# WebKit 0.9.3 Release Notes

WebKit version 0.9.3 released on 04/26/07

## Introduction

This release comprises a lot of small bugfixes, changes and cleanup in WebKit, in an attempt to straighten out some irregularities before the 1.0 version is released. Not all of these small changes can be listed here.

## New Features

- It is now possible to set up custom error pages for HTTP errors and any other exceptions raised in Webware servlets. This is controlled by the `ErrorPage` setting in Application.config and described in the Configuration Guide.

## Improvements and Refinements

- Added JSON-RPC base class and usage example (as suggested by Jean-Francois Pieronne).
- HTTPResponse now sends status code 500 in case an error has occurred (suggested by Veros Kaplan).
- Optimized uploading of large files with the built-in HTTPServer (as suggested by Dan Milstein).
- Some improvements, hints and updates for easier compilation of mod_webkit (renamed to mod_webkit1) and mod_webkit2. Created fresh mod_webkit.dll files for Windows.
- Do not move "one-shot sessions" (usually created by crawler bots) to FileStore on periodical clean-up (patch submitted by Veros Kaplan).
- Changed `cleanStaleSessions()` to iterate over the keys, rather than the items, so that it will not load all sessions into memory (patch submitted by Ben Parker).
- Made the request queue and buffer size and the response buffer size configurable via the settings `RequestQueueSize`, `RequestBufferSize` and `ResponseBufferSize` in AppServer.config.
- New methods `SessionTimeout()`, `SessionPrefix()`, `SessionName()` and `SessionCookiePath()` have been introduced, which can be replaced with variants which are dependent on the transaction. This can be used to implement a different behavior for different contexts (suggested by Michael Hanselmann).
- The `Session` and `SessionStore` classes are now configurable via the settings `SessionModule` and `SessionStore` in Application.config (as suggested by Ben Parker).
- If there is a root `Docs` context, then contexts for the Docs of all plug-ins are added automatically when they are loaded. The same mechanism was already used for the `Examples` context.

## Security

- WebKit now by default uses the servlet path instead of root for the cookie path. This separates sessions if you run several applications in parallel and also improves the security of the application. You can change this by replacing the `sessionCookiePath()` method.
- Fixed security issue in `HTTPExceptions`: With older web browsers it could be exploited that the URI in the 404 page was not properly encoded (report with fix by Michael Hanselmann).
- Added some security measures against "JavaScript hijacking" to the JSON-RPC servlet base class (implemented by Jean-Francois Pieronne and Christoph Zwerschke).

## Minor Changes

- Changed the names of the pid and address files for more consistency and clarity:

  old name | new name
  --- | ---
  webkit.pid | unchanged
  appserverpid.txt | appserver.pid
  monitorpid.txt | monitor.pid
  address.text | adapter.address
  monitor.text | monitor.address
  http.text | http.address

## Bugfixes

- `ImportSpy` (and thus the `AutoReload` feature) did not work correctly with Python 2.5.
- Using `psp-handler` for PSP pages outside a Webware context did not work; this has been fixed (bug report by Fionn Behrens).
- Fixed and improved CGIAdapter and OneShotAdapter (also solving the CGI Adapter problem reported by Mico Siahaan).
- Fixed a bug in `HTTPRequest`: empty `FieldStorage` is False (reported by Jean-Francois Pieronne).
- Fixed bug in `normURL` function (patch by Veros Kaplan).
- Fixed bug regarding aborted connections (reported by Stephan Diehl).
- Made sure servlets are always returned to their pool.