuntu2) saucy; urgency=low
+
+  * debian/rules: Fix FTBFS while installing ufw. 
+
+ -- Chuck Short <[e-mail]>  Tue, 02 Jul 2013 10:10:14 -0500
+
+apache2 (2.4.4-6ubuntu1) saucy; urgency=low
+
+  * Merge from Debian unstable.  Remaining changes:
+    - debian/{control, rules}: Enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2.2-common.install: Add apport hook.
+    - debian/control, debian/ask-for-passphrase, debian/config-dir/mods-available/ssl.conf:
+      Plymouth aware passphrase dialog program ask-for-passphrase.
+  * Dropped changes:
+    - debian/patches/CVE-2012-2687.patch: Dropped no longer needed.
+    - debian/patches/CVE-2012-3499_4558.patch: Dropped no longer needed.
+    - debian/patches/CVE-2012-4929.patch: Dropped no longer needed.
+
+ -- Chuck Short <[e-mail]>  Tue, 02 Jul 2013 08:34:01 -0500
+
 apache2 (2.4.4-6) unstable; urgency=low
 
   * Denote exact versions breaking gnome-user-share now that Gnome maintainers
@@ -1132,6 +1743,122 @@ apache2 (2.4.1-1) experimental; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Mon, 19 Mar 2012 10:46:02 +0100
 
+apache2 (2.2.22-6ubuntu5) raring; urgency=low
+
+  * SECURITY UPDATE: multiple cross-site scripting issues
+    - debian/patches/CVE-2012-3499_4558.patch: properly escape html in
+      modules/generators/{mod_info.c,mod_status.c},
+      modules/ldap/util_ldap_cache_mgr.c, modules/mappers/mod_imagemap.c,
+      modules/proxy/{mod_proxy_balancer.c,mod_proxy_ftp.c}.
+    - CVE-2012-3499
+    - CVE-2012-4558
+  * SECURITY UPDATE: symlink attack in apache2ctl script
+    - debian/apache2ctl: introduce and use a safer mkdir_chown() function.
+    - Thanks to Stefan Fritsch for the fix.
+    - CVE-2013-1048
+
+ -- Marc Deslauriers <[e-mail]>  Fri, 15 Mar 2013 07:59:58 -0400
+
+apache2 (2.2.22-6ubuntu4) raring; urgency=low
+
+  * Fix cross-building by passing DEB_{HOST,BUILD}_GNU_TYPE to configure.
+  * Skip module sanity check between MPMs if cross-building without the
+    kernel/binfmt support to run our target binaries on the build system.
+  * Backport several cross fixes from upstream as 086_svn_cross_compiles.
+
+ -- Adam Conrad <[e-mail]>  Wed, 05 Dec 2012 02:21:46 -0700
+
+apache2 (2.2.22-6ubuntu3) raring; urgency=low
+
+  * SECURITY UPDATE: XSS vulnerability in mod_negotiation
+    - debian/patches/CVE-2012-2687.patch: escape filenames in
+      modules/mappers/mod_negotiation.c.
+    - CVE-2012-2687
+  * SECURITY UPDATE: CRIME attack ssl attack (LP: #1068854)
+    - debian/patches/CVE-2012-4929.patch: backport SSLCompression on|off
+      directive. Defaults to off as enabling compression enables the CRIME
+      attack.
+    - CVE-2012-4929
+
+ -- Marc Deslauriers <[e-mail]>  Thu, 08 Nov 2012 17:56:24 -0500
+
+apache2 (2.2.22-6ubuntu2) quantal; urgency=low
+
+  * debian/apache2.py
+   - Update apport hook for python3 ; thanks to Edward Donovan (LP: #1013171)
+   - Check if this directory exists: /etc/apache2/sites-enabled/
+
+ -- Matthieu Baerts (matttbe) <[e-mail]>  Mon, 16 Jul 2012 10:02:18 +0200
+
+apache2 (2.2.22-6ubuntu1) quantal; urgency=low
+
+  * Merge from Debian unstable.  Remaining changes:
+    - debian/{control, rules}: Enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2.2-common.install: Add apport hook.
+    - debian/control, debian/ask-for-passphrase, debian/config-dir/mods-available/ssl.conf:
+      Plymouth aware passphrase dialog program ask-for-passphrase.
+  * Dropped changes:
+    - debian/control: Add bzr tag and point it to our tree; this is not 
+      really required and just increases the delta.
+
+ -- Robie Basak <[e-mail]>  Fri, 08 Jun 2012 11:37:31 +0100
+
+apache2 (2.2.22-6) unstable; urgency=low
+
+  [ Stefan Fritsch ]
+  * Fix regression causing apache2 to cache "206 partial content" responses,
+    and then serving these partial responses when replying to normal requests.
+    Closes: #671204
+  * Add section to security.conf that shows how to forbid access to VCS
+    directories. Closes: #548213
+  * Update ssl default cipher config, add alternative speed optimized config.
+    Closes: #649020
+  * Add "AddCharset" for .brf files in default mod_mime config.
+    Closes: #402567
+  * Don't create httpd.conf anymore and don't include it in apache2.conf. If
+    it contains local modifications, move it to /etc/apache2/conf.d/httpd.conf
+  * Port some of the comments in apache2.conf from the 2.4 package.
+  * Compile mod_version statically, drop associated module load file.
+  * If apache2 is not running, make "/etc/init.d/apache2 reload" skip the
+    configtest.
+  * Note in README.Debian that future versions of the package will have the
+    include statements changed to include only *.conf.
+  * Change compiled-in document root to /var/www, to avoid strange error
+    messages.
+  * Use "dh --with autotools_dev" instead of patching config.sub/config.guess.
+
+  [ Arno Töll ]
+  * Fix apxs to import LDFLAGS from config_vars.mk. Moreover, make it possible
+    to override LDFLAGS at compile time by defining LDLAGS in the environment,
+    just like it is possible for CFLAGS. This also means, config_vars.mk now
+    exports hardening build flags by default.
+  * Update doc-base metadata for the apache2-doc package.
+
+ -- Stefan Fritsch <[e-mail]>  Tue, 29 May 2012 22:05:48 +0200
+
+apache2 (2.2.22-5) unstable; urgency=low
+
+  * Make LoadFile and LoadModule look in the standard search paths if the
+    dso file name is given as a pure filename. This helps with the multi-arch
+    transition.
+
+ -- Stefan Fritsch <[e-mail]>  Mon, 30 Apr 2012 23:38:33 +0200
+
+apache2 (2.2.22-4) unstable; urgency=high
+
+  * CVE-2012-0216: Remove "Alias /doc /usr/share/doc" from the default virtual
+    hosts' config files.
+    If scripting modules like mod_php or mod_rivet are enabled on systems
+    where either 1) some frontend server forwards connections to an apache2
+    backend server on the localhost address, or 2) the machine running
+    apache2 is also used for web browsing, this could allow a remote
+    attacker to execute example scripts stored under /usr/share/doc.
+    Depending on the installed packages, this could lead to issues like cross
+    site scripting, code execution, or leakage of sensitive data.
+
+ -- Stefan Fritsch <[e-mail]>  Sun, 15 Apr 2012 23:41:43 +0200
+
 apache2 (2.2.22-3) unstable; urgency=low
 
   * Fix "FTBFS: mkdir: cannot create directory `debian/build-tree/arch':
@@ -1152,6 +1879,18 @@ apache2 (2.2.22-2) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Thu, 15 Mar 2012 00:02:31 +0100
 
+apache2 (2.2.22-1ubuntu1) precise; urgency=low
+
+  * Merge from Debian testing.  Remaining changes:
+    - debian/{control, rules}: Enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: Add ufw profiles.
+    - debian/control: Add bzr tag and point it to our tree
+    - debian/apache2.py, debian/apache2.2-common.install: Add apport hook.
+    - debian/control, debian/ask-for-passphrase, debian/config-dir/mods-available/ssl.conf:
+      Plymouth aware passphrase dialog program ask-for-passphrase.
+
+ -- Chuck Short <[e-mail]>  Sun, 12 Feb 2012 20:06:35 -0500
+
 apache2 (2.2.22-1) unstable; urgency=low
 
    [ Stefan Fritsch ]
@@ -1169,6 +1908,18 @@ apache2 (2.2.22-1) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Wed, 01 Feb 2012 21:49:04 +0100 
 
+apache2 (2.2.21-5ubuntu1) precise; urgency=low
+
+  * Merge from Debian testing.  Remaining changes:
+    - debian/{control, rules}: Enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: Add ufw profiles.
+    - debian/control: Add bzr tag and point it to our tree
+    - debian/apache2.py, debian/apache2.2-common.install: Add apport hook.
+    - debian/control, debian/ask-for-passphrase, debian/config-dir/mods-available/ssl.conf:
+      Plymouth aware passphrase dialog program ask-for-passphrase.
+
+ -- Chuck Short <[e-mail]>  Mon, 09 Jan 2012 06:26:31 +0000
+
 apache2 (2.2.21-5) unstable; urgency=low
 
   [ Arno Töll ]
@@ -1222,6 +1973,26 @@ apache2 (2.2.21-4) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Thu, 29 Dec 2011 12:09:14 +0100
 
+apache2 (2.2.21-3ubuntu2) precise; urgency=low
+
+  * d/ask-for-passphrase: Flip the logic of this script so that it checks
+    first to see if apache is being started from a TTY, and then if not,
+    tries plymouth. (LP: #887410)
+
+ -- Clint Byrum <[e-mail]>  Tue, 06 Dec 2011 16:49:33 -0800
+
+apache2 (2.2.21-3ubuntu1) precise; urgency=low
+
+  * Merge from Debian testing.  Remaining changes:
+    - debian/{control, rules}: Enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: Add ufw profiles.
+    - debian/control: Add bzr tag and point it to our tree
+    - debian/apache2.py, debian/apache2.2-common.install: Add apport hook.
+    - debian/control, debian/ask-for-passphrase, debian/config-dir/mods-available/ssl.conf:
+      Plymouth aware passphrase dialog program ask-for-passphrase.
+
+ -- Chuck Short <[e-mail]>  Fri, 09 Dec 2011 05:20:43 +0000
+
 apache2 (2.2.21-3) unstable; urgency=medium
 
   * Fix CVE-2011-4317: Prevent unintended pattern expansion in some
@@ -1236,6 +2007,24 @@ apache2 (2.2.21-3) unstable; urgency=medium
 
  -- Stefan Fritsch <[e-mail]>  Sat, 03 Dec 2011 18:54:03 +0100
 
+apache2 (2.2.21-2ubuntu2) precise; urgency=low
+
+  * No-change rebuild to drop spurious libsfgcc1 dependency on armhf.
+
+ -- Adam Conrad <[e-mail]>  Fri, 02 Dec 2011 17:36:28 -0700
+
+apache2 (2.2.21-2ubuntu1) precise; urgency=low
+
+  * Merge from debian unstable.  Remaining changes:
+    - debian/{control, rules}: Enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: Add ufw profiles.
+    - debian/control: Add bzr tag and point it to our tree
+    - debian/apache2.py, debian/apache2.2-common.install: Add apport hook.
+    - debian/control, debian/ask-for-passphrase, debian/config-dir/mods-available/ssl.conf:
+      Plymouth aware passphrase dialog program ask-for-passphrase.
+
+ -- Chuck Short <[e-mail]>  Fri, 14 Oct 2011 16:01:29 +0000
+
 apache2 (2.2.21-2) unstable; urgency=high
 
   * Fix CVE-2011-3368: Prevent unintended pattern expansion in some
@@ -1253,6 +2042,19 @@ apache2 (2.2.21-1) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Mon, 26 Sep 2011 18:16:11 +0200
 
+apache2 (2.2.20-1ubuntu1) oneiric; urgency=low
+
+  * Merge from debian unstable to fix CVE-2011-3192 (LP: #837991).
+    Remaining changes:
+    - debian/{control, rules}: Enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: Add ufw profiles.
+    - debian/control: Add bzr tag and point it to our tree
+    - debian/apache2.py, debian/apache2.2-common.install: Add apport hook.
+    - debian/control, debian/ask-for-passphrase, debian/config-dir/mods-available/ssl.conf:
+      Plymouth aware passphrase dialog program ask-for-passphrase.
+
+ -- Steve Beattie <[e-mail]>  Tue, 06 Sep 2011 01:17:15 -0700
+
 apache2 (2.2.20-1) unstable; urgency=low
 
   * New upstream release.
@@ -1275,6 +2077,18 @@ apache2 (2.2.19-2) unstable; urgency=high
 
  -- Stefan Fritsch <[e-mail]>  Mon, 29 Aug 2011 17:08:17 +0200
 
+apache2 (2.2.19-1ubuntu1) oneiric; urgency=low
+
+  * Merge from debian unstable (LP: #787013). Remaining changes:
+    - debian/{control, rules}: Enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: Add ufw profiles.
+    - debian/control: Add bzr tag and point it to our tree
+    - debian/apache2.py, debian/apache2.2-common.install: Add apport hook.
+    - debian/control, debian/ask-for-passphrase, debian/config-dir/mods-available/ssl.conf:
+      Plymouth aware passphrase dialog program ask-for-passphrase.
+
+ -- Andres Rodriguez <[e-mail]>  Mon, 23 May 2011 10:16:09 -0400
+
 apache2 (2.2.19-1) unstable; urgency=low
 
   * New upstream release.
@@ -1292,6 +2106,18 @@ apache2 (2.2.19-1) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Sun, 22 May 2011 10:21:21 +0200
 
+apache2 (2.2.17-3ubuntu1) oneiric; urgency=low
+
+  * Merge from debian unstable.  Remaining changes:
+    - debian/{control, rules}: Enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: Add ufw profiles.
+    - debian/control: Add bzr tag and point it to our tree
+    - debain/apache2.py, debian/apache2.2-common.isntall: Add apport hook.
+    - debian/control, debian/ask-for-passphrase, debian/config-dir/mods-available/ssl.conf:
+      Plymouth aware passphrase dialog program ask-for-passphrase.
+
+ -- Chuck Short <[e-mail]>  Mon, 11 Apr 2011 02:13:30 +0100
+
 apache2 (2.2.17-3) unstable; urgency=low
 
   * Fix compilation with OpenSSL without SSLv2 support. Closes: #622049
@@ -1318,6 +2144,18 @@ apache2 (2.2.17-2) unstable; urgency=high
 
  -- Stefan Fritsch <[e-mail]>  Mon, 21 Mar 2011 23:01:17 +0100
 
+apache2 (2.2.17-1ubuntu1) natty; urgency=low
+
+  * Merge from debian unstable, remaining changes:
+    - debian/{control, rules}: Enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: Add ufw profiles.
+    - debian/control: Add bzr tag and point it to our tree
+    - debain/apache2.py, debian/apache2.2-common.isntall: Add apport hook.
+    - debian/control, debian/ask-for-passphrase, debian/config-dir/mods-available/ssl.conf:
+      Plymouth aware passphrase dialog program ask-for-passphrase. 
+
+ -- Chuck Short <[e-mail]>  Tue, 22 Feb 2011 13:02:08 -0500
+
 apache2 (2.2.17-1) unstable; urgency=low
 
   * New upstream version
@@ -1326,6 +2164,32 @@ apache2 (2.2.17-1) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Tue, 15 Feb 2011 23:30:18 +0100
 
+apache2 (2.2.16-6ubuntu3) natty; urgency=low
+
+  * debian/rules: Don't use "-fno-strict-aliasing" since it causes
+    apache FTBFS on amd64. (LP: #711293) 
+
+ -- Chuck Short <[e-mail]>  Tue, 01 Feb 2011 10:19:55 -0500
+
+apache2 (2.2.16-6ubuntu2) natty; urgency=low
+
+  * debian/rules: Use "-fno-strict-aliasing" to work around a gcc bug.
+   (LP: #697105) 
+
+ -- Chuck Short <[e-mail]>  Tue, 25 Jan 2011 11:14:58 -0500
+
+apache2 (2.2.16-6ubuntu1) natty; urgency=low
+
+  * Merge from debian unstable.  Remaining changes:
+    - debian/{control, rules}: Enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: Add ufw profiles.
+    - debian/control: Add bzr tag and point it to our tree
+    - debain/apache2.py, debian/apache2.2-common.isntall: Add apport hook.
+    - debian/control, debian/ask-for-passphrase, debian/config-dir/mods-available/ssl.conf:
+      Plymouth aware passphrase dialog program ask-for-passphrase.
+
+ -- Chuck Short <[e-mail]>  Sun, 02 Jan 2011 06:05:51 +0000
+
 apache2 (2.2.16-6) unstable; urgency=low
 
   * Also add $named to the secondary-init-script example.
@@ -1341,6 +2205,30 @@ apache2 (2.2.16-5) unstable; urgency=medium
 
  -- Stefan Fritsch <[e-mail]>  Fri, 31 Dec 2010 01:22:19 +0100
 
+apache2 (2.2.16-4ubuntu2) natty; urgency=low
+
+  [Clint Byrum]
+  * Adding plymouth aware passphrase dialog program ask-for-passphrase.
+    (LP: #582963)
+    + debian/control: apache2.2-common depends on bash for ask-for-passphrase
+    + debian/config-dir/mods-available/ssl.conf:
+      - SSLPassPhraseDialog now uses exec:/usr/share/apache2/ask-for-passhrase
+
+  [Chuck Short]
+  * Add apport hook. (LP: #609177)
+    + debian/apache2.py, debian/apache2.2-common.install
+
+ -- Chuck Short <[e-mail]>  Mon, 22 Nov 2010 09:43:43 -0500
+
+apache2 (2.2.16-4ubuntu1) natty; urgency=low
+
+  * Merge from debian unstable.  Remaining changes:
+    - debian/{control, rules}: Enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: Add ufw profiles.
+    - debian/control: Add bzr tag and point it to our tree
+
+ -- Chuck Short <[e-mail]>  Mon, 22 Nov 2010 09:43:41 -0500
+
 apache2 (2.2.16-4) unstable; urgency=medium
 
   * Increase the mod_reqtimeout default timeouts to avoid potential problems
@@ -1351,6 +2239,15 @@ apache2 (2.2.16-4) unstable; urgency=medium
 
  -- Stefan Fritsch <[e-mail]>  Sun, 14 Nov 2010 19:05:55 +0100
 
+apache2 (2.2.16-3ubuntu1) natty; urgency=low
+
+  * Merge from debian unstable.  Remaining changes:
+    - debian/{control, rules}: Enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: Add ufw profiles.
+    - debian/control: Add bzr tag and point it to our tree.
+
+ -- Chuck Short <[e-mail]>  Tue, 12 Oct 2010 11:54:48 +0100
+
 apache2 (2.2.16-3) unstable; urgency=high
 
   * CVE-2010-1623: mod_reqtimeout: Fix potential DoS by high memory usage.
@@ -1373,6 +2270,30 @@ apache2 (2.2.16-2) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Sun, 29 Aug 2010 15:29:21 +0200
 
+apache2 (2.2.16-1ubuntu3) maverick; urgency=low
+
+  * Revert "stty sane" to unbreak apache starting, this will have to be
+    fixed a different way. (LP: #626723) 
+
+ -- Chuck Short <[e-mail]>  Wed, 08 Sep 2010 08:33:17 -0400
+
+apache2 (2.2.16-1ubuntu2) maverick; urgency=low
+
+  * debian/apache2.2-common.apache2.init: Add stty sane so that users will get a 
+    password prompt when using apache-ssl. (LP: #582963)
+
+ -- Chuck Short <[e-mail]>  Wed, 25 Aug 2010 09:25:05 -0400
+
+apache2 (2.2.16-1ubuntu1) maverick; urgency=low
+
+  * Merge from debian unstable.  Remaining changes:
+    - debian/{control, rules}: Enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: Add ufw profiles.
+    - debian/control: Add bzr tag and point it to our tree.
+    - debian/apache2-2.common.apache2.init: Add graceful restart (LP: #456381)
+
+ -- Chuck Short <[e-mail]>  Mon, 26 Jul 2010 20:21:37 +0100
+
 apache2 (2.2.16-1) unstable; urgency=medium
 
   * Urgency medium for security fix.
@@ -1405,6 +2326,24 @@ apache2 (2.2.15-6) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Fri, 16 Jul 2010 23:41:08 +0200
 
+apache2 (2.2.15-5ubuntu1) maverick; urgency=low
+
+  * Merge from debian unstable.  Remaining changes:
+    - debian/{control, rules}: Enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: Add ufw profiles.
+    - debian/control: Add bzr tag and point it to our tree.
+    - debian/apache2-2.common.apache2.init: Add graceful restart (LP: #456381)
+    + Dropped:
+      - debian/patches/206-fix-potential-memory-leaks.dpatch: No longer needed.
+      - debian/patches/206-report-max-client-mpm-worker.dpatch: No longer needed.
+      - debian/config-dir/apache2.conf: Merged back from debian.
+      - mod-reqtimeout functionality: Merge back from debian.
+      - debian/patches/204_CVE-2010-0408.dpatch: No longer needed.
+      - debian/patches/205_CVE-2010-0434.dpatch: No longer needed.
+      - debian/patches/203_fix-ab-segfault.dpatch: No longer needed.
+
+ -- Chuck Short <[e-mail]>  Wed, 05 May 2010 01:28:04 +0100
+
 apache2 (2.2.15-5) unstable; urgency=low
 
   * Conflict with apache package as we now include apachectl. Closes: #579065
@@ -1525,6 +2464,80 @@ apache2 (2.2.14-6) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Sun, 07 Feb 2010 17:29:45 +0100
 
+apache2 (2.2.14-5ubuntu8) lucid; urgency=low
+
+  * debian/patches/210-backport-mod-reqtimeout-ftbfs.dpatch: Add missing mod_reqtime.so
+    (LP: #562370) 
+
+ -- Chuck Short <[e-mail]>  Tue, 13 Apr 2010 15:09:57 -0400
+
+apache2 (2.2.14-5ubuntu7) lucid; urgency=low
+
+  * debian/patches/206-fix-potential-memory-leaks.dpatch: Fix potential memory
+    leaks by making sure to not destroy bucket brigades that have been created
+    by earlier filters. Backported from 2.2.15.
+  * debian/patches/206-report-max-client-mpm-worker.dpatch: Don't report server 
+    has reached MaxClients until it has. Backported from 2.2.15
+  * debian/config-dir/apache2.conf: Make the Files ~ "^\.ht" block in apache2.conf 
+    more secure by adding Satisfy all. (Debian bug: #572075)
+  * debian/rules, debian/patches/209-backport-mod-reqtimeout.dpatch, 
+    debian/config2-dir/mods-available/reqtimeout.load,
+    debian/config2-dir/mods-available/reqtimeout.conf debian/NEWS : Backport the 
+    mod-reqtimeout module from 2.2.15, this will mitigate apache slowloris
+    bug in apache. Enable it by default. (LP: #392759)
+
+ -- Chuck Short <[e-mail]>  Mon, 05 Apr 2010 09:53:35 -0400
+
+apache2 (2.2.14-5ubuntu6) lucid; urgency=low
+
+  * debian/apache2.2-common.apache2.init: Fix thinko. (LP: #551681) 
+
+ -- Chuck Short <[e-mail]>  Tue, 30 Mar 2010 09:41:11 -0400
+
+apache2 (2.2.14-5ubuntu5) lucid; urgency=low
+
+  * Revert 99-fix-mod-dav-permissions.dpatch 
+
+ -- Chuck Short <[e-mail]>  Tue, 30 Mar 2010 07:55:46 -0400
+
+apache2 (2.2.14-5ubuntu4) lucid; urgency=low
+
+  * debian/patches/99-fix-mod-dav-permissions.dpatch: Fix permisisons when 
+    downloading files from webdav (LP: #540747)
+  * debian/apache2.2-common.apache2.init: Add graceful restart (LP: #456381)
+
+ -- Chuck Short <[e-mail]>  Mon, 29 Mar 2010 13:37:39 -0400
+
+apache2 (2.2.14-5ubuntu3) lucid; urgency=low
+
+  * SECURITY UPDATE: denial of service via crafted request in mod_proxy_ajp
+    - debian/patches/204_CVE-2010-0408.dpatch: return the right error code
+      in modules/proxy/mod_proxy_ajp.c.
+    - CVE-2010-0408
+  * SECURITY UPDATE: information disclosure via improper handling of
+    headers in subrequests
+    - debian/patches/205_CVE-2010-0434.dpatch: use a copy of r->headers_in
+      in server/protocol.c.
+    - CVE-2010-0434
+
+ -- Marc Deslauriers <[e-mail]>  Wed, 10 Mar 2010 14:48:48 -0500
+
+apache2 (2.2.14-5ubuntu2) lucid; urgency=low
+
+  * debian/patches/203_fix-ab-segfault.dpatch: Fix segfaulting ab when using really
+    wacky options. (LP: #450501) 
+
+ -- Chuck Short <[e-mail]>  Mon, 08 Mar 2010 14:53:17 -0500
+
+apache2 (2.2.14-5ubuntu1) lucid; urgency=low
+
+  * Merge from debian testing.  Remaining changes: LP: #506862
+    - debian/{control, rules}: Enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: Add ufw profiles.
+    - debian/control: Add bzr tag and point it to our tree.
+
+ -- Bhavani Shankar <[e-mail]>  Wed, 13 Jan 2010 14:28:41 +0530
+
 apache2 (2.2.14-5) unstable; urgency=low
 
   * Security: Further mitigation for the TLS renegotation attack
@@ -1548,6 +2561,15 @@ apache2 (2.2.14-5) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Sat, 02 Jan 2010 22:44:15 +0100
 
+apache2 (2.2.14-4ubuntu1) lucid; urgency=low
+
+  * Resynchronzie with Debian, remaining changes are:
+   - debian/{control, rules}: Enable PIE hardening.
+   - debian/{control, rules, pache2.2-common.ufw.profile}: Add ufw profiles.
+   - debian/control: Add bzr tag and point it to our tree.
+
+ -- Chuck Short <[e-mail]>  Wed, 23 Dec 2009 14:44:51 -0500
+
 apache2 (2.2.14-4) unstable; urgency=low
 
   * Disable localized error pages again by default because they break
@@ -1598,6 +2620,17 @@ apache2 (2.2.14-2) unstable; urgency=medium
 
  -- Stefan Fritsch <[e-mail]>  Sat, 07 Nov 2009 14:37:37 +0100
 
+apache2 (2.2.14-1ubuntu1) lucid; urgency=low
+
+  * Merge from debian testing, remaining changes:
+    - debian/{control, rules}: Enable PIE hardening.
+    - debian/{control, rules, pache2.2-common.ufw.profile}: Add ufw profiles.
+    - debian/conrol: Add bzr tag and point it to our tree.
+    - Dropped debian/patches/203_fix_legacy_ap_rputs_segfaults.dpatch: 
+      Already applied upstream.
+
+ -- Chuck Short <[e-mail]>  Fri, 06 Nov 2009 00:29:03 +0000
+
 apache2 (2.2.14-1) unstable; urgency=low
 
   * New upstream version:
@@ -1632,6 +2665,24 @@ apache2 (2.2.13-1) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Mon, 31 Aug 2009 20:28:56 +0200
 
+apache2 (2.2.12-1ubuntu2) karmic; urgency=low
+
+  * debian/patches/203_fix_legacy_ap_rputs_segfaults.dpatch: 
+    - Fix potential segfaults with the use of the legacy ap_rputs() etc
+      interfaces, in cases where an output filter fails. This happens
+      frequently after CVE-2009-1891 got fixed. (LP: #409987) 
+
+ -- Marc Deslauriers <[e-mail]>  Mon, 17 Aug 2009 15:38:47 -0400
+
+apache2 (2.2.12-1ubuntu1) karmic; urgency=low
+
+  * Merge from debian unstable, remaining changes:
+    - debian/{control,rules}: enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: add ufw profiles.
+    - Dropped debian/patches/203_fix-ssl-timeftm-ignored.dpatch.
+
+ -- Chuck Short <[e-mail]>  Tue, 04 Aug 2009 20:04:24 +0100
+
 apache2 (2.2.12-1) unstable; urgency=low
 
   * New upstream release:
@@ -1679,6 +2730,16 @@ apache2 (2.2.12-1) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Tue, 04 Aug 2009 11:02:34 +0200
 
+apache2 (2.2.11-7ubuntu1) karmic; urgency=low
+
+  * Merge from debian unstable, remaining changes: LP: #398130
+    - debian/patches/203_fix-ssl-timeftm-ignored.dpatch:
+      Fix timefmt is ignored when XBitHack is on. (LP: #258914)
+    - debian/{control,rules}: enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: add ufw profiles.
+
+ -- Bhavani Shankar <[e-mail]>  Sat, 11 Jul 2009 16:34:32 +0530
+
 apache2 (2.2.11-7) unstable; urgency=low
 
   * Security fixes:
@@ -1693,6 +2754,16 @@ apache2 (2.2.11-7) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Fri, 10 Jul 2009 22:42:57 +0200
 
+apache2 (2.2.11-6ubuntu1) karmic; urgency=low
+
+  * Merge from debian unstable, remaining changes:
+    - debian/patches/203_fix-ssl-timeftm-ignored.dpatch:
+      Fix timefmt is ignored when XBitHack is on. (LP: #258914)
+    - debian/{control,rules}: enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: add ufw profiles.
+
+ -- Chuck Short <[e-mail]>  Tue, 09 Jun 2009 01:01:23 +0100
+
 apache2 (2.2.11-6) unstable; urgency=high
 
   * CVE-2009-1195: mod_include allowed to bypass IncludesNoExec for Server
@@ -1701,6 +2772,16 @@ apache2 (2.2.11-6) unstable; urgency=high
 
  -- Stefan Fritsch <[e-mail]>  Mon, 08 Jun 2009 19:22:58 +0200
 
+apache2 (2.2.11-5ubuntu1) karmic; urgency=low
+
+  * Merge from debian unstable, remaining changes:
+    - debian/patches/203_fix-ssi-timeftm-ignored.dpatch: 
+      Fix timefmt is ignored when XBitHack is on. (LP: #258914) 
+    - debian/{control,rules}: enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: add ufw profiles.
+
+ -- Andrew Mitchell <[e-mail]>  Wed, 03 Jun 2009 14:10:54 +1200
+
 apache2 (2.2.11-5) unstable; urgency=low
 
   * Move all binaries into a new package apache2.2-bin and make
@@ -1749,6 +2830,16 @@ apache2 (2.2.11-4) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Tue, 19 May 2009 22:55:27 +0200
 
+apache2 (2.2.11-3ubuntu1) karmic; urgency=low
+
+  * Merge from debian unstable, remaining changes:
+    - debian/patches/203_fix-ssi-timeftm-ignored.dpatch: 
+      Fix timefmt is ignored when XBitHack is on. (LP: #258914) 
+    - debian/{control,rules}: enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: add ufw profiles.
+
+ -- Andrew Mitchell <[e-mail]>  Tue, 12 May 2009 16:15:34 +1200
+
 apache2 (2.2.11-3) unstable; urgency=low
 
   * Rebuild against apr-util 1.3, to fix undefined symbol errors in mod_ldap
@@ -1757,6 +2848,21 @@ apache2 (2.2.11-3) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Tue, 31 Mar 2009 21:07:26 +0200
 
+apache2 (2.2.11-2ubuntu2) jaunty; urgency=low
+
+  * debian/patches/203_fix-ssi-timeftm-ignored.dpatch: 
+    Fix timefmt is ignored when XBitHack is on. (LP: #258914) 
+
+ -- Chuck Short <[e-mail]>  Wed, 01 Apr 2009 11:39:17 -0400
+
+apache2 (2.2.11-2ubuntu1) jaunty; urgency=low
+
+  * Merge from debian unstable, remaining changes:
+    - debian/{contro,rules}: enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: add ufw profiles.
+
+ -- Chuck Short <[e-mail]>  Sat, 17 Jan 2009 00:02:55 +0000
+
 apache2 (2.2.11-2) unstable; urgency=low
 
   * Report an error instead instead of segfaulting when apr_pollset_create
@@ -1766,6 +2872,14 @@ apache2 (2.2.11-2) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Fri, 16 Jan 2009 19:01:59 +0100
 
+apache2 (2.2.11-1ubuntu1) jaunty; urgency=low
+
+  * Merge from debian unstable, remaining changes:
+    - debian/{control, rules}: enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: add ufw profiles.
+
+ -- Chuck Short <[e-mail]>  Mon, 15 Dec 2008 00:06:50 +0000
+
 apache2 (2.2.11-1) unstable; urgency=low
 
   [Thom May]
@@ -1780,6 +2894,14 @@ apache2 (2.2.11-1) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Sun, 14 Dec 2008 09:34:24 +0100
 
+apache2 (2.2.9-11ubuntu1) jaunty; urgency=low
+
+  * Merge from debian unstable, remaining changes: (LP: #303375)
+    - debian/{control, rules}: enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: add ufw profiles.
+
+ -- Bhavani Shankar <[e-mail]>  Sat, 29 Nov 2008 14:02:31 +0530
+
 apache2 (2.2.9-11) unstable; urgency=low
 
   * Regression fix from upstream svn for mod_proxy:
@@ -1794,6 +2916,14 @@ apache2 (2.2.9-11) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Wed, 26 Nov 2008 23:10:22 +0100
 
+apache2 (2.2.9-10ubuntu1) jaunty; urgency=low
+
+  * Merge from debian unstable, remaining changes:
+    - debian/{control, rules}: enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: add ufw profiles.
+
+ -- Chuck Short <[e-mail]>  Wed, 05 Nov 2008 02:23:18 -0400
+
 apache2 (2.2.9-10) unstable; urgency=low
 
   * Regression fix from upstream svn for mod_proxy_http:
@@ -1824,6 +2954,27 @@ apache2 (2.2.9-8) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Thu, 11 Sep 2008 09:17:33 +0200
 
+apache2 (2.2.9-7ubuntu3) intrepid; urgency=low
+
+  * Revert logrotate change since it will break it for everyone. 
+
+ -- Chuck Short <[e-mail]>  Fri, 19 Sep 2008 09:32:01 -0400
+
+apache2 (2.2.9-7ubuntu2) intrepid; urgency=low
+
+  * debian/logrotate: Restart rather than reload for busy websites.
+    (LP: #270899) 
+
+ -- Chuck Short <[e-mail]>  Thu, 18 Sep 2008 08:42:22 -0400
+
+apache2 (2.2.9-7ubuntu1) intrepid; urgency=low
+
+  * Merge from debian unstable, remaining changes:
+    - debian/{control,rules}: enable PIE hardening.
+    - debian/{control,rules,apache2.2-common.ufw.profile}: add ufw profiles.
+
+ -- Kees Cook <[e-mail]>  Thu, 28 Aug 2008 08:10:59 -0700
+
 apache2 (2.2.9-7) unstable; urgency=low
 
   * Fix XSS in mod_proxy_ftp (CVE-2008-2939).
@@ -1866,6 +3017,23 @@ apache2 (2.2.9-4) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Sun, 06 Jul 2008 10:38:37 +0200
 
+apache2 (2.2.9-3ubuntu2) intrepid; urgency=low
+
+  * add ufw integration (see
+    https://wiki.ubuntu.com/UbuntuFirewall#Integrating%20UFW%20with%20Packages)
+    (LP: #261198)
+    - debian/control: suggest ufw for apache2.2-common
+    - add apache2.2-common.ufw.profile with 3 profiles and install it to
+      /etc/ufw/applications.d/apache2.2-common
+
+ -- Didier Roche <[e-mail]>  Tue, 26 Aug 2008 19:03:42 +0200
+
+apache2 (2.2.9-3ubuntu1) intrepid; urgency=low
+
+  * debian/{control,rules}: enable PIE hardening
+
+ -- Kees Cook <[e-mail]>  Wed, 20 Aug 2008 15:45:00 -0700
+
 apache2 (2.2.9-3) unstable; urgency=low
 
   [ Stefan Fritsch ]
@@ -3946,3 +5114,4 @@ apache2 (2.0.18-1) unstable; urgency=low
   * Initial Release.
 
  -- Daniel Stone <[e-mail]>  Wed,  4 Jul 2001 21:29:29 +1000
+
diff --git a/debian/control b/debian/control
index f7e875a..948b39c 100644
--- a/debian/control
+++ b/debian/control
@@ -1,7 +1,8 @@
 Source: apache2
 Section: httpd
 Priority: optional
-Maintainer: Debian Apache Maintainers <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Debian Apache Maintainers <[e-mail]>
 Uploaders: Stefan Fritsch <[e-mail]>, Arno Töll <[e-mail]>
 Build-Depends: debhelper (>= 9.20131213~), lsb-release, dpkg-dev (>= 1.16.1~),
  libaprutil1-dev (>= 1.5.0), libapr1-dev (>= 1.5.0), libpcre3-dev, zlib1g-dev,
@@ -25,7 +26,7 @@ Provides: httpd, httpd-cgi
 Recommends: ssl-cert
 Conflicts: apache2.2-common, apache2.2-bin
 Replaces: apache2.2-common, apache2.2-bin
-Suggests: www-browser, apache2-doc, apache2-suexec-pristine | apache2-suexec-custom
+Suggests: www-browser, apache2-doc, apache2-suexec-pristine | apache2-suexec-custom, ufw
 Description: Apache HTTP Server
  The Apache HTTP Server Project's goal is to build a secure, efficient and
  extensible HTTP server as standards-compliant open source software. The
diff --git a/debian/icons/ubuntu-logo.png b/debian/icons/ubuntu-logo.png
new file mode 100644
index 0000000..4db2fa1
Binary files /dev/null and b/debian/icons/ubuntu-logo.png differ
diff --git a/debian/index.html b/debian/index.html
index 766401d..96ed444 100644
--- a/debian/index.html
+++ b/debian/index.html
@@ -1,9 +1,14 @@
 
 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
 <html xmlns="http://www.w3.org/1999/xhtml">
+  <!--
+    Modified from the Debian original for Ubuntu
+    Last updated: 2016-11-16
+    See: https://launchpad.net/bugs/1288690
+  -->
   <head>
     <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
-    <title>Apache2 Debian Default Page: It works</title>
+    <title>Apache2 Ubuntu Default Page: It works</title>
     <style type="text/css" media="screen">
   * {
     margin: 0px 0px 0px 0px;
@@ -188,9 +193,9 @@
   <body>
     <div class="main_page">
       <div class="page_header floating_element">
-        <img src="/icons/openlogo-75.png" alt="Debian Logo" class="floating_element"/>
+        <img src="/icons/ubuntu-logo.png" alt="Ubuntu Logo" class="floating_element"/>
         <span class="floating_element">
-          Apache2 Debian Default Page
+          Apache2 Ubuntu Default Page
         </span>
       </div>
 <!--      <div class="table_of_contents floating_element">
@@ -221,7 +226,9 @@
         <div class="content_section_text">
           <p>
                 This is the default welcome page used to test the correct 
-                operation of the Apache2 server after installation on Debian systems.
+                operation of the Apache2 server after installation on Ubuntu systems.
+                It is based on the equivalent page on Debian, from which the Ubuntu Apache
+                packaging is derived.
                 If you can read this page, it means that the Apache HTTP server installed at
                 this site is working properly. You should <b>replace this file</b> (located at
                 <tt>/var/www/html/index.html</tt>) before continuing to operate your HTTP server.
@@ -242,9 +249,9 @@
         </div>
         <div class="content_section_text">
           <p>
-                Debian's Apache2 default configuration is different from the
+                Ubuntu's Apache2 default configuration is different from the
                 upstream default configuration, and split into several files optimized for
-                interaction with Debian tools. The configuration system is
+                interaction with Ubuntu tools. The configuration system is
                 <b>fully documented in
                 /usr/share/doc/apache2/README.Debian.gz</b>. Refer to this for the full
                 documentation. Documentation for the web server itself can be
@@ -253,7 +260,7 @@
 
           </p>
           <p>
-                The configuration layout for an Apache2 web server installation on Debian systems is as follows:
+                The configuration layout for an Apache2 web server installation on Ubuntu systems is as follows:
           </p>
           <pre>
 /etc/apache2/
@@ -324,7 +331,7 @@
 
         <div class="content_section_text">
             <p>
-                By default, Debian does not allow access through the web browser to
+                By default, Ubuntu does not allow access through the web browser to
                 <em>any</em> file apart of those located in <tt>/var/www</tt>,
                 <a href="http://httpd.apache.org/docs/2.4/mod/mod_userdir.html" rel="nofollow">public_html</a>
                 directories (when enabled) and <tt>/usr/share</tt> (for web
@@ -333,7 +340,7 @@
                 document root directory in <tt>/etc/apache2/apache2.conf</tt>.
             </p>
             <p>
-                The default Debian document root is <tt>/var/www/html</tt>. You
+                The default Ubuntu document root is <tt>/var/www/html</tt>. You
                 can make your own virtual hosts under /var/www. This is different
                 to previous releases which provides better security out of the box.
             </p>
@@ -345,9 +352,9 @@
         </div>
         <div class="content_section_text">
           <p>
-                Please use the <tt>reportbug</tt> tool to report bugs in the
-                Apache2 package with Debian. However, check <a
-                href="http://bugs.debian.org/cgi-bin/pkgreport.cgi?ordering=normal;archive=0;src=apache2;repeatmerged=0"
+                Please use the <tt>ubuntu-bug</tt> tool to report bugs in the
+                Apache2 package with Ubuntu. However, check <a
+                href="https://bugs.launchpad.net/ubuntu/+source/apache2"
                 rel="nofollow">existing bug reports</a> before reporting a new bug.
           </p>
           <p>
diff --git a/debian/patches/086_svn_cross_compiles b/debian/patches/086_svn_cross_compiles
new file mode 100644
index 0000000..7e5f11c
--- /dev/null
+++ b/debian/patches/086_svn_cross_compiles
@@ -0,0 +1,118 @@
+Description: Pull upstream fixes for autotools for cross-compiling
+Author: Adam Conrad <[e-mail]>
+Origin: upstream, http://svn.eu.apache.org/viewvc?view=revision&revision=1328445
+Origin: upstream, http://svn.eu.apache.org/viewvc?view=revision&revision=1327907
+Origin: upstream, http://svn.eu.apache.org/viewvc?view=revision&revision=1328390
+Origin: upstream, http://svn.eu.apache.org/viewvc?view=revision&revision=1328714
+Forwarded: not-needed
+
+Index: apache2-2.4.23/acinclude.m4
+===================================================================
+--- apache2-2.4.23.orig/acinclude.m4	2016-11-16 09:24:37.118151902 -0500
++++ apache2-2.4.23/acinclude.m4	2016-11-16 09:24:37.110151799 -0500
+@@ -55,6 +55,8 @@
+   APACHE_SUBST(CPPFLAGS)
+   APACHE_SUBST(CFLAGS)
+   APACHE_SUBST(CXXFLAGS)
++  APACHE_SUBST(CC_FOR_BUILD)
++  APACHE_SUBST(CFLAGS_FOR_BUILD)
+   APACHE_SUBST(LTFLAGS)
+   APACHE_SUBST(LDFLAGS)
+   APACHE_SUBST(LT_LDFLAGS)
+@@ -702,7 +704,7 @@
+ {
+     return sizeof(void *) < sizeof(long); 
+ }], [ap_cv_void_ptr_lt_long=no], [ap_cv_void_ptr_lt_long=yes], 
+-    [ap_cv_void_ptr_lt_long=yes])])
++    [ap_cv_void_ptr_lt_long="cross compile - not checked"])])
+ 
+ if test "$ap_cv_void_ptr_lt_long" = "yes"; then
+     AC_MSG_ERROR([Size of "void *" is less than size of "long"])
+Index: apache2-2.4.23/configure
+===================================================================
+--- apache2-2.4.23.orig/configure	2016-11-16 09:24:37.118151902 -0500
++++ apache2-2.4.23/configure	2016-11-16 09:24:37.114151851 -0500
+@@ -660,6 +660,8 @@
+ SH_LDFLAGS
+ LT_LDFLAGS
+ LTFLAGS
++CFLAGS_FOR_BUILD
++CC_FOR_BUILD
+ CXXFLAGS
+ CXX
+ other_targets
+@@ -6066,6 +6068,12 @@
+ 
+ 
+ 
++if test "x${build_alias}" != "x${host_alias}"; then
++  if test "x${CC_FOR_BUILD}" = "x"; then
++    CC_FOR_BUILD=cc
++  fi
++fi
++
+ if test "x${cache_file}" = "x/dev/null"; then
+   # Likewise, ensure that CC and CPP are passed through to the pcre
+   # configure script iff caching is disabled (the autoconf 2.5x default).
+@@ -7693,7 +7701,7 @@
+   $as_echo_n "(cached) " >&6
+ else
+   if test "$cross_compiling" = yes; then :
+-  ap_cv_void_ptr_lt_long=yes
++  ap_cv_void_ptr_lt_long="cross compile - not checked"
+ else
+   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ /* end confdefs.h.  */
+@@ -36047,6 +36055,14 @@
+ 
+ 
+ 
++  APACHE_VAR_SUBST="$APACHE_VAR_SUBST CC_FOR_BUILD"
++
++
++
++  APACHE_VAR_SUBST="$APACHE_VAR_SUBST CFLAGS_FOR_BUILD"
++
++
++
+   APACHE_VAR_SUBST="$APACHE_VAR_SUBST LTFLAGS"
+ 
+ 
+Index: apache2-2.4.23/configure.in
+===================================================================
+--- apache2-2.4.23.orig/configure.in	2016-11-16 09:24:37.118151902 -0500
++++ apache2-2.4.23/configure.in	2016-11-16 09:24:37.114151851 -0500
+@@ -206,6 +206,14 @@
+ dnl Try to get c99 support for variadic macros
+ ifdef([AC_PROG_CC_C99], [AC_PROG_CC_C99])
+ 
++dnl In case of cross compilation we set CC_FOR_BUILD to cc unless
++dnl we got already CC_FOR_BUILD from environment.
++if test "x${build_alias}" != "x${host_alias}"; then
++  if test "x${CC_FOR_BUILD}" = "x"; then
++    CC_FOR_BUILD=cc
++  fi
++fi
++
+ if test "x${cache_file}" = "x/dev/null"; then
+   # Likewise, ensure that CC and CPP are passed through to the pcre
+   # configure script iff caching is disabled (the autoconf 2.5x default).
+Index: apache2-2.4.23/server/Makefile.in
+===================================================================
+--- apache2-2.4.23.orig/server/Makefile.in	2016-11-16 09:24:37.118151902 -0500
++++ apache2-2.4.23/server/Makefile.in	2016-11-16 09:24:37.114151851 -0500
+@@ -24,9 +24,14 @@
+ include $(top_builddir)/build/rules.mk
+ include $(top_srcdir)/build/library.mk
+ 
++ifdef CC_FOR_BUILD
++gen_test_char: gen_test_char.c
++	$(CC_FOR_BUILD) $(CFLAGS_FOR_BUILD) -DCROSS_COMPILE -o $@ $<
++else
+ gen_test_char_OBJECTS = gen_test_char.lo
+ gen_test_char: $(gen_test_char_OBJECTS)
+ 	$(LINK) $(EXTRA_LDFLAGS) $(gen_test_char_OBJECTS) $(EXTRA_LIBS)
++endif
+ 
+ test_char.h: gen_test_char
+ 	./gen_test_char > test_char.h
diff --git a/debian/patches/series b/debian/patches/series
index d46db24..c524c32 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -16,3 +16,6 @@ CVE-2017-3169.diff
 CVE-2017-7659.diff
 CVE-2017-7668.diff
 CVE-2017-7679.diff
+
+# Patches added by Ubuntu
+086_svn_cross_compiles
diff --git a/debian/source/include-binaries b/debian/source/include-binaries
index a211304..eb2d746 100644
--- a/debian/source/include-binaries
+++ b/debian/source/include-binaries
@@ -16,6 +16,7 @@ debian/icons/odf6odp-20x22.png
 debian/icons/odf6otp-20x22.png
 debian/icons/odf6oth-20x22.png
 debian/icons/openlogo-75.png
+debian/icons/ubuntu-logo.png
 debian/upstream/signing-key.pgp
 debian/perl-framework/t/htdocs/modules/cache/cache/index.html
 debian/perl-framework/t/htdocs/modules/negotiation/en/index.html.de
diff --git a/docs/manual/style/latex/atbeginend.sty b/docs/manual/style/latex/atbeginend.sty
new file mode 100644
index 0000000..79b555d
--- /dev/null
+++ b/docs/manual/style/latex/atbeginend.sty
@@ -0,0 +1,80 @@
+% atbeginend.sty 
+%
+% Licensed to the Apache Software Foundation (ASF) under one or more
+% contributor license agreements.  See the NOTICE file distributed with
+% this work for additional information regarding copyright ownership.
+% The ASF licenses this file to You under the Apache License, Version 2.0
+% (the "License"); you may not use this file except in compliance with
+% the License.  You may obtain a copy of the License at
+%
+%     http://www.apache.org/licenses/LICENSE-2.0
+%
+% Unless required by applicable law or agreed to in writing, software
+% distributed under the License is distributed on an "AS IS" BASIS,
+% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+% See the License for the specific language governing permissions and
+% limitations under the License.
+
+% defines
+% \BeforeBegin{environment}{code-to-execute}
+% \BeforeEnd  {environment}{code-to-execute}
+% \AfterBegin {environment}{code-to-execute}
+% \AfterEnd   {environment}{code-to-execute}
+%
+% Save \begin and \end to \BeginEnvironment and \EndEnvironment
+\let\BeginEnvironment=\begin
+\let\EndEnvironment=\end
+
+\def\IfUnDef#1{\expandafter\ifx\csname#1\endcsname\relax}
+
+% Null command needed to for \nothing{something}=.nothing.
+\def\NullCom#1{}
+
+\def\begin#1{%
+%
+% if defined \BeforeBeg for this environment, execute it
+\IfUnDef{BeforeBeg#1}\else\csname BeforeBeg#1\endcsname\fi%
+%
+%
+%
+\IfUnDef{AfterBeg#1}% This is done to skip the command for environments
+		     % which can take arguments, like multicols; YOU MUST NOT
+		     % USE \AfterBegin{...}{...} for such environments!
+	\let\SaveBegEng=\BeginEnvironment%
+\else%
+	% Start this environment
+		\BeginEnvironment{#1}%
+	% and execute code after \begin{environment}
+		\csname AfterBeg#1\endcsname%
+	% 
+	\let\SaveBegEng=\NullCom%
+\fi%
+\SaveBegEng{#1}%
+}
+
+
+\def\end#1{%
+%
+% execute code before \end{environment}
+\IfUnDef{BeforeEnd#1}\else\csname BeforeEnd#1\endcsname\fi%
+%
+% close this environment
+\EndEnvironment{#1}%
+%
+% and execute code after \begin{environment}
+\IfUnDef{AfterEnd#1}\else\csname AfterEnd#1\endcsname\fi%
+}
+
+
+%% Now, define commands
+% \BeforeBegin{environment}{code-to-execute}
+% \BeforeEnd  {environment}{code-to-execute}
+% \AfterBegin {environment}{code-to-execute}
+% \AfterEnd   {environment}{code-to-execute}
+
+\def\BeforeBegin#1#2{\expandafter\gdef\csname BeforeBeg#1\endcsname
+{#2}}
+\def\BeforeEnd  #1#2{\expandafter\gdef\csname BeforeEnd#1\endcsname
+{#2}}
+\def\AfterBegin #1#2{\expandafter\gdef\csname AfterBeg#1\endcsname {#2}}
+\def\AfterEnd   #1#2{\expandafter\gdef\csname AfterEnd#1\endcsname{#2}}
diff --git a/docs/manual/style/manualpage.dtd b/docs/manual/style/manualpage.dtd
new file mode 100644
index 0000000..e9c22a0
--- /dev/null
+++ b/docs/manual/style/manualpage.dtd
@@ -0,0 +1,29 @@
+<?xml version='1.0' encoding='UTF-8' ?>
+
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements.  See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License.  You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+
+<!ENTITY % common SYSTEM "common.dtd">
+%common;
+
+<!-- <manualpage> is the root element -->
+<!ELEMENT manualpage (parentdocument?, title, summary?,
+seealso*, section*)>
+
+<!ATTLIST manualpage metafile CDATA  #REQUIRED
+                     upgrade  CDATA  #IMPLIED
+>
diff --git a/docs/manual/style/modulesynopsis.dtd b/docs/manual/style/modulesynopsis.dtd
new file mode 100644
index 0000000..4dac5ef
--- /dev/null
+++ b/docs/manual/style/modulesynopsis.dtd
@@ -0,0 +1,77 @@
+<?xml version='1.0' encoding='UTF-8' ?>
+
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements.  See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License.  You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+
+<!ENTITY % sitemap SYSTEM "sitemap.dtd">
+%sitemap;
+
+<!ELEMENT modulesynopsis (name , description, status, hint?, sourcefile?,
+identifier? , compatibility? , summary? , seealso* , section*,
+directivesynopsis*)>
+
+<!ATTLIST modulesynopsis metafile CDATA  #REQUIRED
+                         upgrade  CDATA  #IMPLIED>
+
+<!ELEMENT directivesynopsis (name , description? , syntax? , default?
+, contextlist? , override? , modulelist?, status?, compatibility? ,
+usage?, seealso*)>
+
+<!ELEMENT name (#PCDATA)>
+
+<!ELEMENT status (#PCDATA)>
+
+<!ELEMENT hint %Inline;>
+
+<!ELEMENT identifier (#PCDATA)>
+
+<!ELEMENT sourcefile (#PCDATA)>
+
+<!ELEMENT compatibility %Inline;>
+
+<!ELEMENT description %Inline;>
+
+<!ATTLIST directivesynopsis  type CDATA  #IMPLIED
+                             location CDATA  #IMPLIED >
+
+<!ELEMENT syntax %Inline;>
+
+<!ELEMENT default (#PCDATA | directive | br)*>
+
+<!ELEMENT contextlist (context+)+>
+
+<!ELEMENT context (#PCDATA)>
+
+<!ELEMENT override (#PCDATA)>
+
+<!ELEMENT usage %Block;>
+
+<!-- Used in index.xml -->
+<!ELEMENT moduleindex (title, summary, seealso*)>
+
+<!ATTLIST moduleindex metafile CDATA  #REQUIRED>
+
+<!-- Used in directive.xml -->
+<!ELEMENT directiveindex (title | summary)+>
+
+<!ATTLIST directiveindex metafile CDATA  #REQUIRED>
+
+<!-- Used in quickreference.xml -->
+<!ELEMENT quickreference (title | summary | legend)+>
+<!ATTLIST quickreference metafile CDATA  #REQUIRED>
+
+<!ELEMENT legend (table, table)>
diff --git a/docs/manual/style/scripts/MINIFY b/docs/manual/style/scripts/MINIFY
new file mode 100644
index 0000000..2c1efc3
--- /dev/null
+++ b/docs/manual/style/scripts/MINIFY
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+(echo '// see prettify.js for copyright, license and expanded version'; python -mrjsmin <prettify.js) >prettify.min.js
+
+# needs python and rjsmin installed
diff --git a/docs/manual/style/scripts/prettify.js b/docs/manual/style/scripts/prettify.js
new file mode 100644
index 0000000..2fa959a
--- /dev/null
+++ b/docs/manual/style/scripts/prettify.js
@@ -0,0 +1,1622 @@
+// Copyright (C) 2006 Google Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+
+/**
+ * @fileoverview
+ * some functions for browser-side pretty printing of code contained in html.
+ *
+ * <p>
+ * For a fairly comprehensive set of languages see the
+ * <a href="http://google-code-prettify.googlecode.com/svn/trunk/README.html#langs">README</a>
+ * file that came with this source.  At a minimum, the lexer should work on a
+ * number of languages including C and friends, Java, Python, Bash, SQL, HTML,
+ * XML, CSS, Javascript, and Makefiles.  It works passably on Ruby, PHP and Awk
+ * and a subset of Perl, but, because of commenting conventions, doesn't work on
+ * Smalltalk, Lisp-like, or CAML-like languages without an explicit lang class.
+ * <p>
+ * Usage: <ol>
+ * <li> include this source file in an html page via
+ *   {@code <script type="text/javascript" src="/path/to/prettify.js"></script>}
+ * <li> define style rules.  See the example page for examples.
+ * <li> mark the {@code <pre>} and {@code <code>} tags in your source with
+ *    {@code class=prettyprint.}
+ *    You can also use the (html deprecated) {@code <xmp>} tag, but the pretty
+ *    printer needs to do more substantial DOM manipulations to support that, so
+ *    some css styles may not be preserved.
+ * </ol>
+ * That's it.  I wanted to keep the API as simple as possible, so there's no
+ * need to specify which language the code is in, but if you wish, you can add
+ * another class to the {@code <pre>} or {@code <code>} element to specify the
+ * language, as in {@code <pre class="prettyprint lang-java">}.  Any class that
+ * starts with "lang-" followed by a file extension, specifies the file type.
+ * See the "lang-*.js" files in this directory for code that implements
+ * per-language file handlers.
+ * <p>
+ * Change log:<br>
+ * cbeust, 2006/08/22
+ * <blockquote>
+ *   Java annotations (start with "@") are now captured as literals ("lit")
+ * </blockquote>
+ * @requires console
+ */
+
+// JSLint declarations
+/*global console, document, navigator, setTimeout, window, define */
+
+/**
+ * Split {@code prettyPrint} into multiple timeouts so as not to interfere with
+ * UI events.
+ * If set to {@code false}, {@code prettyPrint()} is synchronous.
+ */
+window['PR_SHOULD_USE_CONTINUATION'] = true;
+
+/**
+ * Find all the {@code <pre>} and {@code <code>} tags in the DOM with
+ * {@code class=prettyprint} and prettify them.
+ *
+ * @param {Function?} opt_whenDone if specified, called when the last entry
+ *     has been finished.
+ */
+var prettyPrintOne;
+/**
+ * Pretty print a chunk of code.
+ *
+ * @param {string} sourceCodeHtml code as html
+ * @return {string} code as html, but prettier
+ */
+var prettyPrint;
+
+
+(function () {
+  var win = window;
+  // Keyword lists for various languages.
+  // We use things that coerce to strings to make them compact when minified
+  // and to defeat aggressive optimizers that fold large string constants.
+  var FLOW_CONTROL_KEYWORDS = ["break,continue,do,else,for,if,return,while"];
+  var C_KEYWORDS = [FLOW_CONTROL_KEYWORDS,"auto,case,char,const,default," + 
+      "double,enum,extern,float,goto,int,long,register,short,signed,sizeof,module," +
+      "static,struct,switch,typedef,union,unsigned,void,volatile"];
+  var COMMON_KEYWORDS = [C_KEYWORDS,"catch,class,delete,false,import," +
+      "new,operator,private,protected,public,this,throw,true,try,typeof"];
+  var CPP_KEYWORDS = [COMMON_KEYWORDS,"alignof,align_union,asm,axiom,bool," +
+      "concept,concept_map,const_cast,constexpr,decltype," +
+      "dynamic_cast,explicit,export,friend,inline,late_check," +
+      "mutable,namespace,nullptr,reinterpret_cast,static_assert,static_cast," +
+      "template,typeid,typename,using,virtual,where,request_req"];
+  var JAVA_KEYWORDS = [COMMON_KEYWORDS,
+      "abstract,boolean,byte,extends,final,finally,implements,import," +
+      "instanceof,null,native,package,strictfp,super,synchronized,throws," +
+      "transient"];
+  var CSHARP_KEYWORDS = [JAVA_KEYWORDS,
+      "as,base,by,checked,decimal,delegate,descending,dynamic,event," +
+      "fixed,foreach,from,group,implicit,in,interface,internal,into,is,let," +
+      "lock,object,out,override,orderby,params,partial,readonly,ref,sbyte," +
+      "sealed,stackalloc,string,select,uint,ulong,unchecked,unsafe,ushort," +
+      "var,virtual,where"];
+  var COFFEE_KEYWORDS = "all,and,by,catch,class,else,extends,false,finally," +
+      "for,if,in,is,isnt,loop,new,no,not,null,of,off,on,or,return,super,then," +
+      "throw,true,try,unless,until,when,while,yes";
+  var JSCRIPT_KEYWORDS = [COMMON_KEYWORDS,
+      "debugger,eval,export,function,get,null,set,undefined,var,with," +
+      "Infinity,NaN"];
+  var PERL_KEYWORDS = "caller,delete,die,do,dump,else,elsif,eval,exit,foreach,for," +
+      "goto,if,import,last,local,my,next,no,our,print,printf,package,redo,require," +
+      "sub,undef,unless,until,use,wantarray,while,BEGIN,END";
+  var PHP_KEYWORDS = "abstract,and,array,as,break,case,catch,cfunction,class," +
+      "clone,const,continue,declare,default,do,else,elseif,enddeclare,endfor," + 
+      "endforeach,endif,endswitch,endwhile,extends,final,for,foreach,function," +
+      "global,goto,if,implements,interface,instanceof,namespace,new,old_function," +
+      "or,private,protected,public,static,switch,throw,try,use,var,while,xor," + 
+      "die,echo,empty,exit,eval,include,include_once,isset,list,require," + 
+      "require_once,return,print,unset";
+  var PYTHON_KEYWORDS = [FLOW_CONTROL_KEYWORDS, "and,as,assert,class,def,del," +
+      "elif,except,exec,finally,from,global,import,in,is,lambda," +
+      "nonlocal,not,or,pass,print,raise,try,with,yield," +
+      "False,True,None"];
+  var RUBY_KEYWORDS = [FLOW_CONTROL_KEYWORDS, "alias,and,begin,case,class," +
+      "def,defined,elsif,end,ensure,false,in,module,next,nil,not,or,redo," +
+      "rescue,retry,self,super,then,true,undef,unless,until,when,yield," +
+      "BEGIN,END"];
+  var SH_KEYWORDS = [FLOW_CONTROL_KEYWORDS, "case,done,elif,esac,eval,fi," +
+      "function,in,local,set,then,until,echo"];
+  var CONFIG_ENVS = ["User-Agent,HTTP_USER_AGENT,HTTP_REFERER,HTTP_COOKIE,HTTP_FORWARDED,HTTP_HOST,HTTP_PROXY_CONNECTION,HTTP_ACCEPT,REMOTE_ADDR,REMOTE_HOST,REMOTE_PORT,REMOTE_USER,REMOTE_IDENT,REQUEST_METHOD,SCRIPT_FILENAME,PATH_INFO,QUERY_STRING,AUTH_TYPE,DOCUMENT_ROOT,SERVER_ADMIN,SERVER_NAME,SERVER_ADDR,SERVER_PORT,SERVER_PROTOCOL,SERVER_SOFTWARE,TIME_YEAR,TIME_MON,TIME_DAY,TIME_HOUR,TIME_MIN,TIME_SEC,TIME_WDAY,TIME,API_VERSION,THE_REQUEST,REQUEST_URI,REQUEST_FILENAME,IS_SUBREQ,HTTPS,REQUEST_SCHEME"];
+  var CONFIG_KEYWORDS = ["Macro,UndefMacro,Use,AuthLDAPURL,AcceptFilter,AcceptPathInfo,AccessFileName,Action,AddAlt,AddAltByEncoding,AddAltByType,AddCharset,AddDefaultCharset,AddDescription,AddEncoding,AddHandler,AddIcon,AddIconByEncoding,AddIconByType,AddInputFilter,AddLanguage,AddModuleInfo,AddOutputFilter,AddOutputFilterByType,AddType,Alias,AliasMatch,Allow,AllowCONNECT,AllowEncodedSlashes,AllowMethods,AllowOverride,AllowOverrideList,Anonymous,Anonymous_LogEmail,Anonymous_MustGiveEmail,Anonymous_NoUserID,Anonymous_VerifyEmail,AsyncRequestWorkerFactor,AuthBasicAuthoritative,AuthBasicProvider,AuthDBDUserPWQuery,AuthDBDUserRealmQuery,AuthDBMGroupFile,AuthDBMType,AuthDBMUserFile,AuthDigestAlgorithm,AuthDigestDomain,AuthDigestNcCheck,AuthDigestNonceFormat,AuthDigestNonceLifetime,AuthDigestProvider,AuthDigestQop,AuthDigestShmemSize,AuthFormAuthoritative,AuthFormBody,AuthFormDisableNoStore,AuthFormFakeBasicAuth,AuthFormLocation,AuthFormLoginRequiredLocation,AuthFormLoginSuccessLocation,AuthFormLogoutLocation,AuthFormMethod,AuthFormMimetype,AuthFormPassword,AuthFormProvider,AuthFormSitePassphrase,AuthFormSize,AuthFormUsername,AuthGroupFile,AuthLDAPAuthorizePrefix,AuthLDAPBindAuthoritative,AuthLDAPBindDN,AuthLDAPBindPassword,AuthLDAPCharsetConfig,AuthLDAPCompareAsUser,AuthLDAPCompareDNOnServer,AuthLDAPDereferenceAliases,AuthLDAPGroupAttribute,AuthLDAPGroupAttributeIsDN,AuthLDAPInitialBindAsUser,AuthLDAPInitialBindPattern,AuthLDAPMaxSubGroupDepth,AuthLDAPRemoteUserAttribute,AuthLDAPRemoteUserIsDN,AuthLDAPSearchAsUser,AuthLDAPSubGroupAttribute,AuthLDAPSubGroupClass,AuthLDAPUrl,AuthMerging,AuthName,AuthnCacheContext,AuthnCacheEnable,AuthnCacheProvideFor,AuthnCacheSOCache,AuthnCacheTimeout,<AuthnProviderAlias>,AuthType,AuthUserFile,AuthzDBDLoginToReferer,AuthzDBDQuery,AuthzDBDRedirectQuery,AuthzDBMType,<AuthzProviderAlias>,AuthzSendForbiddenOnFailure,BalancerGrowth,BalancerMember,BrowserMatch,BrowserMatchNoCase,BufferedLogs,BufferSize,CacheDefaultExpire,CacheDetailHeader,CacheDirLength,CacheDirLevels,CacheDisable,CacheEnable,CacheFile,CacheHeader,CacheIgnoreCacheControl,CacheIgnoreHeaders,CacheIgnoreNoLastMod,CacheIgnoreQueryString,CacheIgnoreURLSessionIdentifiers,CacheKeyBaseURL,CacheLastModifiedFactor,CacheLock,CacheLockMaxAge,CacheLockPath,CacheMaxExpire,CacheMaxFileSize,CacheMinExpire,CacheMinFileSize,CacheNegotiatedDocs,CacheQuickHandler,CacheReadSize,CacheReadTime,CacheRoot,CacheStaleOnError,CacheStoreExpired,CacheStoreNoStore,CacheStorePrivate,CGIMapExtension,CharsetDefault,CharsetOptions,CharsetSourceEnc,CheckCaseOnly,CheckSpelling,ChrootDir,ContentDigest,CookieDomain,CookieExpires,CookieName,CookieStyle,CookieTracking,CoreDumpDirectory,CustomLog,Dav,DavDepthInfinity,DavGenericLockDB,DavLockDB,DavMinTimeout,DBDExptime,DBDInitSQL,DBDKeep,DBDMax,DBDMin,DBDParams,DBDPersist,DBDPrepareSQL,DBDriver,DefaultIcon,DefaultLanguage,DefaultRuntimeDir,DefaultType,Define,DeflateBufferSize,DeflateCompressionLevel,DeflateFilterNote,DeflateMemLevel,DeflateWindowSize,Deny,<Directory>,DirectoryIndex,DirectoryIndexRedirect,<DirectoryMatch>,DirectorySlash,DocumentRoot,DTracePrivileges,DumpIOInput,DumpIOOutput,<Else>,<ElseIf>,EnableExceptionHook,EnableMMAP,EnableSendfile,Error,ErrorDocument,ErrorLog,ErrorLogFormat,Example,ExpiresActive,ExpiresByType,ExpiresDefault,ExtendedStatus,ExtFilterDefine,ExtFilterOptions,FallbackResource,FileETag,<Files>,<FilesMatch>,FilterChain,FilterDeclare,FilterProtocol,FilterProvider,FilterTrace,ForceLanguagePriority,ForceType,ForensicLog,GprofDir,GracefulShutdownTimeout,Group,Header,HeaderName,HeartbeatAddress,HeartbeatListen,HeartbeatMaxServers,HeartbeatStorage,HeartbeatStorage,HostnameLookups,IdentityCheck,IdentityCheckTimeout,<If>,<IfDefine>,<IfModule>,<IfVersion>,ImapBase,ImapDefault,ImapMenu,Include,IncludeOptional,IndexHeadInsert,IndexIgnore,IndexIgnoreReset,IndexOptions,IndexOrderDefault,IndexStyleSheet,InputSed,ISAPIAppendLogToErrors,ISAPIAppendLogToQuery,ISAPICacheFile,ISAPIFakeAsync,ISAPILogNotSupported,ISAPIReadAheadBuffer,KeepAlive,KeepAliveTimeout,KeptBodySize,LanguagePriority,LDAPCacheEntries,LDAPCacheTTL,LDAPConnectionPoolTTL,LDAPConnectionTimeout,LDAPLibraryDebug,LDAPOpCacheEntries,LDAPOpCacheTTL,LDAPReferralHopLimit,LDAPReferrals,LDAPRetries,LDAPRetryDelay,LDAPSharedCacheFile,LDAPSharedCacheSize,LDAPTimeout,LDAPTrustedClientCert,LDAPTrustedGlobalCert,LDAPTrustedMode,LDAPVerifyServerCert,<Limit>,<LimitExcept>,LimitInternalRecursion,LimitRequestBody,LimitRequestFields,LimitRequestFieldSize,LimitRequestLine,LimitXMLRequestBody,Listen,ListenBackLog,LoadFile,LoadModule,<Location>,<LocationMatch>,LogFormat,LogLevel,LogMessage,LuaCodeCache,LuaHookAccessChecker,LuaHookAuthChecker,LuaAuthzProvider,LuaHookCheckUserID,LuaHookFixups,LuaHookInsertFilter,LuaHookMapToStorage,LuaHookTranslateName,LuaHookTypeChecker,LuaInherit,LuaInputFilter,LuaMapHandler,LuaOutputFilter,LuaPackageCPath,LuaPackagePath,LuaQuickHandler,LuaRoot,LuaScope,MaxConnectionsPerChild,MaxKeepAliveRequests,MaxMemFree,MaxRangeOverlaps,MaxRangeReversals,MaxRanges,MaxRequestWorkers,MaxSpareServers,MaxSpareThreads,MaxThreads,MetaDir,MetaFiles,MetaSuffix,MimeMagicFile,MinSpareServers,MinSpareThreads,MMapFile,ModemStandard,ModMimeUsePathInfo,MultiviewsMatch,Mutex,NameVirtualHost,NoProxy,NWSSLTrustedCerts,NWSSLUpgradeable,Options,Order,OutputSed,PassEnv,PidFile,PrivilegesMode,Protocol,ProtocolEcho,<Proxy>,ProxyAddHeaders,ProxyBadHeader,ProxyBlock,ProxyDomain,ProxyErrorOverride,ProxyExpressDBMFile,ProxyExpressDBMType,ProxyExpressEnable,ProxyFtpDirCharset,ProxyFtpEscapeWildcards,ProxyFtpListOnWildcard,ProxyHTMLBufSize,ProxyHTMLCharsetOut,ProxyHTMLDocType,ProxyHTMLEnable,ProxyHTMLEvents,ProxyHTMLExtended,ProxyHTMLFixups,ProxyHTMLInterp,ProxyHTMLLinks,ProxyHTMLStripComments,ProxyHTMLURLMap,ProxyIOBufferSize,<ProxyMatch>,ProxyMaxForwards,ProxyPass,ProxyPassInterpolateEnv,ProxyPassMatch,ProxyPassReverse,ProxyPassReverseCookieDomain,ProxyPassReverseCookiePath,ProxyPreserveHost,ProxyReceiveBufferSize,ProxyRemote,ProxyRemoteMatch,ProxyRequests,ProxySCGIInternalRedirect,ProxySCGISendfile,ProxySet,ProxySourceAddress,ProxyStatus,ProxyTimeout,ProxyVia,ReadmeName,ReceiveBufferSize,Redirect,RedirectMatch,RedirectPermanent,RedirectTemp,ReflectorHeader,RemoteIPHeader,RemoteIPInternalProxy,RemoteIPInternalProxyList,RemoteIPProxiesHeader,RemoteIPTrustedProxy,RemoteIPTrustedProxyList,RemoveCharset,RemoveEncoding,RemoveHandler,RemoveInputFilter,RemoveLanguage,RemoveOutputFilter,RemoveType,RequestHeader,RequestReadTimeout,Require,<RequireAll>,<RequireAny>,<RequireNone>,RewriteBase,RewriteCond,RewriteEngine,RewriteMap,RewriteOptions,RewriteRule,RLimitCPU,RLimitMEM,RLimitNPROC,Satisfy,ScoreBoardFile,Script,ScriptAlias,ScriptAliasMatch,ScriptInterpreterSource,ScriptLog,ScriptLogBuffer,ScriptLogLength,ScriptSock,SecureListen,SeeRequestTail,SendBufferSize,ServerAdmin,ServerAlias,ServerLimit,ServerName,ServerPath,ServerRoot,ServerSignature,ServerTokens,Session,SessionCookieName,SessionCookieName2,SessionCookieRemove,SessionCryptoCipher,SessionCryptoDriver,SessionCryptoPassphrase,SessionCryptoPassphraseFile,SessionDBDCookieName,SessionDBDCookieName2,SessionDBDCookieRemove,SessionDBDDeleteLabel,SessionDBDInsertLabel,SessionDBDPerUser,SessionDBDSelectLabel,SessionDBDUpdateLabel,SessionEnv,SessionExclude,SessionHeader,SessionInclude,SessionMaxAge,SetEnv,SetEnvIf,SetEnvIfExpr,SetEnvIfNoCase,SetHandler,SetInputFilter,SetOutputFilter,SSIEndTag,SSIErrorMsg,SSIETag,SSILastModified,SSILegacyExprParser,SSIStartTag,SSITimeFormat,SSIUndefinedEcho,SSLCACertificateFile,SSLCACertificatePath,SSLCADNRequestFile,SSLCADNRequestPath,SSLCARevocationCheck,SSLCARevocationFile,SSLCARevocationPath,SSLCertificateChainFile,SSLCertificateFile,SSLCertificateKeyFile,SSLCipherSuite,SSLCryptoDevice,SSLEngine,SSLFIPS,SSLHonorCipherOrder,SSLInsecureRenegotiation,SSLOCSPDefaultResponder,SSLOCSPEnable,SSLOCSPOverrideResponder,SSLOCSPResponderTimeout,SSLOCSPResponseMaxAge,SSLOCSPResponseTimeSkew,SSLOptions,SSLPassPhraseDialog,SSLProtocol,SSLProxyCACertificateFile,SSLProxyCACertificatePath,SSLProxyCARevocationCheck,SSLProxyCARevocationFile,SSLProxyCARevocationPath,SSLProxyCheckPeerCN,SSLProxyCheckPeerExpire,SSLProxyCipherSuite,SSLProxyEngine,SSLProxyMachineCertificateChainFile,SSLProxyMachineCertificateFile,SSLProxyMachineCertificatePath,SSLProxyProtocol,SSLProxyVerify,SSLProxyVerifyDepth,SSLRandomSeed,SSLRenegBufferSize,SSLRequire,SSLRequireSSL,SSLSessionCache,SSLSessionCacheTimeout,SSLSessionTicketKeyFile,SSLStaplingCache,SSLStaplingErrorCacheTimeout,SSLStaplingFakeTryLater,SSLStaplingForceURL,SSLStaplingResponderTimeout,SSLStaplingResponseMaxAge,SSLStaplingResponseTimeSkew,SSLStaplingReturnResponderErrors,SSLStaplingStandardCacheTimeout,SSLStrictSNIVHostCheck,SSLUserName,SSLUseStapling,SSLVerifyClient,SSLVerifyDepth,StartServers,StartThreads,Substitute,Suexec,SuexecUserGroup,ThreadLimit,ThreadsPerChild,ThreadStackSize,TimeOut,TraceEnable,TransferLog,TypesConfig,UnDefine,UnsetEnv,UseCanonicalName,UseCanonicalPhysicalPort,User,UserDir,VHostCGIMode,VHostCGIPrivs,VHostGroup,VHostPrivs,VHostSecure,VHostUser,VirtualDocumentRoot,VirtualDocumentRootIP,<VirtualHost>,VirtualScriptAlias,VirtualScriptAliasIP,WatchdogInterval,XBitHack,xml2EncAlias,xml2EncDefault,xml2StartParse,RewriteLog,RewriteLogLevel"];
+  var CONFIG_OPTIONS = /^[\\+\\-]?(AuthConfig|IncludesNOEXEC|ExecCGI|FollowSymLinks|MultiViews|Includes|Indexes|SymLinksIfOwnerMatch)\b/i;
+  var ALL_KEYWORDS = [
+      CPP_KEYWORDS, CSHARP_KEYWORDS, JSCRIPT_KEYWORDS, PERL_KEYWORDS +
+      PYTHON_KEYWORDS, RUBY_KEYWORDS, SH_KEYWORDS, CONFIG_KEYWORDS, PHP_KEYWORDS];
+  var C_TYPES = /^(DIR|FILE|vector|(de|priority_)?queue|list|stack|(const_)?iterator|(multi)?(set|map)|bitset|u?(int|float|char|void|const|static|struct)\d*(_t)?\b)|[a-z_]+_rec|cmd_parms\b/;
+
+  // token style names.  correspond to css classes
+  /**
+   * token style for a string literal
+   * @const
+   */
+  var PR_STRING = 'str';
+  /**
+   * token style for a keyword
+   * @const
+   */
+  var PR_KEYWORD = 'kwd';
+  /**
+   * token style for a comment
+   * @const
+   */
+  var PR_COMMENT = 'com';
+  /**
+   * token style for a type
+   * @const
+   */
+  var PR_TYPE = 'typ';
+  /**
+   * token style for a literal value.  e.g. 1, null, true.
+   * @const
+   */
+  var PR_LITERAL = 'lit';
+  /**
+   * token style for a punctuation string.
+   * @const
+   */
+  var PR_PUNCTUATION = 'pun';
+  /**
+   * token style for plain text.
+   * @const
+   */
+  var PR_PLAIN = 'pln';
+
+  /**
+   * token style for an sgml tag.
+   * @const
+   */
+  var PR_TAG = 'tag';
+  /**
+   * token style for a markup declaration such as a DOCTYPE.
+   * @const
+   */
+  var PR_DECLARATION = 'dec';
+  /**
+   * token style for embedded source.
+   * @const
+   */
+  var PR_SOURCE = 'src';
+  /**
+   * token style for an sgml attribute name.
+   * @const
+   */
+  var PR_ATTRIB_NAME = 'atn';
+  /**
+   * token style for an sgml attribute value.
+   * @const
+   */
+  var PR_ATTRIB_VALUE = 'atv';
+
+  /**
+   * A class that indicates a section of markup that is not code, e.g. to allow
+   * embedding of line numbers within code listings.
+   * @const
+   */
+  var PR_NOCODE = 'nocode';
+
+
+
+/**
+ * A set of tokens that can precede a regular expression literal in
+ * javascript
+ * http://web.archive.org/web/20070717142515/http://www.mozilla.org/js/language/js20/rationale/syntax.html
+ * has the full list, but I've removed ones that might be problematic when
+ * seen in languages that don't support regular expression literals.
+ *
+ * <p>Specifically, I've removed any keywords that can't precede a regexp
+ * literal in a syntactically legal javascript program, and I've removed the
+ * "in" keyword since it's not a keyword in many languages, and might be used
+ * as a count of inches.
+ *
+ * <p>The link above does not accurately describe EcmaScript rules since
+ * it fails to distinguish between (a=++/b/i) and (a++/b/i) but it works
+ * very well in practice.
+ *
+ * @private
+ * @const
+ */
+var REGEXP_PRECEDER_PATTERN = '(?:^^\\.?|[+-]|[!=]=?=?|\\#|%=?|&&?=?|\\(|\\*=?|[+\\-]=|->|\\/=?|::?|<<?=?|>>?>?=?|,|;|\\?|@|\\[|~|{|\\^\\^?=?|\\|\\|?=?|break|case|continue|delete|do|else|finally|instanceof|return|throw|try|typeof)\\s*';
+
+// CAVEAT: this does not properly handle the case where a regular
+// expression immediately follows another since a regular expression may
+// have flags for case-sensitivity and the like.  Having regexp tokens
+// adjacent is not valid in any language I'm aware of, so I'm punting.
+// TODO: maybe style special characters inside a regexp as punctuation.
+
+
+  /**
+   * Given a group of {@link RegExp}s, returns a {@code RegExp} that globally
+   * matches the union of the sets of strings matched by the input RegExp.
+   * Since it matches globally, if the input strings have a start-of-input
+   * anchor (/^.../), it is ignored for the purposes of unioning.
+   * @param {Array.<RegExp>} regexs non multiline, non-global regexs.
+   * @return {RegExp} a global regex.
+   */
+  function combinePrefixPatterns(regexs) {
+    var capturedGroupIndex = 0;
+  
+    var needToFoldCase = false;
+    var ignoreCase = false;
+    for (var i = 0, n = regexs.length; i < n; ++i) {
+      var regex = regexs[i];
+      if (regex.ignoreCase) {
+        ignoreCase = true;
+      } else if (/[a-z]/i.test(regex.source.replace(
+                     /\\u[0-9a-f]{4}|\\x[0-9a-f]{2}|\\[^ux]/gi, ''))) {
+        needToFoldCase = true;
+        ignoreCase = false;
+        break;
+      }
+    }
+  
+    var escapeCharToCodeUnit = {
+      'b': 8,
+      't': 9,
+      'n': 0xa,
+      'v': 0xb,
+      'f': 0xc,
+      'r': 0xd
+    };
+  
+    function decodeEscape(charsetPart) {
+      var cc0 = charsetPart.charCodeAt(0);
+      if (cc0 !== 92 /* \\ */) {
+        return cc0;
+      }
+      var c1 = charsetPart.charAt(1);
+      cc0 = escapeCharToCodeUnit[c1];
+      if (cc0) {
+        return cc0;
+      } else if ('0' <= c1 && c1 <= '7') {
+        return parseInt(charsetPart.substring(1), 8);
+      } else if (c1 === 'u' || c1 === 'x') {
+        return parseInt(charsetPart.substring(2), 16);
+      } else {
+        return charsetPart.charCodeAt(1);
+      }
+    }
+  
+    function encodeEscape(charCode) {
+      if (charCode < 0x20) {
+        return (charCode < 0x10 ? '\\x0' : '\\x') + charCode.toString(16);
+      }
+      var ch = String.fromCharCode(charCode);
+      return (ch === '\\' || ch === '-' || ch === ']' || ch === '^')
+          ? "\\" + ch : ch;
+    }
+  
+    function caseFoldCharset(charSet) {
+      var charsetParts = charSet.substring(1, charSet.length - 1).match(
+          new RegExp(
+              '\\\\u[0-9A-Fa-f]{4}'
+              + '|\\\\x[0-9A-Fa-f]{2}'
+              + '|\\\\[0-3][0-7]{0,2}'
+              + '|\\\\[0-7]{1,2}'
+              + '|\\\\[\\s\\S]'
+              + '|-'
+              + '|[^-\\\\]',
+              'g'));
+      var ranges = [];
+      var inverse = charsetParts[0] === '^';
+  
+      var out = ['['];
+      if (inverse) { out.push('^'); }
+  
+      for (var i = inverse ? 1 : 0, n = charsetParts.length; i < n; ++i) {
+        var p = charsetParts[i];
+        if (/\\[bdsw]/i.test(p)) {  // Don't muck with named groups.
+          out.push(p);
+        } else {
+          var start = decodeEscape(p);
+          var end;
+          if (i + 2 < n && '-' === charsetParts[i + 1]) {
+            end = decodeEscape(charsetParts[i + 2]);
+            i += 2;
+          } else {
+            end = start;
+          }
+          ranges.push([start, end]);
+          // If the range might intersect letters, then expand it.
+          // This case handling is too simplistic.
+          // It does not deal with non-latin case folding.
+          // It works for latin source code identifiers though.
+          if (!(end < 65 || start > 122)) {
+            if (!(end < 65 || start > 90)) {
+              ranges.push([Math.max(65, start) | 32, Math.min(end, 90) | 32]);
+            }
+            if (!(end < 97 || start > 122)) {
+              ranges.push([Math.max(97, start) & ~32, Math.min(end, 122) & ~32]);
+            }
+          }
+        }
+      }
+  
+      // [[1, 10], [3, 4], [8, 12], [14, 14], [16, 16], [17, 17]]
+      // -> [[1, 12], [14, 14], [16, 17]]
+      ranges.sort(function (a, b) { return (a[0] - b[0]) || (b[1]  - a[1]); });
+      var consolidatedRanges = [];
+      var lastRange = [];
+      for (var i = 0; i < ranges.length; ++i) {
+        var range = ranges[i];
+        if (range[0] <= lastRange[1] + 1) {
+          lastRange[1] = Math.max(lastRange[1], range[1]);
+        } else {
+          consolidatedRanges.push(lastRange = range);
+        }
+      }
+  
+      for (var i = 0; i < consolidatedRanges.length; ++i) {
+        var range = consolidatedRanges[i];
+        out.push(encodeEscape(range[0]));
+        if (range[1] > range[0]) {
+          if (range[1] + 1 > range[0]) { out.push('-'); }
+          out.push(encodeEscape(range[1]));
+        }
+      }
+      out.push(']');
+      return out.join('');
+    }
+  
+    function allowAnywhereFoldCaseAndRenumberGroups(regex) {
+      // Split into character sets, escape sequences, punctuation strings
+      // like ('(', '(?:', ')', '^'), and runs of characters that do not
+      // include any of the above.
+      var parts = regex.source.match(
+          new RegExp(
+              '(?:'
+              + '\\[(?:[^\\x5C\\x5D]|\\\\[\\s\\S])*\\]'  // a character set
+              + '|\\\\u[A-Fa-f0-9]{4}'  // a unicode escape
+              + '|\\\\x[A-Fa-f0-9]{2}'  // a hex escape
+              + '|\\\\[0-9]+'  // a back-reference or octal escape
+              + '|\\\\[^ux0-9]'  // other escape sequence
+              + '|\\(\\?[:!=]'  // start of a non-capturing group
+              + '|[\\(\\)\\^]'  // start/end of a group, or line start
+              + '|[^\\x5B\\x5C\\(\\)\\^]+'  // run of other characters
+              + ')',
+              'g'));
+      var n = parts.length;
+  
+      // Maps captured group numbers to the number they will occupy in
+      // the output or to -1 if that has not been determined, or to
+      // undefined if they need not be capturing in the output.
+      var capturedGroups = [];
+  
+      // Walk over and identify back references to build the capturedGroups
+      // mapping.
+      for (var i = 0, groupIndex = 0; i < n; ++i) {
+        var p = parts[i];
+        if (p === '(') {
+          // groups are 1-indexed, so max group index is count of '('
+          ++groupIndex;
+        } else if ('\\' === p.charAt(0)) {
+          var decimalValue = +p.substring(1);
+          if (decimalValue) {
+            if (decimalValue <= groupIndex) {
+              capturedGroups[decimalValue] = -1;
+            } else {
+              // Replace with an unambiguous escape sequence so that
+              // an octal escape sequence does not turn into a backreference
+              // to a capturing group from an earlier regex.
+              parts[i] = encodeEscape(decimalValue);
+            }
+          }
+        }
+      }
+  
+      // Renumber groups and reduce capturing groups to non-capturing groups
+      // where possible.
+      for (var i = 1; i < capturedGroups.length; ++i) {
+        if (-1 === capturedGroups[i]) {
+          capturedGroups[i] = ++capturedGroupIndex;
+        }
+      }
+      for (var i = 0, groupIndex = 0; i < n; ++i) {
+        var p = parts[i];
+        if (p === '(') {
+          ++groupIndex;
+          if (!capturedGroups[groupIndex]) {
+            parts[i] = '(?:';
+          }
+        } else if ('\\' === p.charAt(0)) {
+          var decimalValue = +p.substring(1);
+          if (decimalValue && decimalValue <= groupIndex) {
+            parts[i] = '\\' + capturedGroups[decimalValue];
+          }
+        }
+      }
+  
+      // Remove any prefix anchors so that the output will match anywhere.
+      // ^^ really does mean an anchored match though.
+      for (var i = 0; i < n; ++i) {
+        if ('^' === parts[i] && '^' !== parts[i + 1]) { parts[i] = ''; }
+      }
+  
+      // Expand letters to groups to handle mixing of case-sensitive and
+      // case-insensitive patterns if necessary.
+      if (regex.ignoreCase && needToFoldCase) {
+        for (var i = 0; i < n; ++i) {
+          var p = parts[i];
+          var ch0 = p.charAt(0);
+          if (p.length >= 2 && ch0 === '[') {
+            parts[i] = caseFoldCharset(p);
+          } else if (ch0 !== '\\') {
+            // TODO: handle letters in numeric escapes.
+            parts[i] = p.replace(
+                /[a-zA-Z]/g,
+                function (ch) {
+                  var cc = ch.charCodeAt(0);
+                  return '[' + String.fromCharCode(cc & ~32, cc | 32) + ']';
+                });
+          }
+        }
+      }
+  
+      return parts.join('');
+    }
+  
+    var rewritten = [];
+    for (var i = 0, n = regexs.length; i < n; ++i) {
+      var regex = regexs[i];
+      if (regex.global || regex.multiline) { throw new Error('' + regex); }
+      rewritten.push(
+          '(?:' + allowAnywhereFoldCaseAndRenumberGroups(regex) + ')');
+    }
+  
+    return new RegExp(rewritten.join('|'), ignoreCase ? 'gi' : 'g');
+  }
+
+
+  /**
+   * Split markup into a string of source code and an array mapping ranges in
+   * that string to the text nodes in which they appear.
+   *
+   * <p>
+   * The HTML DOM structure:</p>
+   * <pre>
+   * (Element   "p"
+   *   (Element "b"
+   *     (Text  "print "))       ; #1
+   *   (Text    "'Hello '")      ; #2
+   *   (Element "br")            ; #3
+   *   (Text    "  + 'World';")) ; #4
+   * </pre>
+   * <p>
+   * corresponds to the HTML
+   * {@code <p><b>print </b>'Hello '<br>  + 'World';</p>}.</p>
+   *
+   * <p>
+   * It will produce the output:</p>
+   * <pre>
+   * {
+   *   sourceCode: "print 'Hello '\n  + 'World';",
+   *   //                     1          2
+   *   //           012345678901234 5678901234567
+   *   spans: [0, #1, 6, #2, 14, #3, 15, #4]
+   * }
+   * </pre>
+   * <p>
+   * where #1 is a reference to the {@code "print "} text node above, and so
+   * on for the other text nodes.
+   * </p>
+   *
+   * <p>
+   * The {@code} spans array is an array of pairs.  Even elements are the start
+   * indices of substrings, and odd elements are the text nodes (or BR elements)
+   * that contain the text for those substrings.
+   * Substrings continue until the next index or the end of the source.
+   * </p>
+   *
+   * @param {Node} node an HTML DOM subtree containing source-code.
+   * @param {boolean} isPreformatted true if white-space in text nodes should
+   *    be considered significant.
+   * @return {Object} source code and the text nodes in which they occur.
+   */
+  function extractSourceSpans(node, isPreformatted) {
+    var nocode = /(?:^|\s)nocode(?:\s|$)/;
+  
+    var chunks = [];
+    var length = 0;
+    var spans = [];
+    var k = 0;
+  
+    function walk(node) {
+      switch (node.nodeType) {
+        case 1:  // Element
+          if (nocode.test(node.className)) { return; }
+          for (var child = node.firstChild; child; child = child.nextSibling) {
+            walk(child);
+          }
+          var nodeName = node.nodeName.toLowerCase();
+          if ('br' === nodeName || 'li' === nodeName) {
+            chunks[k] = '\n';
+            spans[k << 1] = length++;
+            spans[(k++ << 1) | 1] = node;
+          }
+          break;
+        case 3: case 4:  // Text
+          var text = node.nodeValue;
+          if (text.length) {
+            if (!isPreformatted) {
+              text = text.replace(/[ \t\r\n]+/g, ' ');
+            } else {
+              text = text.replace(/\r\n?/g, '\n');  // Normalize newlines.
+              text = text.replace(/^(\r?\n\s*)+/g, '');  // Remove leading newlines
+              text = text.replace(/^\s*/g, '');  // Remove leading spaces due to indented formatting
+              text = text.replace(/(\r?\n\s*)+$/g, '');  // Remove ending newlines
+              
+            }
+            // TODO: handle tabs here?
+            chunks[k] = text;
+            spans[k << 1] = length;
+            length += text.length;
+            spans[(k++ << 1) | 1] = node;
+          }
+          break;
+      }
+    }
+  
+    walk(node);
+  
+    return {
+      sourceCode: chunks.join('').replace(/\n$/, ''),
+      spans: spans
+    };
+  }
+
+
+  /**
+   * Apply the given language handler to sourceCode and add the resulting
+   * decorations to out.
+   * @param {number} basePos the index of sourceCode within the chunk of source
+   *    whose decorations are already present on out.
+   */
+  function appendDecorations(basePos, sourceCode, langHandler, out) {
+    if (!sourceCode) { return; }
+    var job = {
+      sourceCode: sourceCode,
+      basePos: basePos
+    };
+    langHandler(job);
+    out.push.apply(out, job.decorations);
+  }
+
+  var notWs = /\S/;
+
+  /**
+   * Given an element, if it contains only one child element and any text nodes
+   * it contains contain only space characters, return the sole child element.
+   * Otherwise returns undefined.
+   * <p>
+   * This is meant to return the CODE element in {@code <pre><code ...>} when
+   * there is a single child element that contains all the non-space textual
+   * content, but not to return anything where there are multiple child elements
+   * as in {@code <pre><code>...</code><code>...</code></pre>} or when there
+   * is textual content.
+   */
+  function childContentWrapper(element) {
+    var wrapper = undefined;
+    for (var c = element.firstChild; c; c = c.nextSibling) {
+      var type = c.nodeType;
+      wrapper = (type === 1)  // Element Node
+          ? (wrapper ? element : c)
+          : (type === 3)  // Text Node
+          ? (notWs.test(c.nodeValue) ? element : wrapper)
+          : wrapper;
+    }
+    return wrapper === element ? undefined : wrapper;
+  }
+
+  /** Given triples of [style, pattern, context] returns a lexing function,
+    * The lexing function interprets the patterns to find token boundaries and
+    * returns a decoration list of the form
+    * [index_0, style_0, index_1, style_1, ..., index_n, style_n]
+    * where index_n is an index into the sourceCode, and style_n is a style
+    * constant like PR_PLAIN.  index_n-1 <= index_n, and style_n-1 applies to
+    * all characters in sourceCode[index_n-1:index_n].
+    *
+    * The stylePatterns is a list whose elements have the form
+    * [style : string, pattern : RegExp, DEPRECATED, shortcut : string].
+    *
+    * Style is a style constant like PR_PLAIN, or can be a string of the
+    * form 'lang-FOO', where FOO is a language extension describing the
+    * language of the portion of the token in $1 after pattern executes.
+    * E.g., if style is 'lang-lisp', and group 1 contains the text
+    * '(hello (world))', then that portion of the token will be passed to the
+    * registered lisp handler for formatting.
+    * The text before and after group 1 will be restyled using this decorator
+    * so decorators should take care that this doesn't result in infinite
+    * recursion.  For example, the HTML lexer rule for SCRIPT elements looks
+    * something like ['lang-js', /<[s]cript>(.+?)<\/script>/].  This may match
+    * '<script>foo()<\/script>', which would cause the current decorator to
+    * be called with '<script>' which would not match the same rule since
+    * group 1 must not be empty, so it would be instead styled as PR_TAG by
+    * the generic tag rule.  The handler registered for the 'js' extension would
+    * then be called with 'foo()', and finally, the current decorator would
+    * be called with '<\/script>' which would not match the original rule and
+    * so the generic tag rule would identify it as a tag.
+    *
+    * Pattern must only match prefixes, and if it matches a prefix, then that
+    * match is considered a token with the same style.
+    *
+    * Context is applied to the last non-whitespace, non-comment token
+    * recognized.
+    *
+    * Shortcut is an optional string of characters, any of which, if the first
+    * character, gurantee that this pattern and only this pattern matches.
+    *
+    * @param {Array} shortcutStylePatterns patterns that always start with
+    *   a known character.  Must have a shortcut string.
+    * @param {Array} fallthroughStylePatterns patterns that will be tried in
+    *   order if the shortcut ones fail.  May have shortcuts.
+    *
+    * @return {function (Object)} a
+    *   function that takes source code and returns a list of decorations.
+    */
+  function createSimpleLexer(shortcutStylePatterns, fallthroughStylePatterns) {
+    var shortcuts = {};
+    var tokenizer;
+    (function () {
+      var allPatterns = shortcutStylePatterns.concat(fallthroughStylePatterns);
+      var allRegexs = [];
+      var regexKeys = {};
+      for (var i = 0, n = allPatterns.length; i < n; ++i) {
+        var patternParts = allPatterns[i];
+        var shortcutChars = patternParts[3];
+        if (shortcutChars) {
+          for (var c = shortcutChars.length; --c >= 0;) {
+            shortcuts[shortcutChars.charAt(c)] = patternParts;
+          }
+        }
+        var regex = patternParts[1];
+        var k = '' + regex;
+        if (!regexKeys.hasOwnProperty(k)) {
+          allRegexs.push(regex);
+          regexKeys[k] = null;
+        }
+      }
+      allRegexs.push(/[\0-\uffff]/);
+      tokenizer = combinePrefixPatterns(allRegexs);
+    })();
+
+    var nPatterns = fallthroughStylePatterns.length;
+
+    /**
+     * Lexes job.sourceCode and produces an output array job.decorations of
+     * style classes preceded by the position at which they start in
+     * job.sourceCode in order.
+     *
+     * @param {Object} job an object like <pre>{
+     *    sourceCode: {string} sourceText plain text,
+     *    basePos: {int} position of job.sourceCode in the larger chunk of
+     *        sourceCode.
+     * }</pre>
+     */
+    var decorate = function (job) {
+      var sourceCode = job.sourceCode, basePos = job.basePos;
+      /** Even entries are positions in source in ascending order.  Odd enties
+        * are style markers (e.g., PR_COMMENT) that run from that position until
+        * the end.
+        * @type {Array.<number|string>}
+        */
+      var decorations = [basePos, PR_PLAIN];
+      var pos = 0;  // index into sourceCode
+      var tokens = sourceCode.match(tokenizer) || [];
+      var styleCache = {};
+
+      for (var ti = 0, nTokens = tokens.length; ti < nTokens; ++ti) {
+        var token = tokens[ti];
+        var style = styleCache[token];
+        var match = void 0;
+
+        var isEmbedded;
+        if (typeof style === 'string') {
+          isEmbedded = false;
+        } else {
+          var patternParts = shortcuts[token.charAt(0)];
+          if (patternParts) {
+            match = token.match(patternParts[1]);
+            style = patternParts[0];
+          } else {
+            for (var i = 0; i < nPatterns; ++i) {
+              patternParts = fallthroughStylePatterns[i];
+              match = token.match(patternParts[1]);
+              if (match) {
+                style = patternParts[0];
+                break;
+              }
+            }
+
+            if (!match) {  // make sure that we make progress
+              style = PR_PLAIN;
+            }
+          }
+
+          isEmbedded = style.length >= 5 && 'lang-' === style.substring(0, 5);
+          if (isEmbedded && !(match && typeof match[1] === 'string')) {
+            isEmbedded = false;
+            style = PR_SOURCE;
+          }
+
+          if (!isEmbedded) { styleCache[token] = style; }
+        }
+
+        var tokenStart = pos;
+        pos += token.length;
+
+        if (!isEmbedded) {
+          decorations.push(basePos + tokenStart, style);
+        } else {  // Treat group 1 as an embedded block of source code.
+          var embeddedSource = match[1];
+          var embeddedSourceStart = token.indexOf(embeddedSource);
+          var embeddedSourceEnd = embeddedSourceStart + embeddedSource.length;
+          if (match[2]) {
+            // If embeddedSource can be blank, then it would match at the
+            // beginning which would cause us to infinitely recurse on the
+            // entire token, so we catch the right context in match[2].
+            embeddedSourceEnd = token.length - match[2].length;
+            embeddedSourceStart = embeddedSourceEnd - embeddedSource.length;
+          }
+          var lang = style.substring(5);
+          // Decorate the left of the embedded source
+          appendDecorations(
+              basePos + tokenStart,
+              token.substring(0, embeddedSourceStart),
+              decorate, decorations);
+          // Decorate the embedded source
+          appendDecorations(
+              basePos + tokenStart + embeddedSourceStart,
+              embeddedSource,
+              langHandlerForExtension(lang, embeddedSource),
+              decorations);
+          // Decorate the right of the embedded section
+          appendDecorations(
+              basePos + tokenStart + embeddedSourceEnd,
+              token.substring(embeddedSourceEnd),
+              decorate, decorations);
+        }
+      }
+      job.decorations = decorations;
+    };
+    return decorate;
+  }
+
+  /** returns a function that produces a list of decorations from source text.
+    *
+    * This code treats ", ', and ` as string delimiters, and \ as a string
+    * escape.  It does not recognize perl's qq() style strings.
+    * It has no special handling for double delimiter escapes as in basic, or
+    * the tripled delimiters used in python, but should work on those regardless
+    * although in those cases a single string literal may be broken up into
+    * multiple adjacent string literals.
+    *
+    * It recognizes C, C++, and shell style comments.
+    *
+    * @param {Object} options a set of optional parameters.
+    * @return {function (Object)} a function that examines the source code
+    *     in the input job and builds the decoration list.
+    */
+  function sourceDecorator(options) {
+    var shortcutStylePatterns = [], fallthroughStylePatterns = [];
+    if (options['tripleQuotedStrings']) {
+      // '''multi-line-string''', 'single-line-string', and double-quoted
+      shortcutStylePatterns.push(
+          [PR_STRING,  /^(?:\'\'\'(?:[^\'\\]|\\[\s\S]|\'{1,2}(?=[^\']))*(?:\'\'\'|$)|\"\"\"(?:[^\"\\]|\\[\s\S]|\"{1,2}(?=[^\"]))*(?:\"\"\"|$)|\'(?:[^\\\']|\\[\s\S])*(?:\'|$)|\"(?:[^\\\"]|\\[\s\S])*(?:\"|$))/,
+           null, '\'"']);
+    } else if (options['multiLineStrings']) {
+      // 'multi-line-string', "multi-line-string"
+      shortcutStylePatterns.push(
+          [PR_STRING,  /^(?:\'(?:[^\\\']|\\[\s\S])*(?:\'|$)|\"(?:[^\\\"]|\\[\s\S])*(?:\"|$)|\`(?:[^\\\`]|\\[\s\S])*(?:\`|$))/,
+           null, '\'"`']);
+    } else {
+      // 'single-line-string', "single-line-string"
+      shortcutStylePatterns.push(
+          [PR_STRING,
+           /^(?:\'(?:[^\\\'\r\n]|\\.)*(?:\'|$)|\"(?:[^\\\"\r\n]|\\.)*(?:\"|$))/,
+           null, '"\'']);
+    }
+    if (options['verbatimStrings']) {
+      // verbatim-string-literal production from the C# grammar.  See issue 93.
+      fallthroughStylePatterns.push(
+          [PR_STRING, /^@\"(?:[^\"]|\"\")*(?:\"|$)/, null]);
+    }
+    var hc = options['hashComments'];
+    if (hc) {
+      if (options['cStyleComments']) {
+        if (hc > 1) {  // multiline hash comments
+          shortcutStylePatterns.push(
+              [PR_COMMENT, /^#(?:##(?:[^#]|#(?!##))*(?:###|$)|.*)/, null, '#']);
+        } else {
+          // Stop C preprocessor declarations at an unclosed open comment
+          shortcutStylePatterns.push(
+              [PR_COMMENT, /^#(?:(?:define|elif|else|endif|error|ifdef|include|ifndef|line|pragma|undef|warning)\b|[^\r\n]*)/,
+               null, '#']);
+        }
+        // #include <stdio.h>
+        fallthroughStylePatterns.push(
+            [PR_STRING,
+             /^<(?:(?:(?:\.\.\/)*|\/?)(?:[\w-]+(?:\/[\w-]+)+)?[\w-]+\.h(?:h|pp|\+\+)?|[a-z]\w*)>/,
+             null]);
+      } else {
+        shortcutStylePatterns.push([PR_COMMENT, /^#[^\r\n]*/, null, '#']);
+      }
+    }
+    if (options['cStyleComments']) {
+      fallthroughStylePatterns.push([PR_COMMENT, /^\/\/[^\r\n]*/, null]);
+      fallthroughStylePatterns.push(
+          [PR_COMMENT, /^\/\*[\s\S]*?(?:\*\/|$)/, null]);
+    }
+    if (options['regexLiterals']) {
+      /**
+       * @const
+       */
+      var REGEX_LITERAL = (
+          // A regular expression literal starts with a slash that is
+          // not followed by * or / so that it is not confused with
+          // comments.
+          '/(?=[^/*])'
+          // and then contains any number of raw characters,
+          + '(?:[^/\\x5B\\x5C]'
+          // escape sequences (\x5C),
+          +    '|\\x5C[\\s\\S]'
+          // or non-nesting character sets (\x5B\x5D);
+          +    '|\\x5B(?:[^\\x5C\\x5D]|\\x5C[\\s\\S])*(?:\\x5D|$))+'
+          // finally closed by a /.
+          + '/');
+      fallthroughStylePatterns.push(
+          ['lang-regex',
+           new RegExp('^' + REGEXP_PRECEDER_PATTERN + '(' + REGEX_LITERAL + ')')
+           ]);
+    }
+
+    var types = options['types'];
+    if (types) {
+      fallthroughStylePatterns.push([PR_TYPE, types]);
+    }
+
+    if (options['strings']) {
+        var strings = ("" + options['strings']).replace(/^ | $/g, '').replace(/-/g, '\\-');
+        fallthroughStylePatterns.push(
+            [PR_STRING,
+            new RegExp('(?:' + strings.replace(/[\s,]+/g, '|') + ')'),
+            , null]
+        );
+    }
+    
+    var keywords = ("" + options['keywords']).replace(/^ | $/g, '');
+    if (keywords.length) {
+      fallthroughStylePatterns.push(
+          [PR_KEYWORD,
+           new RegExp('^(?:' + keywords.replace(/[\s,]+/g, '|') + ')\\b'),
+           null]);
+    }
+
+    shortcutStylePatterns.push([PR_PLAIN,       /^\s+/, null, ' \r\n\t\xA0']);
+    if (options['httpdComments']) {
+        fallthroughStylePatterns.push(
+            [PR_PLAIN,     /^.*\S.*#/i, null]
+        );
+    }
+    
+    fallthroughStylePatterns.push(
+        // TODO(mikesamuel): recognize non-latin letters and numerals in idents
+        [PR_LITERAL,     /^@[a-z_$][a-z_$@0-9]*|\bNULL\b/i, null],
+        [PR_LITERAL,     CONFIG_OPTIONS, null],
+        //[PR_STRING,     CONFIG_ENVS, null],
+        [PR_TAG,     /^\b(AuthzProviderAlias|AuthnProviderAlias|RequireAny|RequireAll|RequireNone|Directory|DirectoryMatch|Location|LocationMatch|VirtualHost|If|Else|ElseIf|Proxy\b|LoadBalancer|Files|FilesMatch|Limit|LimitExcept|IfDefine|IfModule|IfVersion)\b/, null],
+        [PR_TYPE,        /^(?:[@_]?[A-Z]+[a-z][A-Za-z_$@0-9]*|\w+_(t|req|module)\b)/, null],
+        [PR_TAG,     /^apr_[a-z_0-9]+|ap_[a-z_0-9]+/i, null],
+        [PR_PLAIN,       /^[a-z_$][a-z_$@0-9\-]*/i, null],
+        [PR_LITERAL,
+         new RegExp(
+             '^(?:'
+             // A hex number
+             + '0x[a-f0-9]+'
+             // An IPv6 Address
+             + '|[a-f0-9:]+:[a-f0-9:]+:[a-f0-9:]+:[a-f0-9:]+:[a-f0-9:]+:[a-f0-9:]+'
+             // or an octal or decimal number,
+             + '|(?:\\d(?:_\\d+)*\\d*(?:\\.\\d*)?|\\.\\d\\+)'
+             // possibly in scientific notation
+             + '(?:e[+\\-]?\\d+)?'
+             + ')'
+             // with an optional modifier like UL for unsigned long
+             + '[a-z]*', 'i'),
+         null, '0123456789'],
+        // Don't treat escaped quotes in bash as starting strings.  See issue 144.
+        [PR_PLAIN,       /^\\[\s\S]?/, null],
+        [PR_PUNCTUATION, /^.[^\s\w\.$@\'\"\`\/\#\\]*/, null]);
+
+    return createSimpleLexer(shortcutStylePatterns, fallthroughStylePatterns);
+  }
+
+  var decorateSource = sourceDecorator({
+        'keywords': ALL_KEYWORDS,
+        'hashComments': true,
+        'cStyleComments': true,
+        'multiLineStrings': true,
+        'regexLiterals': true
+      });
+
+  /**
+   * Given a DOM subtree, wraps it in a list, and puts each line into its own
+   * list item.
+   *
+   * @param {Node} node modified in place.  Its content is pulled into an
+   *     HTMLOListElement, and each line is moved into a separate list item.
+   *     This requires cloning elements, so the input might not have unique
+   *     IDs after numbering.
+   * @param {boolean} isPreformatted true iff white-space in text nodes should
+   *     be treated as significant.
+   */
+  function numberLines(node, opt_startLineNum, isPreformatted) {
+    var nocode = /(?:^|\s)nocode(?:\s|$)/;
+    var lineBreak = /\r\n?|\n/;
+  
+    var document = node.ownerDocument;
+  
+    var li = document.createElement('li');
+    while (node.firstChild) {
+      li.appendChild(node.firstChild);
+    }
+    // An array of lines.  We split below, so this is initialized to one
+    // un-split line.
+    var listItems = [li];
+  
+    function walk(node) {
+      switch (node.nodeType) {
+        case 1:  // Element
+          if (nocode.test(node.className)) { break; }
+          if ('br' === node.nodeName) {
+            breakAfter(node);
+            // Discard the <BR> since it is now flush against a </LI>.
+            if (node.parentNode) {
+              node.parentNode.removeChild(node);
+            }
+          } else {
+            for (var child = node.firstChild; child; child = child.nextSibling) {
+              walk(child);
+            }
+          }
+          break;
+        case 3: case 4:  // Text
+          if (isPreformatted) {
+            var text = node.nodeValue;
+            var match = text.match(lineBreak);
+            if (match) {
+              var firstLine = text.substring(0, match.index);
+              node.nodeValue = firstLine;
+              var tail = text.substring(match.index + match[0].length);
+              if (tail) {
+                var parent = node.parentNode;
+                parent.insertBefore(
+                    document.createTextNode(tail), node.nextSibling);
+              }
+              breakAfter(node);
+              if (!firstLine) {
+                // Don't leave blank text nodes in the DOM.
+                node.parentNode.removeChild(node);
+              }
+            }
+          }
+          break;
+      }
+    }
+  
+    // Split a line after the given node.
+    function breakAfter(lineEndNode) {
+      // If there's nothing to the right, then we can skip ending the line
+      // here, and move root-wards since splitting just before an end-tag
+      // would require us to create a bunch of empty copies.
+      while (!lineEndNode.nextSibling) {
+        lineEndNode = lineEndNode.parentNode;
+        if (!lineEndNode) { return; }
+      }
+  
+      function breakLeftOf(limit, copy) {
+        // Clone shallowly if this node needs to be on both sides of the break.
+        var rightSide = copy ? limit.cloneNode(false) : limit;
+        var parent = limit.parentNode;
+        if (parent) {
+          // We clone the parent chain.
+          // This helps us resurrect important styling elements that cross lines.
+          // E.g. in <i>Foo<br>Bar</i>
+          // should be rewritten to <li><i>Foo</i></li><li><i>Bar</i></li>.
+          var parentClone = breakLeftOf(parent, 1);
+          // Move the clone and everything to the right of the original
+          // onto the cloned parent.
+          var next = limit.nextSibling;
+          parentClone.appendChild(rightSide);
+          for (var sibling = next; sibling; sibling = next) {
+            next = sibling.nextSibling;
+            parentClone.appendChild(sibling);
+          }
+        }
+        return rightSide;
+      }
+  
+      var copiedListItem = breakLeftOf(lineEndNode.nextSibling, 0);
+  
+      // Walk the parent chain until we reach an unattached LI.
+      for (var parent;
+           // Check nodeType since IE invents document fragments.
+           (parent = copiedListItem.parentNode) && parent.nodeType === 1;) {
+        copiedListItem = parent;
+      }
+      // Put it on the list of lines for later processing.
+      listItems.push(copiedListItem);
+    }
+  
+    // Split lines while there are lines left to split.
+    for (var i = 0;  // Number of lines that have been split so far.
+         i < listItems.length;  // length updated by breakAfter calls.
+         ++i) {
+      walk(listItems[i]);
+    }
+  
+    // Make sure numeric indices show correctly.
+    if (opt_startLineNum === (opt_startLineNum|0)) {
+      listItems[0].setAttribute('value', opt_startLineNum);
+    }
+  
+    var ol = document.createElement('ol');
+    ol.className = 'linenums';
+    var offset = Math.max(0, ((opt_startLineNum - 1 /* zero index */)) | 0) || 0;
+    for (var i = 0, n = listItems.length; i < n; ++i) {
+      li = listItems[i];
+      // Stick a class on the LIs so that stylesheets can
+      // color odd/even rows, or any other row pattern that
+      // is co-prime with 10.
+      li.className = 'L' + ((i + offset) % 1);
+      if (!li.firstChild) {
+        li.appendChild(document.createTextNode('\xA0'));
+      }
+      ol.appendChild(li);
+    }
+  
+    node.appendChild(ol);
+  }
+
+  /**
+   * Breaks {@code job.sourceCode} around style boundaries in
+   * {@code job.decorations} and modifies {@code job.sourceNode} in place.
+   * @param {Object} job like <pre>{
+   *    sourceCode: {string} source as plain text,
+   *    spans: {Array.<number|Node>} alternating span start indices into source
+   *       and the text node or element (e.g. {@code <BR>}) corresponding to that
+   *       span.
+   *    decorations: {Array.<number|string} an array of style classes preceded
+   *       by the position at which they start in job.sourceCode in order
+   * }</pre>
+   * @private
+   */
+  function recombineTagsAndDecorations(job) {
+    var isIE8OrEarlier = /\bMSIE\s(\d+)/.exec(navigator.userAgent);
+    isIE8OrEarlier = isIE8OrEarlier && +isIE8OrEarlier[1] <= 8;
+    var newlineRe = /\n/g;
+  
+    var source = job.sourceCode;
+    var sourceLength = source.length;
+    // Index into source after the last code-unit recombined.
+    var sourceIndex = 0;
+  
+    var spans = job.spans;
+    var nSpans = spans.length;
+    // Index into spans after the last span which ends at or before sourceIndex.
+    var spanIndex = 0;
+  
+    var decorations = job.decorations;
+    var nDecorations = decorations.length;
+    // Index into decorations after the last decoration which ends at or before
+    // sourceIndex.
+    var decorationIndex = 0;
+  
+    // Remove all zero-length decorations.
+    decorations[nDecorations] = sourceLength;
+    var decPos, i;
+    for (i = decPos = 0; i < nDecorations;) {
+      if (decorations[i] !== decorations[i + 2]) {
+        decorations[decPos++] = decorations[i++];
+        decorations[decPos++] = decorations[i++];
+      } else {
+        i += 2;
+      }
+    }
+    nDecorations = decPos;
+  
+    // Simplify decorations.
+    for (i = decPos = 0; i < nDecorations;) {
+      var startPos = decorations[i];
+      // Conflate all adjacent decorations that use the same style.
+      var startDec = decorations[i + 1];
+      var end = i + 2;
+      while (end + 2 <= nDecorations && decorations[end + 1] === startDec) {
+        end += 2;
+      }
+      decorations[decPos++] = startPos;
+      decorations[decPos++] = startDec;
+      i = end;
+    }
+  
+    nDecorations = decorations.length = decPos;
+  
+    var sourceNode = job.sourceNode;
+    var oldDisplay;
+    if (sourceNode) {
+      oldDisplay = sourceNode.style.display;
+      sourceNode.style.display = 'none';
+    }
+    try {
+      var decoration = null;
+      var X = 0;
+      while (spanIndex < nSpans) {
+        X = X + 1;
+        if (X > 5000) { break; }
+        var spanStart = spans[spanIndex];
+        var spanEnd = spans[spanIndex + 2] || sourceLength;
+  
+        var decEnd = decorations[decorationIndex + 2] || sourceLength;
+  
+        var end = Math.min(spanEnd, decEnd);
+  
+        var textNode = spans[spanIndex + 1];
+        var styledText;
+        if (textNode.nodeType !== 1  // Don't muck with <BR>s or <LI>s
+            // Don't introduce spans around empty text nodes.
+            && (styledText = source.substring(sourceIndex, end))) {
+          // This may seem bizarre, and it is.  Emitting LF on IE causes the
+          // code to display with spaces instead of line breaks.
+          // Emitting Windows standard issue linebreaks (CRLF) causes a blank
+          // space to appear at the beginning of every line but the first.
+          // Emitting an old Mac OS 9 line separator makes everything spiffy.
+          if (isIE8OrEarlier) {
+            styledText = styledText.replace(newlineRe, '\r');
+          }
+          textNode.nodeValue = styledText;
+          var document = textNode.ownerDocument;
+          var span = document.createElement('span');
+          span.className = decorations[decorationIndex + 1];
+          var parentNode = textNode.parentNode;
+          parentNode.replaceChild(span, textNode);
+          span.appendChild(textNode);
+          if (sourceIndex < spanEnd) {  // Split off a text node.
+            spans[spanIndex + 1] = textNode
+                // TODO: Possibly optimize by using '' if there's no flicker.
+                = document.createTextNode(source.substring(end, spanEnd));
+            parentNode.insertBefore(textNode, span.nextSibling);
+          }
+        }
+  
+        sourceIndex = end;
+  
+        if (sourceIndex >= spanEnd) {
+          spanIndex += 2;
+        }
+        if (sourceIndex >= decEnd) {
+          decorationIndex += 2;
+        }
+      }
+    } finally {
+      if (sourceNode) {
+        sourceNode.style.display = oldDisplay;
+      }
+    }
+  }
+
+
+  /** Maps language-specific file extensions to handlers. */
+  var langHandlerRegistry = {};
+  /** Register a language handler for the given file extensions.
+    * @param {function (Object)} handler a function from source code to a list
+    *      of decorations.  Takes a single argument job which describes the
+    *      state of the computation.   The single parameter has the form
+    *      {@code {
+    *        sourceCode: {string} as plain text.
+    *        decorations: {Array.<number|string>} an array of style classes
+    *                     preceded by the position at which they start in
+    *                     job.sourceCode in order.
+    *                     The language handler should assigned this field.
+    *        basePos: {int} the position of source in the larger source chunk.
+    *                 All positions in the output decorations array are relative
+    *                 to the larger source chunk.
+    *      } }
+    * @param {Array.<string>} fileExtensions
+    */
+  function registerLangHandler(handler, fileExtensions) {
+    for (var i = fileExtensions.length; --i >= 0;) {
+      var ext = fileExtensions[i];
+      if (!langHandlerRegistry.hasOwnProperty(ext)) {
+        langHandlerRegistry[ext] = handler;
+      } else if (win['console']) {
+        console['warn']('cannot override language handler %s', ext);
+      }
+    }
+  }
+  function langHandlerForExtension(extension, source) {
+    if (!(extension && langHandlerRegistry.hasOwnProperty(extension))) {
+      // Treat it as markup if the first non whitespace character is a < and
+      // the last non-whitespace character is a >.
+      extension = /^\s*</.test(source)
+          ? 'default-markup'
+          : 'default-code';
+    }
+    return langHandlerRegistry[extension];
+  }
+  registerLangHandler(decorateSource, ['default-code']);
+  registerLangHandler(
+      createSimpleLexer(
+          [],
+          [
+           [PR_PLAIN,       /^[^<?]+/],
+           [PR_DECLARATION, /^<!\w[^>]*(?:>|$)/],
+           [PR_COMMENT,     /^<\!--[\s\S]*?(?:-\->|$)/],
+           // Unescaped content in an unknown language
+           ['lang-',        /^<\?([\s\S]+?)(?:\?>|$)/],
+           ['lang-',        /^<%([\s\S]+?)(?:%>|$)/],
+           [PR_PUNCTUATION, /^(?:<[%?]|[%?]>)/],
+           ['lang-',        /^<xmp\b[^>]*>([\s\S]+?)<\/xmp\b[^>]*>/i],
+           // Unescaped content in javascript.  (Or possibly vbscript).
+           ['lang-js',      /^<script\b[^>]*>([\s\S]*?)(<\/script\b[^>]*>)/i],
+           // Contains unescaped stylesheet content
+           ['lang-css',     /^<style\b[^>]*>([\s\S]*?)(<\/style\b[^>]*>)/i],
+           ['lang-in.tag',  /^(<\/?[a-z][^<>]*>)/i]
+          ]),
+      ['default-markup', 'htm', 'html', 'mxml', 'xhtml', 'xml', 'xsl']);
+  registerLangHandler(
+      createSimpleLexer(
+          [
+           [PR_PLAIN,        /^[\s]+/, null, ' \t\r\n'],
+           [PR_ATTRIB_VALUE, /^(?:\"[^\"]*\"?|\'[^\']*\'?)/, null, '\"\'']
+           ],
+          [
+           [PR_TAG,          /^^<\/?[a-z](?:[\w.:-]*\w)?|\/?>$/i],
+           [PR_ATTRIB_NAME,  /^(?!style[\s=]|on)[a-z](?:[\w:-]*\w)?/i],
+           ['lang-uq.val',   /^=\s*([^>\'\"\s]*(?:[^>\'\"\s\/]|\/(?=\s)))/],
+           [PR_PUNCTUATION,  /^[=<>\/]+/],
+           ['lang-js',       /^on\w+\s*=\s*\"([^\"]+)\"/i],
+           ['lang-js',       /^on\w+\s*=\s*\'([^\']+)\'/i],
+           ['lang-js',       /^on\w+\s*=\s*([^\"\'>\s]+)/i],
+           ['lang-css',      /^style\s*=\s*\"([^\"]+)\"/i],
+           ['lang-css',      /^style\s*=\s*\'([^\']+)\'/i],
+           ['lang-css',      /^style\s*=\s*([^\"\'>\s]+)/i]
+           ]),
+      ['in.tag']);
+  registerLangHandler(
+      createSimpleLexer([], [[PR_ATTRIB_VALUE, /^[\s\S]+/]]), ['uq.val']);
+  registerLangHandler(sourceDecorator({
+          'keywords': CPP_KEYWORDS,
+          'hashComments': true,
+          'cStyleComments': true,
+          'types': C_TYPES
+        }), ['c', 'cc', 'cpp', 'cxx', 'cyc', 'm']);
+  registerLangHandler(sourceDecorator({
+          'keywords': PHP_KEYWORDS,
+          'hashComments': false,
+          'cStyleComments': true,
+          'multiLineStrings': true,
+          'regexLiterals': true
+//          'types': C_TYPES,
+        }), ['php', 'phtml', 'inc']);
+  registerLangHandler(sourceDecorator({
+          'keywords': 'null,true,false'
+        }), ['json']);
+  registerLangHandler(sourceDecorator({
+          'keywords': CSHARP_KEYWORDS,
+          'hashComments': true,
+          'cStyleComments': true,
+          'verbatimStrings': true,
+          'types': C_TYPES
+        }), ['cs']);
+  registerLangHandler(sourceDecorator({
+          'keywords': JAVA_KEYWORDS,
+          'cStyleComments': true
+        }), ['java']);
+  registerLangHandler(sourceDecorator({
+          'keywords': SH_KEYWORDS,
+          'hashComments': true,
+          'multiLineStrings': true
+        }), ['bsh', 'csh', 'sh']);
+  registerLangHandler(sourceDecorator({
+          'keywords': PYTHON_KEYWORDS,
+          'hashComments': true,
+          'multiLineStrings': true,
+          'tripleQuotedStrings': true
+        }), ['cv', 'py']);
+  registerLangHandler(sourceDecorator({
+          'keywords': PERL_KEYWORDS,
+          'hashComments': true,
+          'multiLineStrings': true,
+          'regexLiterals': true
+        }), ['perl', 'pl', 'pm']);
+  registerLangHandler(sourceDecorator({
+          'keywords': RUBY_KEYWORDS,
+          'hashComments': true,
+          'multiLineStrings': true,
+          'regexLiterals': true
+        }), ['rb']);
+  registerLangHandler(sourceDecorator({
+          'keywords': JSCRIPT_KEYWORDS,
+          'cStyleComments': true,
+          'regexLiterals': true
+        }), ['js']);
+  registerLangHandler(sourceDecorator({
+          'keywords': COFFEE_KEYWORDS,
+          'hashComments': 3,  // ### style block comments
+          'cStyleComments': true,
+          'multilineStrings': true,
+          'tripleQuotedStrings': true,
+          'regexLiterals': true
+        }), ['coffee']);
+  registerLangHandler(
+      createSimpleLexer([], [[PR_STRING, /^[\s\S]+/]]), ['regex']);
+  registerLangHandler(sourceDecorator({
+          'keywords': CONFIG_KEYWORDS,
+          'literals': CONFIG_OPTIONS,
+          'strings': CONFIG_ENVS,
+          'hashComments': true,
+          'cStyleComments': false,
+          'multiLineStrings': false,
+          'regexLiterals': false,
+          'httpdComments': true
+        }), ['config']);
+
+  function applyDecorator(job) {
+    var opt_langExtension = job.langExtension;
+
+    try {
+      // Extract tags, and convert the source code to plain text.
+      var sourceAndSpans = extractSourceSpans(job.sourceNode, job.pre);
+      /** Plain text. @type {string} */
+      var source = sourceAndSpans.sourceCode;
+      job.sourceCode = source;
+      job.spans = sourceAndSpans.spans;
+      job.basePos = 0;
+
+      // Apply the appropriate language handler
+      langHandlerForExtension(opt_langExtension, source)(job);
+
+      // Integrate the decorations and tags back into the source code,
+      // modifying the sourceNode in place.
+      recombineTagsAndDecorations(job);
+    } catch (e) {
+      if (win['console']) {
+        console['log'](e && e['stack'] ? e['stack'] : e);
+      }
+    }
+  }
+
+  /**
+   * @param sourceCodeHtml {string} The HTML to pretty print.
+   * @param opt_langExtension {string} The language name to use.
+   *     Typically, a filename extension like 'cpp' or 'java'.
+   * @param opt_numberLines {number|boolean} True to number lines,
+   *     or the 1-indexed number of the first line in sourceCodeHtml.
+   */
+  function prettyPrintOne(sourceCodeHtml, opt_langExtension, opt_numberLines) {
+    var container = document.createElement('pre');
+    // This could cause images to load and onload listeners to fire.
+    // E.g. <img onerror="alert(1337)" src="nosuchimage.png">.
+    // We assume that the inner HTML is from a trusted source.
+    container.innerHTML = sourceCodeHtml;
+    if (opt_numberLines) {
+      numberLines(container, opt_numberLines, true);
+    }
+
+    var job = {
+      langExtension: opt_langExtension,
+      numberLines: opt_numberLines,
+      sourceNode: container,
+      pre: 1
+    };
+    applyDecorator(job);
+    return container.innerHTML;
+  }
+
+  function prettyPrint(opt_whenDone) {
+    function byTagName(tn) { return document.getElementsByTagName(tn); }
+    // fetch a list of nodes to rewrite
+    var codeSegments = [byTagName('pre'), byTagName('code'), byTagName('xmp')];
+    var elements = [];
+    for (var i = 0; i < codeSegments.length; ++i) {
+      for (var j = 0, n = codeSegments[i].length; j < n; ++j) {
+        elements.push(codeSegments[i][j]);
+      }
+    }
+    codeSegments = null;
+
+    var clock = Date;
+    if (!clock['now']) {
+      clock = { 'now': function () { return +(new Date); } };
+    }
+
+    // The loop is broken into a series of continuations to make sure that we
+    // don't make the browser unresponsive when rewriting a large page.
+    var k = 0;
+    var prettyPrintingJob;
+
+    var langExtensionRe = /\blang(?:uage)?-([\w.]+)(?!\S)/;
+    var prettyPrintRe = /\bprettyprint\b/;
+    var prettyPrintedRe = /\bprettyprinted\b/;
+    var preformattedTagNameRe = /pre|xmp/i;
+    var codeRe = /^code$/i;
+    var preCodeXmpRe = /^(?:pre|code|xmp)$/i;
+
+    function doWork() {
+      var endTime = (win['PR_SHOULD_USE_CONTINUATION'] ?
+                     clock['now']() + 250 /* ms */ :
+                     Infinity);
+      for (; k < elements.length && clock['now']() < endTime; k++) {
+        var cs = elements[k];
+        var className = cs.className;
+        if (prettyPrintRe.test(className)
+            // Don't redo this if we've already done it.
+            // This allows recalling pretty print to just prettyprint elements
+            // that have been added to the page since last call.
+            && !prettyPrintedRe.test(className)) {
+
+          // make sure this is not nested in an already prettified element
+          var nested = false;
+          for (var p = cs.parentNode; p; p = p.parentNode) {
+            var tn = p.tagName;
+            if (preCodeXmpRe.test(tn)
+                && p.className && prettyPrintRe.test(p.className)) {
+              nested = true;
+              break;
+            }
+          }
+          if (!nested) {
+            // Mark done.  If we fail to prettyprint for whatever reason,
+            // we shouldn't try again.
+            cs.className += ' prettyprinted';
+
+            // If the classes includes a language extensions, use it.
+            // Language extensions can be specified like
+            //     <pre class="prettyprint lang-cpp">
+            // the language extension "cpp" is used to find a language handler
+            // as passed to PR.registerLangHandler.
+            // HTML5 recommends that a language be specified using "language-"
+            // as the prefix instead.  Google Code Prettify supports both.
+            // http://dev.w3.org/html5/spec-author-view/the-code-element.html
+            var langExtension = className.match(langExtensionRe);
+            // Support <pre class="prettyprint"><code class="language-c">
+            var wrapper;
+            if (!langExtension && (wrapper = childContentWrapper(cs))
+                && codeRe.test(wrapper.tagName)) {
+              langExtension = wrapper.className.match(langExtensionRe);
+            }
+
+            if (langExtension) { langExtension = langExtension[1]; }
+
+            var preformatted;
+            if (preformattedTagNameRe.test(cs.tagName)) {
+              preformatted = 1;
+            } else {
+              var currentStyle = cs['currentStyle'];
+              var whitespace = (
+                  currentStyle
+                  ? currentStyle['whiteSpace']
+                  : (document.defaultView
+                     && document.defaultView.getComputedStyle)
+                  ? document.defaultView.getComputedStyle(cs, null)
+                  .getPropertyValue('white-space')
+                  : 0);
+              preformatted = whitespace
+                  && 'pre' === whitespace.substring(0, 3);
+            }
+
+            // Look for a class like linenums or linenums:<n> where <n> is the
+            // 1-indexed number of the first line.
+            var lineNums = cs.className.match(/\blinenums\b(?::(\d+))?/);
+            lineNums = lineNums
+                ? lineNums[1] && lineNums[1].length ? +lineNums[1] : true
+                : false;
+            if (lineNums) { numberLines(cs, lineNums, preformatted); }
+
+            // do the pretty printing
+            prettyPrintingJob = {
+              langExtension: langExtension,
+              sourceNode: cs,
+              numberLines: lineNums,
+              pre: preformatted
+            };
+            applyDecorator(prettyPrintingJob);
+          }
+        }
+      }
+      if (k < elements.length) {
+        // finish up in a continuation
+        setTimeout(doWork, 250);
+      } else if (opt_whenDone) {
+        opt_whenDone();
+      }
+    }
+
+    doWork();
+  }
+
+  /**
+   * Contains functions for creating and registering new language handlers.
+   * @type {Object}
+   */
+  var PR = win['PR'] = {
+        'createSimpleLexer': createSimpleLexer,
+        'registerLangHandler': registerLangHandler,
+        'sourceDecorator': sourceDecorator,
+        'PR_ATTRIB_NAME': PR_ATTRIB_NAME,
+        'PR_ATTRIB_VALUE': PR_ATTRIB_VALUE,
+        'PR_COMMENT': PR_COMMENT,
+        'PR_DECLARATION': PR_DECLARATION,
+        'PR_KEYWORD': PR_KEYWORD,
+        'PR_LITERAL': PR_LITERAL,
+        'PR_NOCODE': PR_NOCODE,
+        'PR_PLAIN': PR_PLAIN,
+        'PR_PUNCTUATION': PR_PUNCTUATION,
+        'PR_SOURCE': PR_SOURCE,
+        'PR_STRING': PR_STRING,
+        'PR_TAG': PR_TAG,
+        'PR_TYPE': PR_TYPE,
+        'prettyPrintOne': win['prettyPrintOne'] = prettyPrintOne,
+        'prettyPrint': win['prettyPrint'] = prettyPrint
+      };
+   
+
+/* Register Lua syntaxes */   
+   PR['registerLangHandler'](
+    PR['createSimpleLexer'](
+        [
+         // Whitespace
+         [PR['PR_PLAIN'],       /^[\t\n\r \xA0]+/, null, '\t\n\r \xA0'],
+         // A double or single quoted, possibly multi-line, string.
+         [PR['PR_STRING'],      /^(?:\"(?:[^\"\\]|\\[\s\S])*(?:\"|$)|\'(?:[^\'\\]|\\[\s\S])*(?:\'|$))/, null, '"\'']
+        ],
+        [
+         // A comment is either a line comment that starts with two dashes, or
+         // two dashes preceding a long bracketed block.
+         [PR['PR_COMMENT'], /^--(?:\[(=*)\[[\s\S]*?(?:\]\1\]|$)|[^\r\n]*)/],
+         [PR['PR_TYPE'], /^nil|false|true/],
+         // A long bracketed block not preceded by -- is a string.
+         [PR['PR_STRING'],  /^\[(=*)\[[\s\S]*?(?:\]\1\]|$)/],
+         [PR['PR_KEYWORD'], /^(?:and|break|do|else|elseif|end|for|function|if|in|local|not|or|repeat|require|return|then|until|while)\b/, null],
+         // A number is a hex integer literal, a decimal real literal, or in
+         // scientific notation.
+         [PR['PR_LITERAL'],
+          /^[+-]?(?:0x[\da-f]+|(?:(?:\.\d+|\d+(?:\.\d*)?)(?:e[+\-]?\d+)?))/i],
+         // An identifier
+         [PR['PR_PLAIN'], /^[a-z_]\w*/i],
+         // A run of punctuation
+         [PR['PR_PUNCTUATION'], /^[^\w\t\n\r \xA0][^\w\t\n\r \xA0\"\'\-\+=]*/]
+        ]),
+    ['lua']);
+
+
+  // Make PR available via the Asynchronous Module Definition (AMD) API.
+  // Per https://github.com/amdjs/amdjs-api/wiki/AMD:
+  // The Asynchronous Module Definition (AMD) API specifies a
+  // mechanism for defining modules such that the module and its
+  // dependencies can be asynchronously loaded.
+  // ...
+  // To allow a clear indicator that a global define function (as
+  // needed for script src browser loading) conforms to the AMD API,
+  // any global define function SHOULD have a property called "amd"
+  // whose value is an object. This helps avoid conflict with any
+  // other existing JavaScript code that could have defined a define()
+  // function that does not conform to the AMD API.
+  if (typeof define === "function" && define['amd']) {
+    define("google-code-prettify", [], function () {
+      return PR; 
+    });
+  }
+})();
diff --git a/docs/manual/style/scripts/prettify.min.js b/docs/manual/style/scripts/prettify.min.js
new file mode 100644
index 0000000..4f0f9f5
--- /dev/null
+++ b/docs/manual/style/scripts/prettify.min.js
@@ -0,0 +1,123 @@
+// see prettify.js for copyright, license and expanded version
+window['PR_SHOULD_USE_CONTINUATION']=true;var prettyPrintOne;var prettyPrint;(function(){var win=window;var FLOW_CONTROL_KEYWORDS=["break,continue,do,else,for,if,return,while"];var C_KEYWORDS=[FLOW_CONTROL_KEYWORDS,"auto,case,char,const,default,"+"double,enum,extern,float,goto,int,long,register,short,signed,sizeof,module,"+"static,struct,switch,typedef,union,unsigned,void,volatile"];var COMMON_KEYWORDS=[C_KEYWORDS,"catch,class,delete,false,import,"+"new,operator,private,protected,public,this,throw,true,try,typeof"];var CPP_KEYWORDS=[COMMON_KEYWORDS,"alignof,align_union,asm,axiom,bool,"+"concept,concept_map,const_cast,constexpr,decltype,"+"dynamic_cast,explicit,export,friend,inline,late_check,"+"mutable,namespace,nullptr,reinterpret_cast,static_assert,static_cast,"+"template,typeid,typename,using,virtual,where,request_req"];var JAVA_KEYWORDS=[COMMON_KEYWORDS,"abstract,boolean,byte,extends,final,finally,implements,import,"+"instanceof,null,native,package,strictfp,super,synchronized,throws,"+"transient"];var CSHARP_KEYWORDS=[JAVA_KEYWORDS,"as,base,by,checked,decimal,delegate,descending,dynamic,event,"+"fixed,foreach,from,group,implicit,in,interface,internal,into,is,let,"+"lock,object,out,override,orderby,params,partial,readonly,ref,sbyte,"+"sealed,stackalloc,string,select,uint,ulong,unchecked,unsafe,ushort,"+"var,virtual,where"];var COFFEE_KEYWORDS="all,and,by,catch,class,else,extends,false,finally,"+"for,if,in,is,isnt,loop,new,no,not,null,of,off,on,or,return,super,then,"+"throw,true,try,unless,until,when,while,yes";var JSCRIPT_KEYWORDS=[COMMON_KEYWORDS,"debugger,eval,export,function,get,null,set,undefined,var,with,"+"Infinity,NaN"];var PERL_KEYWORDS="caller,delete,die,do,dump,else,elsif,eval,exit,foreach,for,"+"goto,if,import,last,local,my,next,no,our,print,printf,package,redo,require,"+"sub,undef,unless,until,use,wantarray,while,BEGIN,END";var PHP_KEYWORDS="abstract,and,array,as,break,case,catch,cfunction,class,"+"clone,const,continue,declare,default,do,else,elseif,enddeclare,endfor,"+"endforeach,endif,endswitch,endwhile,extends,final,for,foreach,function,"+"global,goto,if,implements,interface,instanceof,namespace,new,old_function,"+"or,private,protected,public,static,switch,throw,try,use,var,while,xor,"+"die,echo,empty,exit,eval,include,include_once,isset,list,require,"+"require_once,return,print,unset";var PYTHON_KEYWORDS=[FLOW_CONTROL_KEYWORDS,"and,as,assert,class,def,del,"+"elif,except,exec,finally,from,global,import,in,is,lambda,"+"nonlocal,not,or,pass,print,raise,try,with,yield,"+"False,True,None"];var RUBY_KEYWORDS=[FLOW_CONTROL_KEYWORDS,"alias,and,begin,case,class,"+"def,defined,elsif,end,ensure,false,in,module,next,nil,not,or,redo,"+"rescue,retry,self,super,then,true,undef,unless,until,when,yield,"+"BEGIN,END"];var SH_KEYWORDS=[FLOW_CONTROL_KEYWORDS,"case,done,elif,esac,eval,fi,"+"function,in,local,set,then,until,echo"];var CONFIG_ENVS=["User-Agent,HTTP_USER_AGENT,HTTP_REFERER,HTTP_COOKIE,HTTP_FORWARDED,HTTP_HOST,HTTP_PROXY_CONNECTION,HTTP_ACCEPT,REMOTE_ADDR,REMOTE_HOST,REMOTE_PORT,REMOTE_USER,REMOTE_IDENT,REQUEST_METHOD,SCRIPT_FILENAME,PATH_INFO,QUERY_STRING,AUTH_TYPE,DOCUMENT_ROOT,SERVER_ADMIN,SERVER_NAME,SERVER_ADDR,SERVER_PORT,SERVER_PROTOCOL,SERVER_SOFTWARE,TIME_YEAR,TIME_MON,TIME_DAY,TIME_HOUR,TIME_MIN,TIME_SEC,TIME_WDAY,TIME,API_VERSION,THE_REQUEST,REQUEST_URI,REQUEST_FILENAME,IS_SUBREQ,HTTPS,REQUEST_SCHEME"];var CONFIG_KEYWORDS=["Macro,UndefMacro,Use,AuthLDAPURL,AcceptFilter,AcceptPathInfo,AccessFileName,Action,AddAlt,AddAltByEncoding,AddAltByType,AddCharset,AddDefaultCharset,AddDescription,AddEncoding,AddHandler,AddIcon,AddIconByEncoding,AddIconByType,AddInputFilter,AddLanguage,AddModuleInfo,AddOutputFilter,AddOutputFilterByType,AddType,Alias,AliasMatch,Allow,AllowCONNECT,AllowEncodedSlashes,AllowMethods,AllowOverride,AllowOverrideList,Anonymous,Anonymous_LogEmail,Anonymous_MustGiveEmail,Anonymous_NoUserID,Anonymous_VerifyEmail,AsyncRequestWorkerFactor,AuthBasicAuthoritative,AuthBasicProvider,AuthDBDUserPWQuery,AuthDBDUserRealmQuery,AuthDBMGroupFile,AuthDBMType,AuthDBMUserFile,AuthDigestAlgorithm,AuthDigestDomain,AuthDigestNcCheck,AuthDigestNonceFormat,AuthDigestNonceLifetime,AuthDigestProvider,AuthDigestQop,AuthDigestShmemSize,AuthFormAuthoritative,AuthFormBody,AuthFormDisableNoStore,AuthFormFakeBasicAuth,AuthFormLocation,AuthFormLoginRequiredLocation,AuthFormLoginSuccessLocation,AuthFormLogoutLocation,AuthFormMethod,AuthFormMimetype,AuthFormPassword,AuthFormProvider,AuthFormSitePassphrase,AuthFormSize,AuthFormUsername,AuthGroupFile,AuthLDAPAuthorizePrefix,AuthLDAPBindAuthoritative,AuthLDAPBindDN,AuthLDAPBindPassword,AuthLDAPCharsetConfig,AuthLDAPCompareAsUser,AuthLDAPCompareDNOnServer,AuthLDAPDereferenceAliases,AuthLDAPGroupAttribute,AuthLDAPGroupAttributeIsDN,AuthLDAPInitialBindAsUser,AuthLDAPInitialBindPattern,AuthLDAPMaxSubGroupDepth,AuthLDAPRemoteUserAttribute,AuthLDAPRemoteUserIsDN,AuthLDAPSearchAsUser,AuthLDAPSubGroupAttribute,AuthLDAPSubGroupClass,AuthLDAPUrl,AuthMerging,AuthName,AuthnCacheContext,AuthnCacheEnable,AuthnCacheProvideFor,AuthnCacheSOCache,AuthnCacheTimeout,<AuthnProviderAlias>,AuthType,AuthUserFile,AuthzDBDLoginToReferer,AuthzDBDQuery,AuthzDBDRedirectQuery,AuthzDBMType,<AuthzProviderAlias>,AuthzSendForbiddenOnFailure,BalancerGrowth,BalancerMember,BrowserMatch,BrowserMatchNoCase,BufferedLogs,BufferSize,CacheDefaultExpire,CacheDetailHeader,CacheDirLength,CacheDirLevels,CacheDisable,CacheEnable,CacheFile,CacheHeader,CacheIgnoreCacheControl,CacheIgnoreHeaders,CacheIgnoreNoLastMod,CacheIgnoreQueryString,CacheIgnoreURLSessionIdentifiers,CacheKeyBaseURL,CacheLastModifiedFactor,CacheLock,CacheLockMaxAge,CacheLockPath,CacheMaxExpire,CacheMaxFileSize,CacheMinExpire,CacheMinFileSize,CacheNegotiatedDocs,CacheQuickHandler,CacheReadSize,CacheReadTime,CacheRoot,CacheStaleOnError,CacheStoreExpired,CacheStoreNoStore,CacheStorePrivate,CGIMapExtension,CharsetDefault,CharsetOptions,CharsetSourceEnc,CheckCaseOnly,CheckSpelling,ChrootDir,ContentDigest,CookieDomain,CookieExpires,CookieName,CookieStyle,CookieTracking,CoreDumpDirectory,CustomLog,Dav,DavDepthInfinity,DavGenericLockDB,DavLockDB,DavMinTimeout,DBDExptime,DBDInitSQL,DBDKeep,DBDMax,DBDMin,DBDParams,DBDPersist,DBDPrepareSQL,DBDriver,DefaultIcon,DefaultLanguage,DefaultRuntimeDir,DefaultType,Define,DeflateBufferSize,DeflateCompressionLevel,DeflateFilterNote,DeflateMemLevel,DeflateWindowSize,Deny,<Directory>,DirectoryIndex,DirectoryIndexRedirect,<DirectoryMatch>,DirectorySlash,DocumentRoot,DTracePrivileges,DumpIOInput,DumpIOOutput,<Else>,<ElseIf>,EnableExceptionHook,EnableMMAP,EnableSendfile,Error,ErrorDocument,ErrorLog,ErrorLogFormat,Example,ExpiresActive,ExpiresByType,ExpiresDefault,ExtendedStatus,ExtFilterDefine,ExtFilterOptions,FallbackResource,FileETag,<Files>,<FilesMatch>,FilterChain,FilterDeclare,FilterProtocol,FilterProvider,FilterTrace,ForceLanguagePriority,ForceType,ForensicLog,GprofDir,GracefulShutdownTimeout,Group,Header,HeaderName,HeartbeatAddress,HeartbeatListen,HeartbeatMaxServers,HeartbeatStorage,HeartbeatStorage,HostnameLookups,IdentityCheck,IdentityCheckTimeout,<If>,<IfDefine>,<IfModule>,<IfVersion>,ImapBase,ImapDefault,ImapMenu,Include,IncludeOptional,IndexHeadInsert,IndexIgnore,IndexIgnoreReset,IndexOptions,IndexOrderDefault,IndexStyleSheet,InputSed,ISAPIAppendLogToErrors,ISAPIAppendLogToQuery,ISAPICacheFile,ISAPIFakeAsync,ISAPILogNotSupported,ISAPIReadAheadBuffer,KeepAlive,KeepAliveTimeout,KeptBodySize,LanguagePriority,LDAPCacheEntries,LDAPCacheTTL,LDAPConnectionPoolTTL,LDAPConnectionTimeout,LDAPLibraryDebug,LDAPOpCacheEntries,LDAPOpCacheTTL,LDAPReferralHopLimit,LDAPReferrals,LDAPRetries,LDAPRetryDelay,LDAPSharedCacheFile,LDAPSharedCacheSize,LDAPTimeout,LDAPTrustedClientCert,LDAPTrustedGlobalCert,LDAPTrustedMode,LDAPVerifyServerCert,<Limit>,<LimitExcept>,LimitInternalRecursion,LimitRequestBody,LimitRequestFields,LimitRequestFieldSize,LimitRequestLine,LimitXMLRequestBody,Listen,ListenBackLog,LoadFile,LoadModule,<Location>,<LocationMatch>,LogFormat,LogLevel,LogMessage,LuaCodeCache,LuaHookAccessChecker,LuaHookAuthChecker,LuaAuthzProvider,LuaHookCheckUserID,LuaHookFixups,LuaHookInsertFilter,LuaHookMapToStorage,LuaHookTranslateName,LuaHookTypeChecker,LuaInherit,LuaInputFilter,LuaMapHandler,LuaOutputFilter,LuaPackageCPath,LuaPackagePath,LuaQuickHandler,LuaRoot,LuaScope,MaxConnectionsPerChild,MaxKeepAliveRequests,MaxMemFree,MaxRangeOverlaps,MaxRangeReversals,MaxRanges,MaxRequestWorkers,MaxSpareServers,MaxSpareThreads,MaxThreads,MetaDir,MetaFiles,MetaSuffix,MimeMagicFile,MinSpareServers,MinSpareThreads,MMapFile,ModemStandard,ModMimeUsePathInfo,MultiviewsMatch,Mutex,NameVirtualHost,NoProxy,NWSSLTrustedCerts,NWSSLUpgradeable,Options,Order,OutputSed,PassEnv,PidFile,PrivilegesMode,Protocol,ProtocolEcho,<Proxy>,ProxyAddHeaders,ProxyBadHeader,ProxyBlock,ProxyDomain,ProxyErrorOverride,ProxyExpressDBMFile,ProxyExpressDBMType,ProxyExpressEnable,ProxyFtpDirCharset,ProxyFtpEscapeWildcards,ProxyFtpListOnWildcard,ProxyHTMLBufSize,ProxyHTMLCharsetOut,ProxyHTMLDocType,ProxyHTMLEnable,ProxyHTMLEvents,ProxyHTMLExtended,ProxyHTMLFixups,ProxyHTMLInterp,ProxyHTMLLinks,ProxyHTMLStripComments,ProxyHTMLURLMap,ProxyIOBufferSize,<ProxyMatch>,ProxyMaxForwards,ProxyPass,ProxyPassInterpolateEnv,ProxyPassMatch,ProxyPassReverse,ProxyPassReverseCookieDomain,ProxyPassReverseCookiePath,ProxyPreserveHost,ProxyReceiveBufferSize,ProxyRemote,ProxyRemoteMatch,ProxyRequests,ProxySCGIInternalRedirect,ProxySCGISendfile,ProxySet,ProxySourceAddress,ProxyStatus,ProxyTimeout,ProxyVia,ReadmeName,ReceiveBufferSize,Redirect,RedirectMatch,RedirectPermanent,RedirectTemp,ReflectorHeader,RemoteIPHeader,RemoteIPInternalProxy,RemoteIPInternalProxyList,RemoteIPProxiesHeader,RemoteIPTrustedProxy,RemoteIPTrustedProxyList,RemoveCharset,RemoveEncoding,RemoveHandler,RemoveInputFilter,RemoveLanguage,RemoveOutputFilter,RemoveType,RequestHeader,RequestReadTimeout,Require,<RequireAll>,<RequireAny>,<RequireNone>,RewriteBase,RewriteCond,RewriteEngine,RewriteMap,RewriteOptions,RewriteRule,RLimitCPU,RLimitMEM,RLimitNPROC,Satisfy,ScoreBoardFile,Script,ScriptAlias,ScriptAliasMatch,ScriptInterpreterSource,ScriptLog,ScriptLogBuffer,ScriptLogLength,ScriptSock,SecureListen,SeeRequestTail,SendBufferSize,ServerAdmin,ServerAlias,ServerLimit,ServerName,ServerPath,ServerRoot,ServerSignature,ServerTokens,Session,SessionCookieName,SessionCookieName2,SessionCookieRemove,SessionCryptoCipher,SessionCryptoDriver,SessionCryptoPassphrase,SessionCryptoPassphraseFile,SessionDBDCookieName,SessionDBDCookieName2,SessionDBDCookieRemove,SessionDBDDeleteLabel,SessionDBDInsertLabel,SessionDBDPerUser,SessionDBDSelectLabel,SessionDBDUpdateLabel,SessionEnv,SessionExclude,SessionHeader,SessionInclude,SessionMaxAge,SetEnv,SetEnvIf,SetEnvIfExpr,SetEnvIfNoCase,SetHandler,SetInputFilter,SetOutputFilter,SSIEndTag,SSIErrorMsg,SSIETag,SSILastModified,SSILegacyExprParser,SSIStartTag,SSITimeFormat,SSIUndefinedEcho,SSLCACertificateFile,SSLCACertificatePath,SSLCADNRequestFile,SSLCADNRequestPath,SSLCARevocationCheck,SSLCARevocationFile,SSLCARevocationPath,SSLCertificateChainFile,SSLCertificateFile,SSLCertificateKeyFile,SSLCipherSuite,SSLCryptoDevice,SSLEngine,SSLFIPS,SSLHonorCipherOrder,SSLInsecureRenegotiation,SSLOCSPDefaultResponder,SSLOCSPEnable,SSLOCSPOverrideResponder,SSLOCSPResponderTimeout,SSLOCSPResponseMaxAge,SSLOCSPResponseTimeSkew,SSLOptions,SSLPassPhraseDialog,SSLProtocol,SSLProxyCACertificateFile,SSLProxyCACertificatePath,SSLProxyCARevocationCheck,SSLProxyCARevocationFile,SSLProxyCARevocationPath,SSLProxyCheckPeerCN,SSLProxyCheckPeerExpire,SSLProxyCipherSuite,SSLProxyEngine,SSLProxyMachineCertificateChainFile,SSLProxyMachineCertificateFile,SSLProxyMachineCertificatePath,SSLProxyProtocol,SSLProxyVerify,SSLProxyVerifyDepth,SSLRandomSeed,SSLRenegBufferSize,SSLRequire,SSLRequireSSL,SSLSessionCache,SSLSessionCacheTimeout,SSLSessionTicketKeyFile,SSLStaplingCache,SSLStaplingErrorCacheTimeout,SSLStaplingFakeTryLater,SSLStaplingForceURL,SSLStaplingResponderTimeout,SSLStaplingResponseMaxAge,SSLStaplingResponseTimeSkew,SSLStaplingReturnResponderErrors,SSLStaplingStandardCacheTimeout,SSLStrictSNIVHostCheck,SSLUserName,SSLUseStapling,SSLVerifyClient,SSLVerifyDepth,StartServers,StartThreads,Substitute,Suexec,SuexecUserGroup,ThreadLimit,ThreadsPerChild,ThreadStackSize,TimeOut,TraceEnable,TransferLog,TypesConfig,UnDefine,UnsetEnv,UseCanonicalName,UseCanonicalPhysicalPort,User,UserDir,VHostCGIMode,VHostCGIPrivs,VHostGroup,VHostPrivs,VHostSecure,VHostUser,VirtualDocumentRoot,VirtualDocumentRootIP,<VirtualHost>,VirtualScriptAlias,VirtualScriptAliasIP,WatchdogInterval,XBitHack,xml2EncAlias,xml2EncDefault,xml2StartParse,RewriteLog,RewriteLogLevel"];var CONFIG_OPTIONS=/^[\\+\\-]?(AuthConfig|IncludesNOEXEC|ExecCGI|FollowSymLinks|MultiViews|Includes|Indexes|SymLinksIfOwnerMatch)\b/i;var ALL_KEYWORDS=[CPP_KEYWORDS,CSHARP_KEYWORDS,JSCRIPT_KEYWORDS,PERL_KEYWORDS+
+PYTHON_KEYWORDS,RUBY_KEYWORDS,SH_KEYWORDS,CONFIG_KEYWORDS,PHP_KEYWORDS];var C_TYPES=/^(DIR|FILE|vector|(de|priority_)?queue|list|stack|(const_)?iterator|(multi)?(set|map)|bitset|u?(int|float|char|void|const|static|struct)\d*(_t)?\b)|[a-z_]+_rec|cmd_parms\b/;var PR_STRING='str';var PR_KEYWORD='kwd';var PR_COMMENT='com';var PR_TYPE='typ';var PR_LITERAL='lit';var PR_PUNCTUATION='pun';var PR_PLAIN='pln';var PR_TAG='tag';var PR_DECLARATION='dec';var PR_SOURCE='src';var PR_ATTRIB_NAME='atn';var PR_ATTRIB_VALUE='atv';var PR_NOCODE='nocode';var REGEXP_PRECEDER_PATTERN='(?:^^\\.?|[+-]|[!=]=?=?|\\#|%=?|&&?=?|\\(|\\*=?|[+\\-]=|->|\\/=?|::?|<<?=?|>>?>?=?|,|;|\\?|@|\\[|~|{|\\^\\^?=?|\\|\\|?=?|break|case|continue|delete|do|else|finally|instanceof|return|throw|try|typeof)\\s*';function combinePrefixPatterns(regexs){var capturedGroupIndex=0;var needToFoldCase=false;var ignoreCase=false;for(var i=0,n=regexs.length;i<n;++i){var regex=regexs[i];if(regex.ignoreCase){ignoreCase=true;}else if(/[a-z]/i.test(regex.source.replace(/\\u[0-9a-f]{4}|\\x[0-9a-f]{2}|\\[^ux]/gi,''))){needToFoldCase=true;ignoreCase=false;break;}}
+var escapeCharToCodeUnit={'b':8,'t':9,'n':0xa,'v':0xb,'f':0xc,'r':0xd};function decodeEscape(charsetPart){var cc0=charsetPart.charCodeAt(0);if(cc0!==92){return cc0;}
+var c1=charsetPart.charAt(1);cc0=escapeCharToCodeUnit[c1];if(cc0){return cc0;}else if('0'<=c1&&c1<='7'){return parseInt(charsetPart.substring(1),8);}else if(c1==='u'||c1==='x'){return parseInt(charsetPart.substring(2),16);}else{return charsetPart.charCodeAt(1);}}
+function encodeEscape(charCode){if(charCode<0x20){return(charCode<0x10?'\\x0':'\\x')+charCode.toString(16);}
+var ch=String.fromCharCode(charCode);return(ch==='\\'||ch==='-'||ch===']'||ch==='^')?"\\"+ch:ch;}
+function caseFoldCharset(charSet){var charsetParts=charSet.substring(1,charSet.length-1).match(new RegExp('\\\\u[0-9A-Fa-f]{4}'
++'|\\\\x[0-9A-Fa-f]{2}'
++'|\\\\[0-3][0-7]{0,2}'
++'|\\\\[0-7]{1,2}'
++'|\\\\[\\s\\S]'
++'|-'
++'|[^-\\\\]','g'));var ranges=[];var inverse=charsetParts[0]==='^';var out=['['];if(inverse){out.push('^');}
+for(var i=inverse?1:0,n=charsetParts.length;i<n;++i){var p=charsetParts[i];if(/\\[bdsw]/i.test(p)){out.push(p);}else{var start=decodeEscape(p);var end;if(i+2<n&&'-'===charsetParts[i+1]){end=decodeEscape(charsetParts[i+2]);i+=2;}else{end=start;}
+ranges.push([start,end]);if(!(end<65||start>122)){if(!(end<65||start>90)){ranges.push([Math.max(65,start)|32,Math.min(end,90)|32]);}
+if(!(end<97||start>122)){ranges.push([Math.max(97,start)&~32,Math.min(end,122)&~32]);}}}}
+ranges.sort(function(a,b){return(a[0]-b[0])||(b[1]-a[1]);});var consolidatedRanges=[];var lastRange=[];for(var i=0;i<ranges.length;++i){var range=ranges[i];if(range[0]<=lastRange[1]+1){lastRange[1]=Math.max(lastRange[1],range[1]);}else{consolidatedRanges.push(lastRange=range);}}
+for(var i=0;i<consolidatedRanges.length;++i){var range=consolidatedRanges[i];out.push(encodeEscape(range[0]));if(range[1]>range[0]){if(range[1]+1>range[0]){out.push('-');}
+out.push(encodeEscape(range[1]));}}
+out.push(']');return out.join('');}
+function allowAnywhereFoldCaseAndRenumberGroups(regex){var parts=regex.source.match(new RegExp('(?:'
++'\\[(?:[^\\x5C\\x5D]|\\\\[\\s\\S])*\\]'
++'|\\\\u[A-Fa-f0-9]{4}'
++'|\\\\x[A-Fa-f0-9]{2}'
++'|\\\\[0-9]+'
++'|\\\\[^ux0-9]'
++'|\\(\\?[:!=]'
++'|[\\(\\)\\^]'
++'|[^\\x5B\\x5C\\(\\)\\^]+'
++')','g'));var n=parts.length;var capturedGroups=[];for(var i=0,groupIndex=0;i<n;++i){var p=parts[i];if(p==='('){++groupIndex;}else if('\\'===p.charAt(0)){var decimalValue=+p.substring(1);if(decimalValue){if(decimalValue<=groupIndex){capturedGroups[decimalValue]=-1;}else{parts[i]=encodeEscape(decimalValue);}}}}
+for(var i=1;i<capturedGroups.length;++i){if(-1===capturedGroups[i]){capturedGroups[i]=++capturedGroupIndex;}}
+for(var i=0,groupIndex=0;i<n;++i){var p=parts[i];if(p==='('){++groupIndex;if(!capturedGroups[groupIndex]){parts[i]='(?:';}}else if('\\'===p.charAt(0)){var decimalValue=+p.substring(1);if(decimalValue&&decimalValue<=groupIndex){parts[i]='\\'+capturedGroups[decimalValue];}}}
+for(var i=0;i<n;++i){if('^'===parts[i]&&'^'!==parts[i+1]){parts[i]='';}}
+if(regex.ignoreCase&&needToFoldCase){for(var i=0;i<n;++i){var p=parts[i];var ch0=p.charAt(0);if(p.length>=2&&ch0==='['){parts[i]=caseFoldCharset(p);}else if(ch0!=='\\'){parts[i]=p.replace(/[a-zA-Z]/g,function(ch){var cc=ch.charCodeAt(0);return'['+String.fromCharCode(cc&~32,cc|32)+']';});}}}
+return parts.join('');}
+var rewritten=[];for(var i=0,n=regexs.length;i<n;++i){var regex=regexs[i];if(regex.global||regex.multiline){throw new Error(''+regex);}
+rewritten.push('(?:'+allowAnywhereFoldCaseAndRenumberGroups(regex)+')');}
+return new RegExp(rewritten.join('|'),ignoreCase?'gi':'g');}
+function extractSourceSpans(node,isPreformatted){var nocode=/(?:^|\s)nocode(?:\s|$)/;var chunks=[];var length=0;var spans=[];var k=0;function walk(node){switch(node.nodeType){case 1:if(nocode.test(node.className)){return;}
+for(var child=node.firstChild;child;child=child.nextSibling){walk(child);}
+var nodeName=node.nodeName.toLowerCase();if('br'===nodeName||'li'===nodeName){chunks[k]='\n';spans[k<<1]=length++;spans[(k++<<1)|1]=node;}
+break;case 3:case 4:var text=node.nodeValue;if(text.length){if(!isPreformatted){text=text.replace(/[ \t\r\n]+/g,' ');}else{text=text.replace(/\r\n?/g,'\n');text=text.replace(/^(\r?\n\s*)+/g,'');text=text.replace(/^\s*/g,'');text=text.replace(/(\r?\n\s*)+$/g,'');}
+chunks[k]=text;spans[k<<1]=length;length+=text.length;spans[(k++<<1)|1]=node;}
+break;}}
+walk(node);return{sourceCode:chunks.join('').replace(/\n$/,''),spans:spans};}
+function appendDecorations(basePos,sourceCode,langHandler,out){if(!sourceCode){return;}
+var job={sourceCode:sourceCode,basePos:basePos};langHandler(job);out.push.apply(out,job.decorations);}
+var notWs=/\S/;function childContentWrapper(element){var wrapper=undefined;for(var c=element.firstChild;c;c=c.nextSibling){var type=c.nodeType;wrapper=(type===1)?(wrapper?element:c):(type===3)?(notWs.test(c.nodeValue)?element:wrapper):wrapper;}
+return wrapper===element?undefined:wrapper;}
+function createSimpleLexer(shortcutStylePatterns,fallthroughStylePatterns){var shortcuts={};var tokenizer;(function(){var allPatterns=shortcutStylePatterns.concat(fallthroughStylePatterns);var allRegexs=[];var regexKeys={};for(var i=0,n=allPatterns.length;i<n;++i){var patternParts=allPatterns[i];var shortcutChars=patternParts[3];if(shortcutChars){for(var c=shortcutChars.length;--c>=0;){shortcuts[shortcutChars.charAt(c)]=patternParts;}}
+var regex=patternParts[1];var k=''+regex;if(!regexKeys.hasOwnProperty(k)){allRegexs.push(regex);regexKeys[k]=null;}}
+allRegexs.push(/[\0-\uffff]/);tokenizer=combinePrefixPatterns(allRegexs);})();var nPatterns=fallthroughStylePatterns.length;var decorate=function(job){var sourceCode=job.sourceCode,basePos=job.basePos;var decorations=[basePos,PR_PLAIN];var pos=0;var tokens=sourceCode.match(tokenizer)||[];var styleCache={};for(var ti=0,nTokens=tokens.length;ti<nTokens;++ti){var token=tokens[ti];var style=styleCache[token];var match=void 0;var isEmbedded;if(typeof style==='string'){isEmbedded=false;}else{var patternParts=shortcuts[token.charAt(0)];if(patternParts){match=token.match(patternParts[1]);style=patternParts[0];}else{for(var i=0;i<nPatterns;++i){patternParts=fallthroughStylePatterns[i];match=token.match(patternParts[1]);if(match){style=patternParts[0];break;}}
+if(!match){style=PR_PLAIN;}}
+isEmbedded=style.length>=5&&'lang-'===style.substring(0,5);if(isEmbedded&&!(match&&typeof match[1]==='string')){isEmbedded=false;style=PR_SOURCE;}
+if(!isEmbedded){styleCache[token]=style;}}
+var tokenStart=pos;pos+=token.length;if(!isEmbedded){decorations.push(basePos+tokenStart,style);}else{var embeddedSource=match[1];var embeddedSourceStart=token.indexOf(embeddedSource);var embeddedSourceEnd=embeddedSourceStart+embeddedSource.length;if(match[2]){embeddedSourceEnd=token.length-match[2].length;embeddedSourceStart=embeddedSourceEnd-embeddedSource.length;}
+var lang=style.substring(5);appendDecorations(basePos+tokenStart,token.substring(0,embeddedSourceStart),decorate,decorations);appendDecorations(basePos+tokenStart+embeddedSourceStart,embeddedSource,langHandlerForExtension(lang,embeddedSource),decorations);appendDecorations(basePos+tokenStart+embeddedSourceEnd,token.substring(embeddedSourceEnd),decorate,decorations);}}
+job.decorations=decorations;};return decorate;}
+function sourceDecorator(options){var shortcutStylePatterns=[],fallthroughStylePatterns=[];if(options['tripleQuotedStrings']){shortcutStylePatterns.push([PR_STRING,/^(?:\'\'\'(?:[^\'\\]|\\[\s\S]|\'{1,2}(?=[^\']))*(?:\'\'\'|$)|\"\"\"(?:[^\"\\]|\\[\s\S]|\"{1,2}(?=[^\"]))*(?:\"\"\"|$)|\'(?:[^\\\']|\\[\s\S])*(?:\'|$)|\"(?:[^\\\"]|\\[\s\S])*(?:\"|$))/,null,'\'"']);}else if(options['multiLineStrings']){shortcutStylePatterns.push([PR_STRING,/^(?:\'(?:[^\\\']|\\[\s\S])*(?:\'|$)|\"(?:[^\\\"]|\\[\s\S])*(?:\"|$)|\`(?:[^\\\`]|\\[\s\S])*(?:\`|$))/,null,'\'"`']);}else{shortcutStylePatterns.push([PR_STRING,/^(?:\'(?:[^\\\'\r\n]|\\.)*(?:\'|$)|\"(?:[^\\\"\r\n]|\\.)*(?:\"|$))/,null,'"\'']);}
+if(options['verbatimStrings']){fallthroughStylePatterns.push([PR_STRING,/^@\"(?:[^\"]|\"\")*(?:\"|$)/,null]);}
+var hc=options['hashComments'];if(hc){if(options['cStyleComments']){if(hc>1){shortcutStylePatterns.push([PR_COMMENT,/^#(?:##(?:[^#]|#(?!##))*(?:###|$)|.*)/,null,'#']);}else{shortcutStylePatterns.push([PR_COMMENT,/^#(?:(?:define|elif|else|endif|error|ifdef|include|ifndef|line|pragma|undef|warning)\b|[^\r\n]*)/,null,'#']);}
+fallthroughStylePatterns.push([PR_STRING,/^<(?:(?:(?:\.\.\/)*|\/?)(?:[\w-]+(?:\/[\w-]+)+)?[\w-]+\.h(?:h|pp|\+\+)?|[a-z]\w*)>/,null]);}else{shortcutStylePatterns.push([PR_COMMENT,/^#[^\r\n]*/,null,'#']);}}
+if(options['cStyleComments']){fallthroughStylePatterns.push([PR_COMMENT,/^\/\/[^\r\n]*/,null]);fallthroughStylePatterns.push([PR_COMMENT,/^\/\*[\s\S]*?(?:\*\/|$)/,null]);}
+if(options['regexLiterals']){var REGEX_LITERAL=('/(?=[^/*])'
++'(?:[^/\\x5B\\x5C]'
++'|\\x5C[\\s\\S]'
++'|\\x5B(?:[^\\x5C\\x5D]|\\x5C[\\s\\S])*(?:\\x5D|$))+'
++'/');fallthroughStylePatterns.push(['lang-regex',new RegExp('^'+REGEXP_PRECEDER_PATTERN+'('+REGEX_LITERAL+')')]);}
+var types=options['types'];if(types){fallthroughStylePatterns.push([PR_TYPE,types]);}
+if(options['strings']){var strings=(""+options['strings']).replace(/^ | $/g,'').replace(/-/g,'\\-');fallthroughStylePatterns.push([PR_STRING,new RegExp('(?:'+strings.replace(/[\s,]+/g,'|')+')'),,null]);}
+var keywords=(""+options['keywords']).replace(/^ | $/g,'');if(keywords.length){fallthroughStylePatterns.push([PR_KEYWORD,new RegExp('^(?:'+keywords.replace(/[\s,]+/g,'|')+')\\b'),null]);}
+shortcutStylePatterns.push([PR_PLAIN,/^\s+/,null,' \r\n\t\xA0']);if(options['httpdComments']){fallthroughStylePatterns.push([PR_PLAIN,/^.*\S.*#/i,null]);}
+fallthroughStylePatterns.push([PR_LITERAL,/^@[a-z_$][a-z_$@0-9]*|\bNULL\b/i,null],[PR_LITERAL,CONFIG_OPTIONS,null],[PR_TAG,/^\b(AuthzProviderAlias|AuthnProviderAlias|RequireAny|RequireAll|RequireNone|Directory|DirectoryMatch|Location|LocationMatch|VirtualHost|If|Else|ElseIf|Proxy\b|LoadBalancer|Files|FilesMatch|Limit|LimitExcept|IfDefine|IfModule|IfVersion)\b/,null],[PR_TYPE,/^(?:[@_]?[A-Z]+[a-z][A-Za-z_$@0-9]*|\w+_(t|req|module)\b)/,null],[PR_TAG,/^apr_[a-z_0-9]+|ap_[a-z_0-9]+/i,null],[PR_PLAIN,/^[a-z_$][a-z_$@0-9\-]*/i,null],[PR_LITERAL,new RegExp('^(?:'
++'0x[a-f0-9]+'
++'|[a-f0-9:]+:[a-f0-9:]+:[a-f0-9:]+:[a-f0-9:]+:[a-f0-9:]+:[a-f0-9:]+'
++'|(?:\\d(?:_\\d+)*\\d*(?:\\.\\d*)?|\\.\\d\\+)'
++'(?:e[+\\-]?\\d+)?'
++')'
++'[a-z]*','i'),null,'0123456789'],[PR_PLAIN,/^\\[\s\S]?/,null],[PR_PUNCTUATION,/^.[^\s\w\.$@\'\"\`\/\#\\]*/,null]);return createSimpleLexer(shortcutStylePatterns,fallthroughStylePatterns);}
+var decorateSource=sourceDecorator({'keywords':ALL_KEYWORDS,'hashComments':true,'cStyleComments':true,'multiLineStrings':true,'regexLiterals':true});function numberLines(node,opt_startLineNum,isPreformatted){var nocode=/(?:^|\s)nocode(?:\s|$)/;var lineBreak=/\r\n?|\n/;var document=node.ownerDocument;var li=document.createElement('li');while(node.firstChild){li.appendChild(node.firstChild);}
+var listItems=[li];function walk(node){switch(node.nodeType){case 1:if(nocode.test(node.className)){break;}
+if('br'===node.nodeName){breakAfter(node);if(node.parentNode){node.parentNode.removeChild(node);}}else{for(var child=node.firstChild;child;child=child.nextSibling){walk(child);}}
+break;case 3:case 4:if(isPreformatted){var text=node.nodeValue;var match=text.match(lineBreak);if(match){var firstLine=text.substring(0,match.index);node.nodeValue=firstLine;var tail=text.substring(match.index+match[0].length);if(tail){var parent=node.parentNode;parent.insertBefore(document.createTextNode(tail),node.nextSibling);}
+breakAfter(node);if(!firstLine){node.parentNode.removeChild(node);}}}
+break;}}
+function breakAfter(lineEndNode){while(!lineEndNode.nextSibling){lineEndNode=lineEndNode.parentNode;if(!lineEndNode){return;}}
+function breakLeftOf(limit,copy){var rightSide=copy?limit.cloneNode(false):limit;var parent=limit.parentNode;if(parent){var parentClone=breakLeftOf(parent,1);var next=limit.nextSibling;parentClone.appendChild(rightSide);for(var sibling=next;sibling;sibling=next){next=sibling.nextSibling;parentClone.appendChild(sibling);}}
+return rightSide;}
+var copiedListItem=breakLeftOf(lineEndNode.nextSibling,0);for(var parent;(parent=copiedListItem.parentNode)&&parent.nodeType===1;){copiedListItem=parent;}
+listItems.push(copiedListItem);}
+for(var i=0;i<listItems.length;++i){walk(listItems[i]);}
+if(opt_startLineNum===(opt_startLineNum|0)){listItems[0].setAttribute('value',opt_startLineNum);}
+var ol=document.createElement('ol');ol.className='linenums';var offset=Math.max(0,((opt_startLineNum-1))|0)||0;for(var i=0,n=listItems.length;i<n;++i){li=listItems[i];li.className='L'+((i+offset)%1);if(!li.firstChild){li.appendChild(document.createTextNode('\xA0'));}
+ol.appendChild(li);}
+node.appendChild(ol);}
+function recombineTagsAndDecorations(job){var isIE8OrEarlier=/\bMSIE\s(\d+)/.exec(navigator.userAgent);isIE8OrEarlier=isIE8OrEarlier&&+isIE8OrEarlier[1]<=8;var newlineRe=/\n/g;var source=job.sourceCode;var sourceLength=source.length;var sourceIndex=0;var spans=job.spans;var nSpans=spans.length;var spanIndex=0;var decorations=job.decorations;var nDecorations=decorations.length;var decorationIndex=0;decorations[nDecorations]=sourceLength;var decPos,i;for(i=decPos=0;i<nDecorations;){if(decorations[i]!==decorations[i+2]){decorations[decPos++]=decorations[i++];decorations[decPos++]=decorations[i++];}else{i+=2;}}
+nDecorations=decPos;for(i=decPos=0;i<nDecorations;){var startPos=decorations[i];var startDec=decorations[i+1];var end=i+2;while(end+2<=nDecorations&&decorations[end+1]===startDec){end+=2;}
+decorations[decPos++]=startPos;decorations[decPos++]=startDec;i=end;}
+nDecorations=decorations.length=decPos;var sourceNode=job.sourceNode;var oldDisplay;if(sourceNode){oldDisplay=sourceNode.style.display;sourceNode.style.display='none';}
+try{var decoration=null;var X=0;while(spanIndex<nSpans){X=X+1;if(X>5000){break;}
+var spanStart=spans[spanIndex];var spanEnd=spans[spanIndex+2]||sourceLength;var decEnd=decorations[decorationIndex+2]||sourceLength;var end=Math.min(spanEnd,decEnd);var textNode=spans[spanIndex+1];var styledText;if(textNode.nodeType!==1&&(styledText=source.substring(sourceIndex,end))){if(isIE8OrEarlier){styledText=styledText.replace(newlineRe,'\r');}
+textNode.nodeValue=styledText;var document=textNode.ownerDocument;var span=document.createElement('span');span.className=decorations[decorationIndex+1];var parentNode=textNode.parentNode;parentNode.replaceChild(span,textNode);span.appendChild(textNode);if(sourceIndex<spanEnd){spans[spanIndex+1]=textNode=document.createTextNode(source.substring(end,spanEnd));parentNode.insertBefore(textNode,span.nextSibling);}}
+sourceIndex=end;if(sourceIndex>=spanEnd){spanIndex+=2;}
+if(sourceIndex>=decEnd){decorationIndex+=2;}}}finally{if(sourceNode){sourceNode.style.display=oldDisplay;}}}
+var langHandlerRegistry={};function registerLangHandler(handler,fileExtensions){for(var i=fileExtensions.length;--i>=0;){var ext=fileExtensions[i];if(!langHandlerRegistry.hasOwnProperty(ext)){langHandlerRegistry[ext]=handler;}else if(win['console']){console['warn']('cannot override language handler %s',ext);}}}
+function langHandlerForExtension(extension,source){if(!(extension&&langHandlerRegistry.hasOwnProperty(extension))){extension=/^\s*</.test(source)?'default-markup':'default-code';}
+return langHandlerRegistry[extension];}
+registerLangHandler(decorateSource,['default-code']);registerLangHandler(createSimpleLexer([],[[PR_PLAIN,/^[^<?]+/],[PR_DECLARATION,/^<!\w[^>]*(?:>|$)/],[PR_COMMENT,/^<\!--[\s\S]*?(?:-\->|$)/],['lang-',/^<\?([\s\S]+?)(?:\?>|$)/],['lang-',/^<%([\s\S]+?)(?:%>|$)/],[PR_PUNCTUATION,/^(?:<[%?]|[%?]>)/],['lang-',/^<xmp\b[^>]*>([\s\S]+?)<\/xmp\b[^>]*>/i],['lang-js',/^<script\b[^>]*>([\s\S]*?)(<\/script\b[^>]*>)/i],['lang-css',/^<style\b[^>]*>([\s\S]*?)(<\/style\b[^>]*>)/i],['lang-in.tag',/^(<\/?[a-z][^<>]*>)/i]]),['default-markup','htm','html','mxml','xhtml','xml','xsl']);registerLangHandler(createSimpleLexer([[PR_PLAIN,/^[\s]+/,null,' \t\r\n'],[PR_ATTRIB_VALUE,/^(?:\"[^\"]*\"?|\'[^\']*\'?)/,null,'\"\'']],[[PR_TAG,/^^<\/?[a-z](?:[\w.:-]*\w)?|\/?>$/i],[PR_ATTRIB_NAME,/^(?!style[\s=]|on)[a-z](?:[\w:-]*\w)?/i],['lang-uq.val',/^=\s*([^>\'\"\s]*(?:[^>\'\"\s\/]|\/(?=\s)))/],[PR_PUNCTUATION,/^[=<>\/]+/],['lang-js',/^on\w+\s*=\s*\"([^\"]+)\"/i],['lang-js',/^on\w+\s*=\s*\'([^\']+)\'/i],['lang-js',/^on\w+\s*=\s*([^\"\'>\s]+)/i],['lang-css',/^style\s*=\s*\"([^\"]+)\"/i],['lang-css',/^style\s*=\s*\'([^\']+)\'/i],['lang-css',/^style\s*=\s*([^\"\'>\s]+)/i]]),['in.tag']);registerLangHandler(createSimpleLexer([],[[PR_ATTRIB_VALUE,/^[\s\S]+/]]),['uq.val']);registerLangHandler(sourceDecorator({'keywords':CPP_KEYWORDS,'hashComments':true,'cStyleComments':true,'types':C_TYPES}),['c','cc','cpp','cxx','cyc','m']);registerLangHandler(sourceDecorator({'keywords':PHP_KEYWORDS,'hashComments':false,'cStyleComments':true,'multiLineStrings':true,'regexLiterals':true}),['php','phtml','inc']);registerLangHandler(sourceDecorator({'keywords':'null,true,false'}),['json']);registerLangHandler(sourceDecorator({'keywords':CSHARP_KEYWORDS,'hashComments':true,'cStyleComments':true,'verbatimStrings':true,'types':C_TYPES}),['cs']);registerLangHandler(sourceDecorator({'keywords':JAVA_KEYWORDS,'cStyleComments':true}),['java']);registerLangHandler(sourceDecorator({'keywords':SH_KEYWORDS,'hashComments':true,'multiLineStrings':true}),['bsh','csh','sh']);registerLangHandler(sourceDecorator({'keywords':PYTHON_KEYWORDS,'hashComments':true,'multiLineStrings':true,'tripleQuotedStrings':true}),['cv','py']);registerLangHandler(sourceDecorator({'keywords':PERL_KEYWORDS,'hashComments':true,'multiLineStrings':true,'regexLiterals':true}),['perl','pl','pm']);registerLangHandler(sourceDecorator({'keywords':RUBY_KEYWORDS,'hashComments':true,'multiLineStrings':true,'regexLiterals':true}),['rb']);registerLangHandler(sourceDecorator({'keywords':JSCRIPT_KEYWORDS,'cStyleComments':true,'regexLiterals':true}),['js']);registerLangHandler(sourceDecorator({'keywords':COFFEE_KEYWORDS,'hashComments':3,'cStyleComments':true,'multilineStrings':true,'tripleQuotedStrings':true,'regexLiterals':true}),['coffee']);registerLangHandler(createSimpleLexer([],[[PR_STRING,/^[\s\S]+/]]),['regex']);registerLangHandler(sourceDecorator({'keywords':CONFIG_KEYWORDS,'literals':CONFIG_OPTIONS,'strings':CONFIG_ENVS,'hashComments':true,'cStyleComments':false,'multiLineStrings':false,'regexLiterals':false,'httpdComments':true}),['config']);function applyDecorator(job){var opt_langExtension=job.langExtension;try{var sourceAndSpans=extractSourceSpans(job.sourceNode,job.pre);var source=sourceAndSpans.sourceCode;job.sourceCode=source;job.spans=sourceAndSpans.spans;job.basePos=0;langHandlerForExtension(opt_langExtension,source)(job);recombineTagsAndDecorations(job);}catch(e){if(win['console']){console['log'](e&&e['stack']?e['stack']:e);}}}
+function prettyPrintOne(sourceCodeHtml,opt_langExtension,opt_numberLines){var container=document.createElement('pre');container.innerHTML=sourceCodeHtml;if(opt_numberLines){numberLines(container,opt_numberLines,true);}
+var job={langExtension:opt_langExtension,numberLines:opt_numberLines,sourceNode:container,pre:1};applyDecorator(job);return container.innerHTML;}
+function prettyPrint(opt_whenDone){function byTagName(tn){return document.getElementsByTagName(tn);}
+var codeSegments=[byTagName('pre'),byTagName('code'),byTagName('xmp')];var elements=[];for(var i=0;i<codeSegments.length;++i){for(var j=0,n=codeSegments[i].length;j<n;++j){elements.push(codeSegments[i][j]);}}
+codeSegments=null;var clock=Date;if(!clock['now']){clock={'now':function(){return+(new Date);}};}
+var k=0;var prettyPrintingJob;var langExtensionRe=/\blang(?:uage)?-([\w.]+)(?!\S)/;var prettyPrintRe=/\bprettyprint\b/;var prettyPrintedRe=/\bprettyprinted\b/;var preformattedTagNameRe=/pre|xmp/i;var codeRe=/^code$/i;var preCodeXmpRe=/^(?:pre|code|xmp)$/i;function doWork(){var endTime=(win['PR_SHOULD_USE_CONTINUATION']?clock['now']()+250:Infinity);for(;k<elements.length&&clock['now']()<endTime;k++){var cs=elements[k];var className=cs.className;if(prettyPrintRe.test(className)&&!prettyPrintedRe.test(className)){var nested=false;for(var p=cs.parentNode;p;p=p.parentNode){var tn=p.tagName;if(preCodeXmpRe.test(tn)&&p.className&&prettyPrintRe.test(p.className)){nested=true;break;}}
+if(!nested){cs.className+=' prettyprinted';var langExtension=className.match(langExtensionRe);var wrapper;if(!langExtension&&(wrapper=childContentWrapper(cs))&&codeRe.test(wrapper.tagName)){langExtension=wrapper.className.match(langExtensionRe);}
+if(langExtension){langExtension=langExtension[1];}
+var preformatted;if(preformattedTagNameRe.test(cs.tagName)){preformatted=1;}else{var currentStyle=cs['currentStyle'];var whitespace=(currentStyle?currentStyle['whiteSpace']:(document.defaultView&&document.defaultView.getComputedStyle)?document.defaultView.getComputedStyle(cs,null).getPropertyValue('white-space'):0);preformatted=whitespace&&'pre'===whitespace.substring(0,3);}
+var lineNums=cs.className.match(/\blinenums\b(?::(\d+))?/);lineNums=lineNums?lineNums[1]&&lineNums[1].length?+lineNums[1]:true:false;if(lineNums){numberLines(cs,lineNums,preformatted);}
+prettyPrintingJob={langExtension:langExtension,sourceNode:cs,numberLines:lineNums,pre:preformatted};applyDecorator(prettyPrintingJob);}}}
+if(k<elements.length){setTimeout(doWork,250);}else if(opt_whenDone){opt_whenDone();}}
+doWork();}
+var PR=win['PR']={'createSimpleLexer':createSimpleLexer,'registerLangHandler':registerLangHandler,'sourceDecorator':sourceDecorator,'PR_ATTRIB_NAME':PR_ATTRIB_NAME,'PR_ATTRIB_VALUE':PR_ATTRIB_VALUE,'PR_COMMENT':PR_COMMENT,'PR_DECLARATION':PR_DECLARATION,'PR_KEYWORD':PR_KEYWORD,'PR_LITERAL':PR_LITERAL,'PR_NOCODE':PR_NOCODE,'PR_PLAIN':PR_PLAIN,'PR_PUNCTUATION':PR_PUNCTUATION,'PR_SOURCE':PR_SOURCE,'PR_STRING':PR_STRING,'PR_TAG':PR_TAG,'PR_TYPE':PR_TYPE,'prettyPrintOne':win['prettyPrintOne']=prettyPrintOne,'prettyPrint':win['prettyPrint']=prettyPrint};PR['registerLangHandler'](PR['createSimpleLexer']([[PR['PR_PLAIN'],/^[\t\n\r \xA0]+/,null,'\t\n\r \xA0'],[PR['PR_STRING'],/^(?:\"(?:[^\"\\]|\\[\s\S])*(?:\"|$)|\'(?:[^\'\\]|\\[\s\S])*(?:\'|$))/,null,'"\'']],[[PR['PR_COMMENT'],/^--(?:\[(=*)\[[\s\S]*?(?:\]\1\]|$)|[^\r\n]*)/],[PR['PR_TYPE'],/^nil|false|true/],[PR['PR_STRING'],/^\[(=*)\[[\s\S]*?(?:\]\1\]|$)/],[PR['PR_KEYWORD'],/^(?:and|break|do|else|elseif|end|for|function|if|in|local|not|or|repeat|require|return|then|until|while)\b/,null],[PR['PR_LITERAL'],/^[+-]?(?:0x[\da-f]+|(?:(?:\.\d+|\d+(?:\.\d*)?)(?:e[+\-]?\d+)?))/i],[PR['PR_PLAIN'],/^[a-z_]\w*/i],[PR['PR_PUNCTUATION'],/^[^\w\t\n\r \xA0][^\w\t\n\r \xA0\"\'\-\+=]*/]]),['lua']);if(typeof define==="function"&&define['amd']){define("google-code-prettify",[],function(){return PR;});}})();
\ No newline at end of file
diff --git a/docs/manual/style/sitemap.dtd b/docs/manual/style/sitemap.dtd
new file mode 100644
index 0000000..829f326
--- /dev/null
+++ b/docs/manual/style/sitemap.dtd
@@ -0,0 +1,42 @@
+<?xml version='1.0' encoding='UTF-8' ?>
+
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements.  See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License.  You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+
+<!ENTITY % common SYSTEM "common.dtd">
+%common;
+
+<!-- <sitemap> is the root element -->
+<!ELEMENT sitemap (title, summary?, seealso*, category*)>
+
+<!ATTLIST sitemap metafile CDATA  #REQUIRED
+                  upgrade  CDATA  #IMPLIED
+>
+
+<!-- <indexpage> is another root element -->
+<!ELEMENT indexpage (parentdocument, title, category*)>
+
+<!ATTLIST indexpage metafile CDATA  #REQUIRED
+                    upgrade  CDATA  #IMPLIED
+>
+
+<!ELEMENT category (title, page*)>
+<!ATTLIST category id ID #IMPLIED>
+
+<!ELEMENT page (#PCDATA)>
+<!ATTLIST page href CDATA #IMPLIED
+               separate (yes | no) "no" >
diff --git a/docs/manual/style/version.ent b/docs/manual/style/version.ent
new file mode 100644
index 0000000..0c2a5f3
--- /dev/null
+++ b/docs/manual/style/version.ent
@@ -0,0 +1,24 @@
+<?xml version='1.0' encoding='UTF-8' ?>
+
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements.  See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License.  You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+
+<!ENTITY httpd.major "2">
+<!ENTITY httpd.minor "4">
+<!ENTITY httpd.patch "25">
+
+<!ENTITY httpd.docs "2.4">
diff --git a/docs/manual/suexec.html b/docs/manual/suexec.html
new file mode 100644
index 0000000..c4cc65b
--- /dev/null
+++ b/docs/manual/suexec.html
@@ -0,0 +1,21 @@
+# GENERATED FROM XML -- DO NOT EDIT
+
+URI: suexec.html.en
+Content-Language: en
+Content-type: text/html; charset=ISO-8859-1
+
+URI: suexec.html.fr
+Content-Language: fr
+Content-type: text/html; charset=ISO-8859-1
+
+URI: suexec.html.ja.utf8
+Content-Language: ja
+Content-type: text/html; charset=UTF-8
+
+URI: suexec.html.ko.euc-kr
+Content-Language: ko
+Content-type: text/html; charset=EUC-KR
+
+URI: suexec.html.tr.utf8
+Content-Language: tr
+Content-type: text/html; charset=UTF-8
diff --git a/docs/manual/suexec.html.en b/docs/manual/suexec.html.en
new file mode 100644
index 0000000..b156b57
--- /dev/null
+++ b/docs/manual/suexec.html.en
@@ -0,0 +1,643 @@
+<?xml version="1.0" encoding="ISO-8859-1"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head>
+<meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type" />
+<!--
+        XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+              This file is generated from xml source: DO NOT EDIT
+        XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+      -->
+<title>suEXEC Support - Apache HTTP Server Version 2.4</title>
+<link href="./style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" />
+<link href="./style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" />
+<link href="./style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" /><link rel="stylesheet" type="text/css" href="./style/css/prettify.css" />
+<script src="./style/scripts/prettify.min.js" type="text/javascript">
+</script>
+
+<link href="./images/favicon.ico" rel="shortcut icon" /></head>
+<body id="manual-page"><div id="page-header">
+<p class="menu"><a href="./mod/">Modules</a> | <a href="./mod/directives.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="./glossary.html">Glossary</a> | <a href="./sitemap.html">Sitemap</a></p>
+<p class="apache">Apache HTTP Server Version 2.4</p>
+<img alt="" src="./images/feather.png" /></div>
+<div class="up"><a href="./"><img title="&lt;-" alt="&lt;-" src="./images/left.gif" /></a></div>
+<div id="path">
+<a href="http://www.apache.org/">Apache</a> &gt; <a href="http://httpd.apache.org/">HTTP Server</a> &gt; <a href="http://httpd.apache.org/docs/">Documentation</a> &gt; <a href="./">Version 2.4</a></div><div id="page-content"><div id="preamble"><h1>suEXEC Support</h1>
+<div class="toplang">
+<p><span>Available Languages: </span><a href="./en/suexec.html" title="English">&nbsp;en&nbsp;</a> |
+<a href="./fr/suexec.html" hreflang="fr" rel="alternate" title="Fran�ais">&nbsp;fr&nbsp;</a> |
+<a href="./ja/suexec.html" hreflang="ja" rel="alternate" title="Japanese">&nbsp;ja&nbsp;</a> |
+<a href="./ko/suexec.html" hreflang="ko" rel="alternate" title="Korean">&nbsp;ko&nbsp;</a> |
+<a href="./tr/suexec.html" hreflang="tr" rel="alternate" title="T�rk�e">&nbsp;tr&nbsp;</a></p>
+</div>
+
+    <p>The <strong>suEXEC</strong> feature provides users of the Apache
+    HTTP Server the ability
+    to run <strong>CGI</strong> and <strong>SSI</strong> programs
+    under user IDs different from the user ID of the calling
+    web server. Normally, when a CGI or SSI program executes, it
+    runs as the same user who is running the web server.</p>
+
+    <p>Used properly, this feature can reduce
+    considerably the security risks involved with allowing users to
+    develop and run private CGI or SSI programs. However, if suEXEC
+    is improperly configured, it can cause any number of problems
+    and possibly create new holes in your computer's security. If
+    you aren't familiar with managing <em>setuid root</em> programs
+    and the security issues they present, we highly recommend that
+    you not consider using suEXEC.</p>
+  </div>
+<div id="quickview"><ul id="toc"><li><img alt="" src="./images/down.gif" /> <a href="#before">Before we begin</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#model">suEXEC Security Model</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#install">Configuring &amp; Installing
+    suEXEC</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#enable">Enabling &amp; Disabling
+    suEXEC</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#usage">Using suEXEC</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#debug">Debugging suEXEC</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#jabberwock">Beware the Jabberwock:
+    Warnings &amp; Examples</a></li>
+</ul><h3>See also</h3><ul class="seealso"><li><a href="#comments_section">Comments</a></li></ul></div>
+<div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="before" id="before">Before we begin</a></h2>
+
+    <p>Before jumping head-first into this document,
+    you should be aware that certain assumptions are made about you and
+    the environment in which you will be using suexec.</p>
+
+    <p>First, it is assumed that you are using a UNIX
+    derivative operating system that is capable of
+    <strong>setuid</strong> and <strong>setgid</strong> operations.
+    All command examples are given in this regard. Other platforms,
+    if they are capable of supporting suEXEC, may differ in their
+    configuration.</p>
+
+    <p>Second, it is assumed you are familiar with
+    some basic concepts of your computer's security and its
+    administration. This involves an understanding of
+    <strong>setuid/setgid</strong> operations and the various
+    effects they may have on your system and its level of
+    security.</p>
+
+    <p>Third, it is assumed that you are using an
+    <strong>unmodified</strong> version of suEXEC code. All code
+    for suEXEC has been carefully scrutinized and tested by the
+    developers as well as numerous beta testers. Every precaution
+    has been taken to ensure a simple yet solidly safe base of
+    code. Altering this code can cause unexpected problems and new
+    security risks. It is <strong>highly</strong> recommended you
+    not alter the suEXEC code unless you are well versed in the
+    particulars of security programming and are willing to share
+    your work with the Apache HTTP Server development team for consideration.</p>
+
+    <p>Fourth, and last, it has been the decision of
+    the Apache HTTP Server development team to <strong>NOT</strong> make suEXEC part of
+    the default installation of Apache httpd. To this end, suEXEC
+    configuration requires of the administrator careful attention
+    to details. After due consideration has been given to the
+    various settings for suEXEC, the administrator may install
+    suEXEC through normal installation methods. The values for
+    these settings need to be carefully determined and specified by
+    the administrator to properly maintain system security during
+    the use of suEXEC functionality. It is through this detailed
+    process that we hope to limit suEXEC
+    installation only to those who are careful and determined
+    enough to use it.</p>
+
+    <p>Still with us? Yes? Good. Let's move on!</p>
+</div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="model" id="model">suEXEC Security Model</a></h2>
+
+    <p>Before we begin configuring and installing
+    suEXEC, we will first discuss the security model you are about
+    to implement. By doing so, you may better understand what
+    exactly is going on inside suEXEC and what precautions are
+    taken to ensure your system's security.</p>
+
+    <p><strong>suEXEC</strong> is based on a setuid
+    "wrapper" program that is called by the main Apache HTTP Server.
+    This wrapper is called when an HTTP request is made for a CGI
+    or SSI program that the administrator has designated to run as
+    a userid other than that of the main server. When such a
+    request is made, Apache httpd provides the suEXEC wrapper with the
+    program's name and the user and group IDs under which the
+    program is to execute.</p>
+
+    <p>The wrapper then employs the following process
+    to determine success or failure -- if any one of these
+    conditions fail, the program logs the failure and exits with an
+    error, otherwise it will continue:</p>
+
+    <ol>
+      <li>
+        <strong>Is the user executing this wrapper a valid user of
+        this system?</strong>
+
+        <p class="indent">
+          This is to ensure that the user executing the wrapper is
+          truly a user of the system.
+        </p>
+     </li>
+
+     <li>
+        <strong>Was the wrapper called with the proper number of
+        arguments?</strong>
+
+        <p class="indent">
+          The wrapper will only execute if it is given the proper
+          number of arguments. The proper argument format is known
+          to the Apache HTTP Server. If the wrapper is not receiving
+          the proper number of arguments, it is either being
+          hacked, or there is something wrong with the suEXEC
+          portion of your Apache httpd binary.
+        </p>
+      </li>
+
+      <li>
+        <strong>Is this valid user allowed to run the
+        wrapper?</strong>
+
+        <p class="indent">
+          Is this user the user allowed to run this wrapper? Only
+          one user (the Apache user) is allowed to execute this
+          program.
+        </p>
+      </li>
+
+      <li>
+        <strong>Does the target CGI or SSI program have an unsafe
+        hierarchical reference?</strong>
+
+        <p class="indent">
+          Does the target CGI or SSI program's path contain a leading
+          '/' or have a '..' backreference? These are not allowed; the
+          target CGI/SSI program must reside within suEXEC's document
+          root (see <code>--with-suexec-docroot=<em>DIR</em></code>
+          below).
+        </p>
+      </li>
+
+      <li>
+        <strong>Is the target user name valid?</strong>
+
+        <p class="indent">
+          Does the target user exist?
+        </p>
+      </li>
+
+      <li>
+        <strong>Is the target group name valid?</strong>
+
+        <p class="indent">
+          Does the target group exist?
+        </p>
+      </li>
+
+      <li>
+        <strong>Is the target user <em>NOT</em> superuser?</strong>
+
+
+        <p class="indent">
+          suEXEC does not allow <code><em>root</em></code>
+          to execute CGI/SSI programs.
+        </p>
+      </li>
+
+      <li>
+        <strong>Is the target userid <em>ABOVE</em> the minimum ID
+        number?</strong>
+
+        <p class="indent">
+          The minimum user ID number is specified during
+          configuration. This allows you to set the lowest possible
+          userid that will be allowed to execute CGI/SSI programs.
+          This is useful to block out "system" accounts.
+        </p>
+      </li>
+
+      <li>
+        <strong>Is the target group <em>NOT</em> the superuser
+        group?</strong>
+
+        <p class="indent">
+          Presently, suEXEC does not allow the <code><em>root</em></code>
+          group to execute CGI/SSI programs.
+        </p>
+      </li>
+
+      <li>
+        <strong>Is the target groupid <em>ABOVE</em> the minimum ID
+        number?</strong>
+
+        <p class="indent">
+          The minimum group ID number is specified during
+          configuration. This allows you to set the lowest possible
+          groupid that will be allowed to execute CGI/SSI programs.
+          This is useful to block out "system" groups.
+        </p>
+      </li>
+
+      <li>
+        <strong>Can the wrapper successfully become the target user
+        and group?</strong>
+
+        <p class="indent">
+          Here is where the program becomes the target user and
+          group via setuid and setgid calls. The group access list
+          is also initialized with all of the groups of which the
+          user is a member.
+        </p>
+      </li>
+
+      <li>
+        <strong>Can we change directory to the one in which the target
+        CGI/SSI program resides?</strong>
+
+        <p class="indent">
+          If it doesn't exist, it can't very well contain files. If we
+          can't change directory to it, it might as well not exist.
+        </p>
+      </li>
+
+      <li>
+        <strong>Is the directory within the httpd webspace?</strong>
+
+        <p class="indent">
+          If the request is for a regular portion of the server, is
+          the requested directory within suEXEC's document root? If
+          the request is for a <code class="directive"><a href="./mod/mod_userdir.html#userdir">UserDir</a></code>, is the requested directory
+          within the directory configured as suEXEC's userdir (see
+          <a href="#install">suEXEC's configuration options</a>)?
+        </p>
+      </li>
+
+      <li>
+        <strong>Is the directory <em>NOT</em> writable by anyone
+        else?</strong>
+
+        <p class="indent">
+          We don't want to open up the directory to others; only
+          the owner user may be able to alter this directories
+          contents.
+        </p>
+      </li>
+
+      <li>
+        <strong>Does the target CGI/SSI program exist?</strong>
+
+        <p class="indent">
+          If it doesn't exists, it can't very well be executed.
+        </p>
+      </li>
+
+      <li>
+        <strong>Is the target CGI/SSI program <em>NOT</em> writable
+        by anyone else?</strong>
+
+        <p class="indent">
+          We don't want to give anyone other than the owner the
+          ability to change the CGI/SSI program.
+        </p>
+      </li>
+
+      <li>
+        <strong>Is the target CGI/SSI program <em>NOT</em> setuid or
+        setgid?</strong>
+
+        <p class="indent">
+          We do not want to execute programs that will then change
+          our UID/GID again.
+        </p>
+      </li>
+
+      <li>
+        <strong>Is the target user/group the same as the program's
+        user/group?</strong>
+
+        <p class="indent">
+          Is the user the owner of the file?
+        </p>
+      </li>
+
+      <li>
+        <strong>Can we successfully clean the process environment
+        to ensure safe operations?</strong>
+
+        <p class="indent">
+          suEXEC cleans the process' environment by establishing a
+          safe execution PATH (defined during configuration), as
+          well as only passing through those variables whose names
+          are listed in the safe environment list (also created
+          during configuration).
+        </p>
+      </li>
+
+      <li>
+        <strong>Can we successfully become the target CGI/SSI program
+        and execute?</strong>
+
+        <p class="indent">
+          Here is where suEXEC ends and the target CGI/SSI program begins.
+        </p>
+      </li>
+    </ol>
+
+    <p>This is the standard operation of the
+    suEXEC wrapper's security model. It is somewhat stringent and
+    can impose new limitations and guidelines for CGI/SSI design,
+    but it was developed carefully step-by-step with security in
+    mind.</p>
+
+    <p>For more information as to how this security
+    model can limit your possibilities in regards to server
+    configuration, as well as what security risks can be avoided
+    with a proper suEXEC setup, see the <a href="#jabberwock">"Beware the Jabberwock"</a> section of this
+    document.</p>
+</div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="install" id="install">Configuring &amp; Installing
+    suEXEC</a></h2>
+
+    <p>Here's where we begin the fun.</p>
+
+    <p><strong>suEXEC configuration
+    options</strong><br />
+    </p>
+
+    <dl>
+      <dt><code>--enable-suexec</code></dt>
+
+      <dd>This option enables the suEXEC feature which is never
+      installed or activated by default. At least one
+      <code>--with-suexec-xxxxx</code> option has to be provided
+      together with the <code>--enable-suexec</code> option to let
+      APACI accept your request for using the suEXEC feature.</dd>
+
+      <dt><code>--with-suexec-bin=<em>PATH</em></code></dt>
+
+      <dd>The path to the <code>suexec</code> binary must be hard-coded
+      in the server for security reasons. Use this option to override
+      the default path. <em>e.g.</em>
+      <code>--with-suexec-bin=/usr/sbin/suexec</code></dd>
+
+      <dt><code>--with-suexec-caller=<em>UID</em></code></dt>
+
+      <dd>The <a href="mod/mpm_common.html#user">username</a> under which
+      httpd normally runs. This is the only user allowed to
+      execute the suEXEC wrapper.</dd>
+
+      <dt><code>--with-suexec-userdir=<em>DIR</em></code></dt>
+
+      <dd>Define to be the subdirectory under users' home
+      directories where suEXEC access should be allowed. All
+      executables under this directory will be executable by suEXEC
+      as the user so they should be "safe" programs. If you are
+      using a "simple" <code class="directive"><a href="./mod/mod_userdir.html#userdir">UserDir</a></code>
+      directive (ie. one without a "*" in it) this should be set to the same
+      value. suEXEC will not work properly in cases where the <code class="directive"><a href="./mod/mod_userdir.html#userdir">UserDir</a></code> directive points to
+      a location that is not the same as the user's home directory
+      as referenced in the <code>passwd</code> file. Default value is
+      "<code>public_html</code>".<br />
+      If you have virtual hosts with a different <code class="directive"><a href="./mod/mod_userdir.html#userdir">UserDir</a></code> for each,
+      you will need to define them to all reside in one parent
+      directory; then name that parent directory here. <strong>If
+      this is not defined properly, "~userdir" cgi requests will
+      not work!</strong></dd>
+
+      <dt><code>--with-suexec-docroot=<em>DIR</em></code></dt>
+
+      <dd>Define as the DocumentRoot set for httpd. This will be
+      the only hierarchy (aside from <code class="directive"><a href="./mod/mod_userdir.html#userdir">UserDir</a></code>s) that can be used for suEXEC behavior. The
+      default directory is the <code>--datadir</code> value with the suffix
+      "<code>/htdocs</code>", <em>e.g.</em> if you configure with
+      "<code>--datadir=/home/apache</code>" the directory
+      "<code>/home/apache/htdocs</code>" is used as document root for the
+      suEXEC wrapper.</dd>
+
+      <dt><code>--with-suexec-uidmin=<em>UID</em></code></dt>
+
+      <dd>Define this as the lowest UID allowed to be a target user
+      for suEXEC. For most systems, 500 or 100 is common. Default
+      value is 100.</dd>
+
+      <dt><code>--with-suexec-gidmin=<em>GID</em></code></dt>
+
+      <dd>Define this as the lowest GID allowed to be a target
+      group for suEXEC. For most systems, 100 is common and
+      therefore used as default value.</dd>
+
+      <dt><code>--with-suexec-logfile=<em>FILE</em></code></dt>
+
+      <dd>This defines the filename to which all suEXEC
+      transactions and errors are logged (useful for auditing and
+      debugging purposes). By default the logfile is named
+      "<code>suexec_log</code>" and located in your standard logfile
+      directory (<code>--logfiledir</code>).</dd>
+
+      <dt><code>--with-suexec-safepath=<em>PATH</em></code></dt>
+
+      <dd>Define a safe PATH environment to pass to CGI
+      executables. Default value is
+      "<code>/usr/local/bin:/usr/bin:/bin</code>".</dd>
+    </dl>
+
+    <h3>Compiling and installing the suEXEC wrapper</h3>
+      
+
+      <p>If you have enabled the suEXEC feature with the
+      <code>--enable-suexec</code> option the <code>suexec</code> binary
+      (together with httpd itself) is automatically built if you execute
+      the <code>make</code> command.</p>
+
+      <p>After all components have been built you can execute the
+      command <code>make install</code> to install them. The binary image
+      <code>suexec</code> is installed in the directory defined by the
+      <code>--sbindir</code> option. The default location is
+      "/usr/local/apache2/bin/suexec".</p>
+
+      <p>Please note that you need <strong><em>root
+      privileges</em></strong> for the installation step. In order
+      for the wrapper to set the user ID, it must be installed as
+      owner <code><em>root</em></code> and must have the setuserid
+      execution bit set for file modes.</p>
+    
+
+    <h3>Setting paranoid permissions</h3>
+      
+
+      <p>Although the suEXEC wrapper will check to ensure that its
+      caller is the correct user as specified with the
+      <code>--with-suexec-caller</code> <code class="program"><a href="./programs/configure.html">configure</a></code>
+      option, there is
+      always the possibility that a system or library call suEXEC uses
+      before this check may be exploitable on your system. To counter
+      this, and because it is best-practise in general, you should use
+      filesystem permissions to ensure that only the group httpd
+      runs as may execute suEXEC.</p>
+
+      <p>If for example, your web server is configured to run as:</p>
+
+      <pre class="prettyprint lang-config">User www
+Group webgroup</pre>
+
+
+      <p>and <code class="program"><a href="./programs/suexec.html">suexec</a></code> is installed at
+      "/usr/local/apache2/bin/suexec", you should run:</p>
+
+      <div class="example"><p><code>
+          chgrp webgroup /usr/local/apache2/bin/suexec<br />
+          chmod 4750 /usr/local/apache2/bin/suexec<br />
+      </code></p></div>
+
+      <p>This will ensure that only the group httpd runs as can even
+      execute the suEXEC wrapper.</p>
+    
+</div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="enable" id="enable">Enabling &amp; Disabling
+    suEXEC</a></h2>
+
+    <p>Upon startup of httpd, it looks for the file
+    <code class="program"><a href="./programs/suexec.html">suexec</a></code> in the directory defined by the
+    <code>--sbindir</code> option (default is
+    "/usr/local/apache/sbin/suexec"). If httpd finds a properly
+    configured suEXEC wrapper, it will print the following message
+    to the error log:</p>
+
+<div class="example"><p><code>
+    [notice] suEXEC mechanism enabled (wrapper: <var>/path/to/suexec</var>)
+</code></p></div>
+
+    <p>If you don't see this message at server startup, the server is
+    most likely not finding the wrapper program where it expects
+    it, or the executable is not installed <em>setuid root</em>.</p>
+
+     <p>If you want to enable the suEXEC mechanism for the first time
+    and an Apache HTTP Server is already running you must kill and
+    restart httpd. Restarting it with a simple HUP or USR1 signal
+    will not be enough. </p>
+     <p>If you want to disable suEXEC you should kill and restart
+    httpd after you have removed the <code class="program"><a href="./programs/suexec.html">suexec</a></code> file.</p>
+</div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="usage" id="usage">Using suEXEC</a></h2>
+
+    <p>Requests for CGI programs will call the suEXEC wrapper only if
+    they are for a virtual host containing a <code class="directive"><a href="./mod/mod_suexec.html#suexecusergroup">SuexecUserGroup</a></code> directive or if
+    they are processed by <code class="module"><a href="./mod/mod_userdir.html">mod_userdir</a></code>.</p>
+
+    <p><strong>Virtual Hosts:</strong><br /> One way to use the suEXEC
+    wrapper is through the <code class="directive"><a href="./mod/mod_suexec.html#suexecusergroup">SuexecUserGroup</a></code> directive in
+    <code class="directive"><a href="./mod/core.html#virtualhost">VirtualHost</a></code> definitions.  By
+    setting this directive to values different from the main server
+    user ID, all requests for CGI resources will be executed as the
+    <em>User</em> and <em>Group</em> defined for that <code class="directive"><a href="./mod/core.html#virtualhost">&lt;VirtualHost&gt;</a></code>. If this
+    directive is not specified for a <code class="directive"><a href="./mod/core.html#virtualhost">&lt;VirtualHost&gt;</a></code> then the main server userid
+    is assumed.</p>
+
+    <p><strong>User directories:</strong><br /> Requests that are
+     processed by <code class="module"><a href="./mod/mod_userdir.html">mod_userdir</a></code> will call the suEXEC
+     wrapper to execute CGI programs under the userid of the requested
+     user directory.  The only requirement needed for this feature to
+     work is for CGI execution to be enabled for the user and that the
+     script must meet the scrutiny of the <a href="#model">security
+     checks</a> above.  See also the
+     <code>--with-suexec-userdir</code> <a href="#install">compile
+     time option</a>.</p> </div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="debug" id="debug">Debugging suEXEC</a></h2>
+
+    <p>The suEXEC wrapper will write log information
+    to the file defined with the <code>--with-suexec-logfile</code>
+    option as indicated above. If you feel you have configured and
+    installed the wrapper properly, have a look at this log and the
+    error_log for the server to see where you may have gone astray.</p>
+
+</div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="jabberwock" id="jabberwock">Beware the Jabberwock:
+    Warnings &amp; Examples</a></h2>
+
+    <p><strong>NOTE!</strong> This section may not be
+    complete. For the latest revision of this section of the
+    documentation, see the <a href="http://httpd.apache.org/docs/2.4/suexec.html">Online
+    Documentation</a> version.</p>
+
+    <p>There are a few points of interest regarding
+    the wrapper that can cause limitations on server setup. Please
+    review these before submitting any "bugs" regarding suEXEC.</p>
+
+    <ul>
+      <li><strong>suEXEC Points Of Interest</strong></li>
+
+      <li>
+        Hierarchy limitations
+
+        <p class="indent">
+          For security and efficiency reasons, all suEXEC requests
+          must remain within either a top-level document root for
+          virtual host requests, or one top-level personal document
+          root for userdir requests. For example, if you have four
+          VirtualHosts configured, you would need to structure all
+          of your VHosts' document roots off of one main httpd
+          document hierarchy to take advantage of suEXEC for
+          VirtualHosts. (Example forthcoming.)
+        </p>
+      </li>
+
+      <li>
+        suEXEC's PATH environment variable
+
+        <p class="indent">
+          This can be a dangerous thing to change. Make certain
+          every path you include in this define is a
+          <strong>trusted</strong> directory. You don't want to
+          open people up to having someone from across the world
+          running a trojan horse on them.
+        </p>
+      </li>
+
+      <li>
+        Altering the suEXEC code
+
+        <p class="indent">
+          Again, this can cause <strong>Big Trouble</strong> if you
+          try this without knowing what you are doing. Stay away
+          from it if at all possible.
+        </p>
+      </li>
+    </ul>
+
+</div></div>
+<div class="bottomlang">
+<p><span>Available Languages: </span><a href="./en/suexec.html" title="English">&nbsp;en&nbsp;</a> |
+<a href="./fr/suexec.html" hreflang="fr" rel="alternate" title="Fran�ais">&nbsp;fr&nbsp;</a> |
+<a href="./ja/suexec.html" hreflang="ja" rel="alternate" title="Japanese">&nbsp;ja&nbsp;</a> |
+<a href="./ko/suexec.html" hreflang="ko" rel="alternate" title="Korean">&nbsp;ko&nbsp;</a> |
+<a href="./tr/suexec.html" hreflang="tr" rel="alternate" title="T�rk�e">&nbsp;tr&nbsp;</a></p>
+</div><div class="top"><a href="#page-header"><img src="./images/up.gif" alt="top" /></a></div><div class="section"><h2><a id="comments_section" name="comments_section">Comments</a></h2><div class="warning"><strong>Notice:</strong><br />This is not a Q&amp;A section. Comments placed here should be pointed towards suggestions on improving the documentation or server, and may be removed again by our moderators if they are either implemented or considered invalid/off-topic. Questions on how to manage the Apache HTTP Server should be directed at either our IRC channel, #httpd, on Freenode, or sent to our <a href="http://httpd.apache.org/lists.html">mailing lists</a>.</div>
+<script type="text/javascript"><!--//--><![CDATA[//><!--
+var comments_shortname = 'httpd';
+var comments_identifier = 'http://httpd.apache.org/docs/2.4/suexec.html';
+(function(w, d) {
+    if (w.location.hostname.toLowerCase() == "httpd.apache.org") {
+        d.write('<div id="comments_thread"><\/div>');
+        var s = d.createElement('script');
+        s.type = 'text/javascript';
+        s.async = true;
+        s.src = 'https://comments.apache.org/show_comments.lua?site=' + comments_shortname + '&page=' + comments_identifier;
+        (d.getElementsByTagName('head')[0] || d.getElementsByTagName('body')[0]).appendChild(s);
+    }
+    else { 
+        d.write('<div id="comments_thread">Comments are disabled for this page at the moment.<\/div>');
+    }
+})(window, document);
+//--><!]]></script></div><div id="footer">
+<p class="apache">Copyright 2016 The Apache Software Foundation.<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p>
+<p class="menu"><a href="./mod/">Modules</a> | <a href="./mod/directives.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="./glossary.html">Glossary</a> | <a href="./sitemap.html">Sitemap</a></p></div><script type="text/javascript"><!--//--><![CDATA[//><!--
+if (typeof(prettyPrint) !== 'undefined') {
+    prettyPrint();
+}
+//--><!]]></script>
+</body></html>
\ No newline at end of file
diff --git a/docs/manual/suexec.html.fr b/docs/manual/suexec.html.fr
new file mode 100644
index 0000000..e4d47de
--- /dev/null
+++ b/docs/manual/suexec.html.fr
@@ -0,0 +1,689 @@
+<?xml version="1.0" encoding="ISO-8859-1"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" lang="fr" xml:lang="fr"><head>
+<meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type" />
+<!--
+        XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+              This file is generated from xml source: DO NOT EDIT
+        XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+      -->
+<title>Support suEXEC - Serveur Apache HTTP Version 2.4</title>
+<link href="./style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" />
+<link href="./style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" />
+<link href="./style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" /><link rel="stylesheet" type="text/css" href="./style/css/prettify.css" />
+<script src="./style/scripts/prettify.min.js" type="text/javascript">
+</script>
+
+<link href="./images/favicon.ico" rel="shortcut icon" /></head>
+<body id="manual-page"><div id="page-header">
+<p class="menu"><a href="./mod/">Modules</a> | <a href="./mod/directives.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="./glossary.html">Glossaire</a> | <a href="./sitemap.html">Plan du site</a></p>
+<p class="apache">Serveur Apache HTTP Version 2.4</p>
+<img alt="" src="./images/feather.png" /></div>
+<div class="up"><a href="./"><img title="&lt;-" alt="&lt;-" src="./images/left.gif" /></a></div>
+<div id="path">
+<a href="http://www.apache.org/">Apache</a> &gt; <a href="http://httpd.apache.org/">Serveur HTTP</a> &gt; <a href="http://httpd.apache.org/docs/">Documentation</a> &gt; <a href="./">Version 2.4</a></div><div id="page-content"><div id="preamble"><h1>Support suEXEC</h1>
+<div class="toplang">
+<p><span>Langues Disponibles: </span><a href="./en/suexec.html" hreflang="en" rel="alternate" title="English">&nbsp;en&nbsp;</a> |
+<a href="./fr/suexec.html" title="Fran�ais">&nbsp;fr&nbsp;</a> |
+<a href="./ja/suexec.html" hreflang="ja" rel="alternate" title="Japanese">&nbsp;ja&nbsp;</a> |
+<a href="./ko/suexec.html" hreflang="ko" rel="alternate" title="Korean">&nbsp;ko&nbsp;</a> |
+<a href="./tr/suexec.html" hreflang="tr" rel="alternate" title="T�rk�e">&nbsp;tr&nbsp;</a></p>
+</div>
+
+    <p>La fonctionnalit� <strong>suEXEC</strong> permet
+    l'ex�cution des programmes <strong>CGI</strong> et
+    <strong>SSI</strong> sous un utilisateur autre que celui sous
+    lequel s'ex�cute le serveur web qui appelle ces programmes.
+    Normalement, lorsqu'un programme CGI ou SSI est lanc�, il
+    s'ex�cute sous le m�me utilisateur que celui du serveur web qui
+    l'appelle.</p>
+
+    <p>Utilis�e de mani�re appropri�e, cette fonctionnalit� peut
+    r�duire consid�rablement les risques de s�curit� encourus
+    lorsqu'on autorise les utilisateurs � d�velopper et faire
+    s'ex�cuter des programmes CGI ou SSI de leur cru. Cependant, mal
+    configur�, suEXEC peut causer de nombreux probl�mes et m�me cr�er
+    de nouvelles failles dans la s�curit� de votre ordinateur. Si
+    vous n'�tes pas familier avec la gestion des programmes
+    <em>setuid root</em> et les risques de s�curit� qu'ils comportent,
+    nous vous recommandons vivement de ne pas tenter
+    d'utiliser suEXEC.</p>
+  </div>
+<div id="quickview"><ul id="toc"><li><img alt="" src="./images/down.gif" /> <a href="#before">Avant de commencer</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#model">Mod�le de s�curit� de suEXEC</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#install">Configurer et installer suEXEC</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#enable">Activation et d�sactivation
+de suEXEC</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#usage">Utilisation de suEXEC</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#debug">D�bogage de suEXEC</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#jabberwock">Avis � la population !
+    Avertissements et exemples</a></li>
+</ul><h3>Voir aussi</h3><ul class="seealso"><li><a href="#comments_section">Commentaires</a></li></ul></div>
+<div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="before" id="before">Avant de commencer</a></h2>
+
+    <p>Avant de foncer t�te baiss�e dans la lecture de ce document,
+    vous devez tenir compte de certaines hypoth�ses concernant vous-m�me
+    et l'environnement dans lequel vous allez utiliser suexec.</p>
+
+    <p>Premi�rement, vous devez utiliser un syst�me d'exploitation
+    UNIX ou d�riv�, capable d'effectuer des op�rations
+    <strong>setuid</strong> et <strong>setgid</strong>. Tous les
+    exemples de commande sont donn�s en cons�quence. D'autres
+    plates-formes, m�me si elles supportent suEXEC, peuvent
+    avoir une configuration diff�rente.</p>
+
+    <p>Deuxi�mement, vous devez �tre familier avec les concepts de base
+    relatifs � la s�curit� de votre ordinateur et son administration.
+    Ceci implique la compr�hension des op�rations
+    <strong>setuid/setgid</strong> et des diff�rents effets qu'elles
+    peuvent produire sur votre syst�me et son niveau de s�curit�.</p>
+
+    <p>Troisi�mement, vous devez utiliser une version
+    <strong>non modifi�e</strong> du code de suEXEC. L'ensemble du
+    code de suEXEC a �t� scrut� et test� avec soin par les d�veloppeurs
+    et de nombreux b�ta testeurs. Toutes les pr�cautions ont �t� prises
+    pour s'assurer d'une base s�re de code non seulement simple, mais
+    aussi solide. La modification de ce code peut causer des probl�mes
+    inattendus et de nouveaux risques de s�curit�. Il est
+    <strong>vivement</strong> recommand� de ne pas modifier le code de
+    suEXEC, � moins que vous ne soyez un programmeur sp�cialiste des
+    particularit�s li�es � la s�curit�, et souhaitez partager votre
+    travail avec l'�quipe de d�veloppement du serveur HTTP Apache afin
+    de pouvoir en discuter.</p>
+
+    <p>Quatri�mement et derni�rement, l'�quipe de d�veloppement du
+    serveur HTTP Apache a d�cid� de ne
+    <strong>PAS</strong> inclure suEXEC dans l'installation par d�faut
+    d'Apache httpd. Pour pouvoir mettre en oeuvre suEXEC, l'administrateur
+    doit porter la plus grande attention aux d�tails. Apr�s avoir bien
+    r�fl�chi aux diff�rents points de la configuration de suEXEC,
+    l'administrateur peut l'installer selon les m�thodes classiques.
+    Les valeurs des param�tres de configuration doivent �tre
+    d�termin�es et sp�cifi�es avec soin par l'administrateur, afin de
+    maintenir la s�curit� du syst�me de mani�re appropri�e lors de
+    l'utilisation de la fonctionnalit� suEXEC. C'est par le biais de
+    ce processus minutieux que nous esp�rons r�server
+    l'installation de suEXEC aux administrateurs prudents et
+    suffisamment d�termin�s � vouloir l'utiliser.</p>
+
+    <p>Vous �tes encore avec nous ? Oui ? Bien.
+    Alors nous pouvons continuer !</p>
+</div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="model" id="model">Mod�le de s�curit� de suEXEC</a></h2>
+
+    <p>Avant d'installer et configurer suEXEC, nous allons tout d'abord
+    d�crire le mod�le de s�curit� que vous �tes sur le point
+    d'impl�menter. Vous devriez ainsi mieux comprendre ce qui se passe
+    vraiment � l'int�rieur de suEXEC et quelles pr�cautions ont �t�
+    prises pour pr�server la s�curit� de votre syst�me.</p>
+
+    <p><strong>suEXEC</strong> est bas� sur un programme "conteneur"
+    (wrapper) setuid qui est appel� par le serveur HTTP Apache principal.
+    Ce conteneur est appel� quand une requ�te HTTP concerne
+    un programme CGI ou SSI que l'administrateur
+    a d�cid� de faire s'ex�cuter
+    sous un utilisateur autre que celui du serveur principal.
+    Lorsqu'il re�oit une telle requ�te, Apache httpd fournit au conteneur
+    suEXEC le nom du programme, ainsi que les identifiants utilisateur
+    et groupe sous lesquels le programme doit s'ex�cuter.</p>
+
+    <p>Le conteneur effectue ensuite les v�rifications suivantes afin
+    de d�terminer la r�ussite ou l'�chec du processus -- si une seule
+    de ces conditions n'est pas v�rifi�e, le programme journalise
+    l'erreur et se termine en retournant un code d'erreur, sinon il
+    continue :</p>
+
+    <ol>
+      <li>
+        <strong>L'utilisateur qui ex�cute le conteneur est-il un
+	utilisateur valide de ce syst�me ?</strong>
+
+        <p class="indent">
+          Ceci permet de s'assurer que l'utilisateur qui ex�cute le
+	  conteneur est vraiment un utilisateur appartenant au syst�me.
+        </p>
+     </li>
+
+     <li>
+        <strong>Le conteneur a-t-il �t� appel� avec un nombre
+	d'arguments correct ?</strong>
+
+        <p class="indent">
+          Le conteneur ne s'ex�cutera que si on lui fournit un nombre
+	  d'arguments correct. Le serveur HTTP apache sait quel est le
+	  bon format des arguments. Si le conteneur ne re�oit pas un
+	  nombre d'arguments correct, soit il a �t� modifi�,
+	  soit quelque chose ne va pas dans la portion suEXEC de
+	  votre binaire Apache httpd.
+        </p>
+      </li>
+
+      <li>
+        <strong>Cet utilisateur valide est-il autoris� � ex�cuter le
+	conteneur ?</strong>
+
+        <p class="indent">
+          Cet utilisateur est-il celui autoris� � ex�cuter le
+	  conteneur ? Un seul utilisateur (celui d'Apache) est
+	  autoris� � ex�cuter ce programme.
+        </p>
+      </li>
+
+      <li>
+        <strong>Le chemin du programme CGI ou SSI cible est-il
+	non s�r ?</strong>
+
+        <p class="indent">
+          Le chemin du programme CGI ou SSI cible d�bute-t-il par un
+	  '/' ou contient-il une r�f�rence arri�re '..' ? Ceci est
+	  interdit ; le programme CGI ou SSI cible doit se trouver dans
+	  la hi�rarchie de la racine des documents de suEXEC (voir
+	  <code>--with-suexec-docroot=<em>DIR</em></code> ci-dessous).
+        </p>
+      </li>
+
+      <li>
+        <strong>Le nom utilisateur cible est-il valide ?</strong>
+
+        <p class="indent">
+          L'utilisateur cible existe-t-il ?
+        </p>
+      </li>
+
+      <li>
+        <strong>Le nom du groupe cible est-il valide ?</strong>
+
+        <p class="indent">
+          Le groupe cible existe-t-il ?
+        </p>
+      </li>
+
+      <li>
+        <strong>L'utilisateur cible n'est-il <em>PAS</em>
+	superutilisateur ?</strong>
+
+
+        <p class="indent">
+          suEXEc ne permet pas �
+	  <code><em>root</em></code> d'ex�cuter des programmes CGI/SSI.
+        </p>
+      </li>
+
+      <li>
+        <strong>Le num�ro de l'identifiant de l'utilisateur cible
+	est-il <em>SUPERIEUR</em> au num�ro d'identifiant
+	minimum ?</strong>
+
+        <p class="indent">
+          Le num�ro d'identifiant utilisateur minimum est d�fini �
+	  l'ex�cution du script configure. Ceci vous permet de d�finir
+	  le num�ro d'identifiant utilisateur le plus bas qui sera
+	  autoris� � �x�cuter des programmes CGI/SSI. En particulier,
+	  cela permet d'�carter les comptes syst�me.
+        </p>
+      </li>
+
+      <li>
+        <strong>Le groupe cible n'est-il <em>PAS</em> le groupe
+	superutilisateur ?</strong>
+
+        <p class="indent">
+          Actuellement, suEXEC ne permet pas au groupe
+	  <code><em>root</em></code> d'ex�cuter des programmes CGI/SSI.
+        </p>
+      </li>
+
+      <li>
+        <strong> Le num�ro d'identifiant du groupe cible est-il
+	<em>SUPERIEUR</em> au num�ro d'identifiant minimum ?</strong>
+
+        <p class="indent">
+          Le num�ro d'identifiant de groupe minimum est sp�cifi� lors
+	  de l'ex�cution du script configure. Ceci vous permet de
+	  d�finir l'identifiant de groupe le plus bas possible qui sera
+	  autoris� � ex�cuter des programmes CGI/SSI, et est
+	  particuli�rement utile pour �carter les groupes "syst�me".
+        </p>
+      </li>
+
+      <li>
+        <strong>Le conteneur peut-il obtenir avec succ�s l'identit�
+	des utilisateur et groupe cibles ?</strong>
+
+        <p class="indent">
+          C'est ici que le programme obtient l'identit� des utilisateur
+	  et groupe cibles via des appels � setuid et setgid. De m�me,
+	  la liste des acc�s groupe est initialis�e avec tous les
+	  groupes auxquels l'utilisateur cible appartient.
+        </p>
+      </li>
+
+      <li>
+        <strong>Peut-on se positionner dans le r�pertoire dans dequel
+	sont situ�s les programmes CGI/SSI ?</strong>
+
+        <p class="indent">
+          S'il n'existe pas, il ne peut pas contenir de fichier. Et si
+	  l'on ne peut pas s'y positionner, il n'existe probablement
+	  pas.
+        </p>
+      </li>
+
+      <li>
+        <strong>Le r�pertoire est-il dans l'espace web
+	de httpd ?</strong>
+
+        <p class="indent">
+          Si la requ�te concerne une portion de la racine du serveur,
+	  le r�pertoire demand� est-il dans la hi�rarchie de la racine
+	  des documents de suEXEC ? Si la requ�te concerne un
+	 <code class="directive"><a href="./mod/mod_userdir.html#userdir">UserDir</a></code>, le r�pertoire demand� est-il dans
+	  la hi�rarchie du r�pertoire d�fini comme le r�pertoire
+	  utilisateur de suEXEC (voir les
+	  <a href="#install">options de configuration de suEXEC</a>) ?
+        </p>
+      </li>
+
+      <li>
+        <strong>L'�criture dans le r�pertoire est-elle interdite pour
+	un utilisateur autre que le propri�taire </strong>
+
+        <p class="indent">
+          Le r�pertoire ne doit pas �tre ouvert aux autres
+	  utilisateurs ; seul l'utilisateur propri�taire doit pouvoir
+	  modifier le contenu du r�pertoire.
+        </p>
+      </li>
+
+      <li>
+        <strong>Le programme CGI/SSI cible existe-t-il ?</strong>
+
+        <p class="indent">
+          S'il n'existe pas, il ne peut pas �tre ex�cut�.
+        </p>
+      </li>
+
+      <li>
+        <strong>Les utilisateurs autres que le propri�taire n'ont-ils
+	<em>PAS</em> de droits en �criture sur le programme
+	CGI/SSI ?</strong>
+
+        <p class="indent">
+          Les utilisateurs autres que le propri�taire ne doivent pas
+	  pouvoir modifier le programme CGI/SSI.
+        </p>
+      </li>
+
+      <li>
+        <strong>Le programme CGI/SSI n'est-il <em>PAS</em> setuid ou
+	setgid ?</strong>
+
+        <p class="indent">
+          Les programmes cibles ne doivent pas pouvoir modifier �
+	  nouveau les identifiants utilisateur/groupe.
+        </p>
+      </li>
+
+      <li>
+        <strong>Le couple utilisateur/groupe cible est-il le m�me que
+	celui du programme ?</strong>
+
+        <p class="indent">
+          L'utilisateur est-il le propri�taire du fichier ?
+        </p>
+      </li>
+
+      <li>
+        <strong>Peut-on nettoyer avec succ�s l'environnement des
+	processus afin de garantir la s�ret� des op�rations ?</strong>
+
+        <p class="indent">
+          suExec nettoie l'environnement des processus en �tablissant
+	  un chemin d'ex�cution s�r (d�fini lors de la configuration),
+	  et en ne passant que les variables dont les noms font partie
+	  de la liste de l'environnement s�r (cr��e de m�me lors de la
+	  configuration).
+        </p>
+      </li>
+
+      <li>
+        <strong>Le conteneur peut-il avec succ�s se substituer au
+	programme CGI/SSI cible et s'ex�cuter ?</strong>
+
+        <p class="indent">
+          C'est l� o� l'ex�cution de suEXEC s'arr�te et o� commence
+	  celle du programme CGI/ssi cible.
+        </p>
+      </li>
+    </ol>
+
+    <p>Ce sont les op�rations standards effectu�es par le mod�le de
+    s�curit� du conteneur suEXEC. Il peut para�tre strict et est
+    susceptible d'imposer de nouvelles limitations et orientations
+    dans la conception des programmes CGI/SSI, mais il a �t� d�velopp�
+    avec le plus grand soin, �tape par �tape, en se focalisant sur
+    la s�curit�.</p>
+
+    <p>Pour plus d'informations sur la mesure dans laquelle ce mod�le
+    de s�curit� peut limiter vos possibilit�s au regard de la
+    configuration du serveur, ainsi que les risques de s�curit� qui
+    peuvent �tre �vit�s gr�ce � une configuration appropri�e de suEXEC,
+    se r�f�rer � la section <a href="#jabberwock">"Avis � la population !"</a> de ce document.</p>
+</div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="install" id="install">Configurer et installer suEXEC</a></h2>
+
+    <p>C'est ici que nous entrons dans le vif du sujet.</p>
+