Changes in Version 0.24.0.0 (from previous public release 0.22.0.1)
-------------------------------------------------------------------

o Started keeping notes about what changed in each version.

o Removed the word "Alpha" from the version number. This is a cosmetic change 
  only.

o Added web based Administration Console (HoTTProxy_Admin) to simplify 
  administration. HoTTProxy_Admin provides its own HTTP daemon and listens 
  on its own configurable port number (default is 8085). HoTTProxy_Admin 
  accepts requests from localhost only and has no built in security. With 
  the Administration Console you can do the following:
  
     1. Add users
     2. Delete users
     3. Edit users
     4. View cookies of any user
     5. View the HoTTProxy log
     6. Change basic HoTTProxy settings

o Fixed a bug that would have caused passwords with a colon in them to fail 
  to match (replaced "split" with a regex).

o Added code to clean up user supplied username to eliminate any potential 
  vulnerability that may have existed by not doing so.  These characters 
  are now not legal in a HoTTProxy username \/:+*?"<>|&` the space character, 
  and 0x00-0x21 (\x00-\x21 is a range of characters in hex notation).
 
o Added HTTP_Proxy_Module_Logmask and HTTP_Proxy_Module_Logfile options to 
  the configuration file to control logging by the underlying 
  HTTP::Proxy module -- helpful for troubleshooting or debugging new 
  code. See HoTTProxy.conf for more details.

o Worked with the author of the HTTP::Proxy module to build support for 
  unknown schemes into the standard distribution of the module. Based on 
  these updates, we now can redirect the Alltel 'proxy:homepage' homepage 
  setting (just as we do for Verizon's 'http://homepage'). Changed 
  HoTTProxy to require version 0.16 or later of HTTP::Proxy (first 
  version with the new code).

o On Win32, changed the frontslash in the CookieDirectory setting to be a 
  backslash. This is purely cosmetic, but was a source of confusion for some.

o Added feature to detect and report (on the console) the private (local) 
	and public IP address of the machine running HoTTProxy.

o Added a check and warning at startup time if no .user or .password files 
  are found. Since HoTTProxy is specifically programmed not to run "open" 
  (without authentication), if there are no .user or .password files, then 
  no user accounts have been created, and thus it is sort of pointless to 
  run the program.

o Added ability to set expiration dates for accounts. If the current date 
  is equal to or greater than the expiration date for an account, the 
  proxy will deny access to that user.

o Added new type of user account file. The old .password account files still 
  work, but the new type '.user' is the default.  The only difference is that 
  in the .user files, instead of the cleartext user password being the first 
  line, the MD5 hash of the user's password is the first line. If you are 
  using the new Administration Console, this is handled for you. If you are 
  creating user accounts "by hand", you should probably continue to use the 
  .password files with cleartext passwords to avoid error.

o Added optional [User Details] section to .user and .password files to 
  store more details about the user. Has no effect on the proxy, but is 
  displayed by the Administration Console and makes keeping track of lots 
  of users easier.

o Fixed cosmetic bug where multi-item .conf file elements would be reported 
  as '(HASH....)' on console instead of showing the individual items.

o Fixed bug where if a multi-item .conf file element was configured with only 
  a single value, it would be put into memory not as a multi but as a regular 
  element (which would cause the item to fail to have an effect). Now, any 
  element whose name ends with 's' is forced to be a multi even if it only 
  has one value (e.g. TrustedDomains, ValidLocalHosts). Now multi-item 
  elements are denoted on the console with a '+' before the element name.

o Fixed bug where if HoTTProxy was installed in a directory containing 
  whitespace in the path, "globbing" of files would fail. Changed to 
  bsd_glob instead of glob as it ignores whitespace.

o Added ValidLocalHosts .conf file element which accepts a list of valid 
  local host names. By "valid" we mean that there really is a host that is 
  on the local network with the HoTTProxy by that name, or that the name 
  will in some way resolve to a valid host, and we want to be able to access 
  web resources on that device without HoTTProxy doing a redirect to the 
  user's home page.

o Added DisableLocalHostRedirection .conf file element. If set to "true" 
  (greater than zero) redirection of requests for a local host (a.k.a. a 
  ".local" domain) will *not* be redirected to the configured home page. 
  Obviously if your phone then requests http://homepage, and this item is 
  set, you should ensure that http://homepage resolves to some local or 
  public resource via a hosts file mapping, etc.

o Added ability to specify which (if any) .conf file elements should not 
  appear on the HoTTProxy console by putting a minus sign ('-') before the 
  element name. Changed default .conf file to hide elements that aren't 
  important to troubleshooting, etc.

o Changed the format of "Cookie" and "Set-Cookie" log entries (only present 
  when LogDetail is turned on) to match other log entries.

o All logging and time reporting is now in local time to the server instead 
  of in GMT.


NOTES:

o If you use the configuration editor in the Admin Console to edit a value
  that has been tagged as "hidden" (with the minus sign), it will get 
  unhidden. Shouldn't be an issue as none of the items it edits are hidden 
  by default.


NEW MODULES USED BY 0.24.0.0 NOT USED BY 0.22.0.1:

o Date::Calc
o HTTP::Proxy 0.16 (version didn't matter before)
o Digest::MD5
o File::Glob


THINGS TO DO IN THE NEXT RELEASE:

o Add "clear log", and "save log" buttons to the "view log" screen.

o Review "print STDERR" lines and see if they should be changed to "say" and 
  if so, what level.

o Any way to give a response to someone that browses to http://hostname:9201 
  (which is an invalid thing to do by the way).

o Add ability to run admin console from other than local host - permit access 
  by user or IP address.

o See if you can come up with some post-analysis tool to look for people 
  sharing passwords.
