The new Access Control Permissions methodology simplifies the process of setting up security with PowerWeb. Instead of requiring the administrator to learn about the capabilities and affects of each command within each Internet Protocol, the new security model uses a unified approach which deals with affects rather than commands.

The User Permissions page has been improved to show this new model and also allows direct hyperlinks to the Access Control Rules for each Resource. Also, when editing a Template's Access Control Rules, you are shown a list of the Resources that use that Template, making it clearer what affect your changes will have.

The security permissions have been categorised into "attributes", "create", "delete", "list", "permissions", "read", "write", "execute", "append" and "sub-directories", making security work similarly to common LAN implementations.

Your old Access Control Rules are automatically migrated to the new method of working, however, with the new simplified model you may find opportunity for improving your Access Control Rules through combining rules or modifying them slightly.

It is highly recommended that you Upgrade the Standard PowerWeb Templates, but please read the notes contained on that page first.

PowerWeb now includes fully integrated database support allowing for rapid application development, all within HTML and without having to learn the intricacies of each database vendor's programming interface. Sybase, Microsoft SQL Server and IBM DB/2 are currently supported. Please read the Database Reference Manual for further information.

With the new Ripple Service you can now have your server AutoMagically updated whenever a new release of PowerWeb is available.

A new User Editor simplifies the management of realms, groups, users and aliases by coordinating the editing within one screen and allowing several common operations to be performed with a single SUBMIT.

The Audit and User-Agent logs now include a field that specifies the incoming local IP address on the server, making it easier to compute statistics for multi-homed servers.

The new Directory Map WebMacro allows you to publish a secure, always up-to-date map of the public directories of your site to your users.

The AutoMagic Access Counters now support date and time stamping so you can see when the counters were last reset. Use the "attrib" attribute to extract the datestamp.

Counters defined with previous PowerWeb versions will have their datestamp initially set to the time the server was started.

Counters now support all service access protocols, such as HTTP and FTP. You can query counts for each service independently or query the total access count. Use the "service" attribute to specify which value to display.

Using InSide HTML © technology, you can now mix and match languages directly within your HTML document, making it considerably easier to create and manage custom applications. You can freely mix WebPerl, WebRexx and WebMacros code within your HTML, using the language most appropriate to your solution.

WebPerl has arrived with the full power of the PowerWeb API function interface and none of the overhead of CGI! In our tests, WebPerl is typically 3 times faster than WebRexx, but compiled C is about 3 times faster than WebPerl. So you can choose your language - the APIs are consistent across all languages.

A new multi-home IP address wizard has been added to automate the creation of multiple IP addresses for a single network card.

The documentation for creating custom applications with PowerWeb has been considerably restructured and improved, reflecting the increased power now available.

Three new WebMacros are now available: Call, Loop, and Script, which are used to create and call embedded WebScripts. You will also want to read preview documentation on the Database WebMacro which integrates with WebScripts.

A new User Tree shows an overview of all users defined on the server, categorised by Realm and Group, also showing all affected Resources.

Added Proxy Chaining to allow PowerWeb when acting as a Proxy Server to conditionally chain to another Proxy Server. This is useful when PowerWeb is serving on an internal intranet and you need to allow external Internet connectivity. With these settings you can make your client browsers point to PowerWeb as the proxy and have PowerWeb relay all non-internal requests to a second firewall server.

Fixed a compatibility problem with Netscape browsers and some pages that contain many graphics images.

For NEW installations, the HTTP and FTP document roots now point to the same directory, and the UserDirectory setting is now "~User" so that users can have their own directories without needing to specify a tilde "~" in front of their directory names.

The configuration of the server has been substantially revised to make it easier to understand and work with. Several new views of the configuration are available which allow an interactive overview of your settings. There is also a new WorkFlow Wizard which guides you through the various configuration pages.

New security management features have been added to show a user-centric view of the server. You can view and modify the access rights of an anonymous user, or of a specified authenticated user, or group of users.

Document and Access Counter Trees now feature dynamic expansion of directories, to overcome large HTML pages being generated for sites with many documents.

AutoMagic User Directories are a new feature. There is no longer any setup or configuration required to provide each of your users with a private directory from which to serve documents. By default, the directory \powerweb\usr is used to hold all user directories. Users have full access rights to their own directory, but to no other directory. This allows users to maintain their own web pages by using FTP. Refer to the FAQ for more details.

User Directories are only created the first time the user attempts to access their own directory. A user can access another user's directory, but will only have read access, as determined by the PublicMacro Template, which is assigned to the Resource controlling the parent directory of the user directories.

If you wish to change the access control rules for a specific user, go through the same process as you would for a normal resource directory. i.e. you do this by finding the user's home directory name in the Directory Tree and defining a resource for that directory and changing that directory's access control rules.

If you wish to apply the same rule to all user directories, create a new Template based on the PublicMacro Template and change the access rules for the user directories' parent directory.

A user directory is accessed by prefixing the user's name by a tilde (~) character. For example, user admin's directory is accessed by "/~admin". User directories work across all services, including HTTP and FTP. Read about FTP user home directories in the FAQ.

To change the default user directory location, go to "Services" and then choose "Common Settings" for each affected service. The setting to change is named "UserDir". You will also need to use the Resource Editor to allow other users read access to that directory, by assigning it the "Default" or "PublicMacro" Template.

The FTP server now AutoMagically places authenticated users into their own home directory immediately upon logon. Anonymous users are placed into the FTP document root directory.

The rename and restart commands within the FTP service have been fixed. Unix compatibility has been improved, so FTP client programs such as NCFTP work better with PowerWeb. If your FTP client software does not recognise PowerWeb's output correctly, try setting your FTP client to UNIX compatibility mode.

The FTP service now supports a new API hook which allows for customised logon processing. The UserAuthentication Hook is called when the User logs on. In addition, whenever a new Resource is accessed, the User is re-Authenticated according to the Realm or UserAuthentication Hook for that Resource. This prevents any security leaks for the case where the same User name is defined in multiple Realms, but with varying privileges.

Automatic Fast Page Access Counters with customisable text or graphic display output have been added to this release. Documents must simply include a Web Macro such as <!--#Counter--> within the HTML.

PowerWeb counters have automatic anti-counter-terrorism built-in.

The counters work regardless of whether the user has graphics switched on or not (unlike most other counter implementations) and are very fast with almost zero performance impact (achieved through usage of an API hook which eliminates the CGI overhead of common add-on solutions). The counters also work on non-HTML files, so you can keep access counts on files used for download or images too.

You can choose which documents have attached page access counters, and see a summary view of the number of accesses of your documents. The summary view will be empty if you have not specified any documents to track. Changes to the set of documents to track take place immediately - there is no need to save the configuration and restart the server.

User-Agent and Referer Logs are now supported. They are switched off by default because of the performance penalty. To enable these logs, or to change the location of the log files, go to the main /admin page, choose "Services" and then "Auditing" for the relevant service. The settings "LogReferer" and "LogUserAgent" control whether logging is enabled. You can view the current status of the logs from the /admin page and choosing "Logs".

There is a new directory and file structure which allows for easier upgrading of PowerWeb from one version to another. All PowerWeb distribution files are kept in a "system" directory underneath the Server Root directory. This "system" directory name will change from version to version. The naming convention that will be adopted is "sys207" for version 2.07 and "sys207.r4" for release 4 of version 2.07, with subsequent releases following the same pattern.

You MUST NOT add any of your own files under this "system" directory, as they could be deleted by future upgrades. API Extension DLLs can remain in the existing \powerweb\bin directory and are automatically added to the operating system's LIBPATH on PowerWeb startup.

There is a batch file named "\powerweb\system\bin\cleanold.cmd" which will assist you in removing files left over from versions prior to 2.07 - it will not remove any of your own additional files.

The HTTP service now supports the "Keep-Alive" feature found in the draft HTTP/1.1 proposal to speed the loading of pages with inline graphics. Browsers such as Netscape 2.0 are able to establish a single connection and use that one connection to download the original HTML as well as all inline images contained within it. This dramatically reduces the overall time required to transfer a document, especially over a communications link with high latency. You can configure the operation of the Keep-Alive feature.

A new PowerWeb Variables Reference Manual has been added which lists all PowerWeb variables accessible from Web Macros or API Extensions. Each variable is described by name, usage, example, datatype and access control permissions. In addition, a new Rexx example shows how you can navigate within the Variable Tree. Its source code can be found in "\powerweb\system\rexx-bin\tree.cmd"

A new semaphore data type has been added to the PowerWeb Rexx and C APIs to allow easier writing of multi-thread safe API Extensions. Documentation on creating and using your own semaphores can be found in the API Reference Manual. An example Rexx script is provided in "\powerweb\system\rexx-bin\semaphor.cmd".

The Pizza example in the Guided Tour which demonstrates the /$form forms processing command has been expanded to show form validation at work (look at the files "pizza.htm", "pizzachk.htm" and "pizzaok.htm"). The documentation on /$form has also been improved, and new examples of forms processing with Rexx and Web Macros have been added.

The /$form built-in forms processing command has been extended to support the Lotus Notes STF format, using the form_format attribute.

The Web Macro Reference Manual has been expanded to include many more examples, and updated with several enhancements to existing macros.

The documentation on writing your own user authentication and access control routines has been improved with examples.

A new Web Macro Append allows appending text to an existing PowerWeb variable, while Concat allows you to combine an entire directory of PowerWeb variables, which is useful when writing scripts for the Database macro.

Server Statistics now use double precision floating point to accumulate the number of bytes received and sent. This prevents the overflow caused after 2 billion bytes of transferred data.

A new Server Statistic for measuring the overhead of writing audit log file entries has been added. On a typical server, the overhead of keeping audit, user-agent and referer logs is about 10-20% of the total transaction time.

Access control rules are now case insensitive when matching protocol, method and sub-method.

User names and passwords are optionally case sensitive. The default is case sensitive, and can be changed on the "User Databases" page.

The C and C++ API Hook header file "powerapi.hpp" has been modified to make the calling convention more precise. Users of non-IBM C compilers should now find it a lot easier to write hooks.

If you have coded your own API Hook libraries, you will need to modify your function declarations to specify a linkage type of APIENTRY and recompile them for this version. Look at the sample code in "\powerweb\tour\source\tour.cpp" for an example.

The administrator is now able to specify the stack size requirements of request-handling threads that execute API Extensions. You can configure this in the Global Settings page. Read the Help for more information.

Fixed a problem where editing a Template based on another Template could under some (rare) situations lead to an incompatibility between the revised settings and the previous settings.

Fixed a problem with CGI scripts using Web Macros. An example of using Web Macros with CGI can be found at \powerweb\system\cgi-bin\showcgi2.cmd

The Server Save and Restart page has been revised with more facilities, including the ability to forcibly restart the server, regardless of existing connections. Another option allows the server to restart as soon as it becomes idle, which is valuable for busy servers which cannot afford downtime or premature closing of connections.

If the server is very active and is never idle, then you can schedule a time for updates to occur in the Global Settings page. At this time if a restart request is pending, all incoming connections are paused, existing connections are allowed a grace period to complete, after which the server forces outstanding connections closed and restarts.

Server log files are now automatically flushed and committed to disk regularly as an idle-time process. The "rotate" command-line program also now rotates ALL logs for a service, not just the audit log.

The administrator can toggle on/off echoing of the log entries to the system console, by pressing the 'E' key. This provides visual feedback of requests as they are serviced. The performance overhead is negligible if the window is minimised or in a background session. Pressing the '?' key provides a list of other system console facilities.

An example of calling Perl from PowerWeb has been included in the file "\powerweb\cgi-bin\showperl.cmd" using the hyperlink /example/cgi-bin/showperl. The latest version of Perl5 for OS/2 may be obtained by FTP, the Hobbes FTP site is currently not as up-to-date.

Fixed a problem with multi-homed servers where an internal redirection would specify the main IP address of the server, and not the IP address of the incoming connection. This could have affected users with imagemap redirections to non-default IP addresses on the same server.

Added improved caching to speed access to commonly referenced HTTP documents. Caching can be controlled per-resource according to the "cache" settings in the Template Editor.

Note that operating a cache does not in any way compromise security, unlike most other servers. The cache is kept permanently updated, so if you change any documents which are contained in the cache, they are automatically refreshed so that users will always see the most current version.

Users who are upgrading from a previous release will need to manually enable the cache within "Global Settings" for cache, by setting "Enabled" to "yes", submitting the change and restarting the server.

System administrators can now re-instate a previous version of PowerWeb Server++ through the "Server Version Control" menu option under "Server Administration". Changing between versions is as simple as selecting the hyperlink for the required version number. The server automatically restarts with the newly selected version. Note that configuration files are upwardly compatible across versions.

Added an alternative table editing mode which bypasses the problem of some browsers not being able to show or edit tables correctly without crashing the client computer.

The default table view mode is set in the Config:/Console/TableType variable and can be set by pointing your browser at the /admin page, choosing "Global", and then choosing "Console".

If you wish to dynamically view a table in the other mode, all you have to do is choose "Toggle Table View" from the menu at the top of the page that is displaying the table.

Note: There is a bug in the current version of IBM's WebExplorer which affects you when you use the horizontal scroll bar to view more text to the right of the screen. The mouse coordinate position is read incorrectly which means hyperlinks don't work after you have scrolled to the right.

Configuration pages now have help as a separate topic on the menu bar at the top of the page, thereby making configuration pages load faster. It also enables you to have two Web browsers running simultaneously with one displaying help and the other for editing.

Added command line utilities to manage users in a PowerWeb user database. Both single user as well as batch user changes are supported. The utilities are named adduser, deluser, changepw, addusers and delusers and are found in the \powerweb\bin directory. Type the name of the command file on its own with no command line arguments to get help for each utility.

Two other useful utilities are "restart" and "rotate" which respectively restart the server and rotate the log files. Rotating the log files allows you to access log information for analysis or for backup.

Added the UIDL command to the POP3 server to allow mail clients to leave mail on the server instead of retrieving it and storing it locally.

Changed the error message displayed to the client when a Rexx script encounters a syntax or execution error. Version 2.05 always said the file was not found instead of correctly diagnosing problems with Rexx execution.

The FTP server now accepts "ftp" as an alternative valid anonymous login name.

The FTP server now recognises user aliases for login.

The Configuration Save and Restart page has now been split into two separate pages to avoid confusion between the two sections. A new page "Server Start and Stop" shows the previous top section which allows for dynamic stopping and starting of services.

The OS/2 version has been optimised for faster load times, as a result of which PowerWeb will not run on versions of OS/2 prior to Warp 3.0.

Revised the pages used to configure Resources to make them simpler to use and more understandable. This is the first phase of a set of changes to be made to ease the configuration process.

Extended the documentation on API Hooks and included further examples. Look at the URLs /admin/help/api.htm and /tour/source/tour.htm.

Added new fields to the "Statistics" and "Connections" pages for Server Activity monitoring to show the date and time from which the statistics apply.

Changed the FTP server's handling of empty directories - it now sends back an empty response instead of saying "No files found". This makes it more compatible with common automated FTP clients.

Changed the FTP server's handling of private directories - it now allows changing to that directory, and (optionally) displaying a README message file, but it will not allow directory listings. This makes it easier to set up multi-level private directories and sub-directories.

Changed the FTP server's file listing display format, because some automated FTP clients were mistakenly inserting a space in front of each filename.

Added two new resource template definitions to make it easier to configure FTP services: PublicFTP and IncomingFTP.

Fixed a problem on the "Save and Restart" administration page where dynamic starting, stopping and pausing of individual services caused a "Variable not found" message to be displayed.

Fixed a problem with POSTing HTML forms with an input field containing more than 32K of text which could cause the server to reject the form.

Improved the performance of PowerWeb Server++ when parsing the submitted data from large forms.

Changed the declaration of PowerAPI C interface functions to explicitly mention the linkage type, making usage of other vendor compilers easier.

A full-function FTP server is included in the standard package.

The FTP server takes full advantage of the multi-threaded multi-tasking PowerWeb Server++ engine to provide robust and very fast FTP services. It is easy to configure through the HTML browser pages, just like the HTTP and POP3 servers. The unified security model means that you need to set access control permissions in one place only to administer all your services, regardless of protocol such as FTP or HTTP.

The FTP server automatically uses the same directory aliases as the HTTP server so you can offer FTP users an alternative access path to your documents and files. This also means you can create a unified directory structure across all your drives, even across a network.

Facilities such as PowerWeb Macros and API extensions are also available with the FTP server, making it easy to customise and extend. An example use of PowerWeb Macros is given in the standard welcome message file "/powerweb/ftp/readme".

The default setup automatically creates public and incoming directories along with appropriate access control permissions.

The POP3 mail server now automatically creates a default mail directory and a default mail user database containing postmaster and webmaster aliases for the admin user id, letting you have one mailbox for all admin-related mail.

It is strongly suggested that you run the POP3 mail server on a drive that supports long filenames because user names are often longer than 8 characters. Change the mail directory by selecting "Global", then "Mail" from the admin page.

The existing POP3 server is for re-distributing mail to client mail packages only. It does not send mail. There is a primitive interim mail sorting program available until PowerMail, a fully integrated mail package is released.

A new facility for defining user aliases has been implemented. Its primary purpose is to allow pooling of users into a single POP3 mailbox. It is available across all services, including HTTP. Go to the "/admin" page and select "User Databases".

C and Rexx scripts can now be referenced directly by means of a URL without having to create customised Resources to manage them. The \powerweb\system\rexx-bin\ directory includes an example of such a script, which is called through the URL "/example/rexx-bin/svrpush.cmd". Libraries coded in C can be accessed by a URL of the form "/bin/module!function".

HTML documents can now embed calls to C and Rexx scripts directly, using the "Exec" PowerWeb Macro. These scripts have full access to the PowerWeb Server++ APIs.

The automated forms processing facility can now call Rexx functions in addition to C functions, to extend upon the default functionality.

The CGI interface now preserves upper and lower case for path arguments.
Example: /cgi-bin/program/Argument?Parameter now preserves the capital A in Argument when calling the program.

A new option in the "Save Configuration and Restart" administration page allows you to reset your configuration to a default setup. This can be useful if you want to revert to the original setup or if you have upgraded to a new version and don't need to preserve your configuration changes.

Added an option to the server auditing page to allow forcing of displaying the remote client's host name in the audit log. If this option is enabled it will halve the performance of your server, because a reverse domain name server lookup is required. A better performing solution is to instruct your log analysing program to perform the host name lookup when it processes your log information.

Fixed a bug which prevented the loading of some user database files into the memory cache, causing the server not to load.

An icon for use on the OS/2 desktop is included in the "/powerweb/bin" directory, named "powerweb.ico". We welcome contributions for an improved icon. Please FTP them to compusource.co.za in the /incoming directory.

PowerWeb Server++ Rexx Extensions offer increased functionality and far better speed than CGI for writing customised web serving applications. The Rexx interface is direct, not through CGI, so full access to the server's internal data structures is provided, and the overhead of a fork to the command interpreter is avoided.

The Rexx Extensions Interface has the same power as the PowerWeb C Language Interface but offers easier development without the need for compiling, and mastering the intricacies of DLL development.

Servers that use REXX filters for processing HTTP requests cannot offer the same level of customisability without having to modify the main server code itself, causing a maintenance and reliability problem, as well as making upgrades to new versions of the server very time consuming.

User databases can now be managed on a batch (or bulk) process. This facility makes it easy to import a large existing user database file from another source without typing in each individual user. Similarly batches of users can be deleted or verified in one step.

There is now a much simpler to use facility to restore a previous configuration file. Select "Restore a Previous Configuration" on the main Admin page and pick a previous configuration file from the list presented. The server auto-restarts afterwards.

The API Extension for defining your own custom PowerWeb Macros has been improved to be easier to use.

Modified the default audit log format to include the timezone.

The POP3 server is now setup by default, but not autostarted. This makes it easier to configure.