Pullup ticket 2050 - requested by wiz

security update for p5-CGI-Session

- pkgsrc/www/p5-CGI-Session/Makefile			1.8
- pkgsrc/www/p5-CGI-Session/distinfo			1.4

   Module Name:	pkgsrc
   Committed By:	wiz
   Date:		Fri Mar 16 20:41:22 UTC 2007

   Modified Files:
	   pkgsrc/www/p5-CGI-Session: Makefile distinfo

   Log Message:
   Update to 4.20:

   4.20 - Monday, December 4, 2006

       * INTERNAL: No Changes since 4.20_1. Declaring stable.

   4.20_1 - Friday, November 24, 2006

       * FIX: -ip_match now works even when it's not the last import item. (RT#21779)
       * FIX: In the PostgreSQL driver, a race condition is when storing is now worked around. (Mark Stosberg)
       * FIX: Added important clarification and example to MySQL driver docs that the session column
              needs to be defined as a primary key to avoid duplicate sessions. (Justin Simoni, Mark Stosberg)
       * FIX: The default serializer now works correctly with certain data structures. (RT#?) (Matt LeBlanc)
       * FIX: A documentation bug in find() was fixed (Matt LeBlanc)
       * FIX: Documented how to declare a database handle to be used on demand, which was introduced
              in 4.04. (Mark Stosberg)
       * FIX: Connections made with SQLite now disconnect only when appropriate, instead of always.
              This addresses a symptom seen as "attempt to prepare on inactive database handle"
              (Jaldhar Vyas, Sherzod, Mark Stosberg)
       * FIX: Args to the constructor for CGI::Session and the drivers are now always shallow
              copied rather than used directly, to prevent modification.
              (RT#21952, Franck Porcher, Sherzod, Mark Stosberg)
       * FIX: The documentation for expire($param, $time) was made more explicit
              (pjf, Mark Stosberg)
       * NEW: Added recommended use of flush() to the Synopsis (Michael Renner, RT#22333)
       * NEW: Added links to Japanese translations of the documentation (Makio Tsukamoto)
              http://digit.que.ne.jp/work/index.cgi?Perldoc/ja
       * INTERNAL: Update test to workaround YAML versions less than 0.58. (Matt LeBlanc)
       * INTERNAL: param() code was refactored for clarity (Mark Stosberg, Ali ISIK, RT#21782)
       * INTERNAL: new() and load() were refactored (Ali Isik)
       * INTERNAL: renamed some environment variables used for testing (Ron Savage)
       * INTERNAL: Multi key-value syntax of param() now always returns number of keys
         successfully processed, 0 if no key/values were processed.

   4.14 - Sunday, June 11, 2006

       * NEW: The find() command now has better documentation. (Ron Savage, Matt LeBlanc)
       * FIX: find() no longer changes the access or modified times (RT#18442) (Matt LeBlanc)
       * FIX: param() called with two parameters now returns the value set, if any (RT#18912) (Matt LeBlanc)
       * FIX: driver, serializer, and id generator names are now untainted (RT#18873) (Matt LeBlanc)
       * INTERNAL: automatic flushing has been documented to be unreliable, although
         it was recommended in the past. Automatic flushing can be affected adversely
         in persistent environments and in some cases by third party software. There are
         also some cases in which flushing happened automatically in 3.x, but quit working
         with 4.x. See these tickets for details.

          http://rt.cpan.org/Ticket/Display.html?id=17541
          http://rt.cpan.org/Ticket/Display.html?id=17299

   4.13 - Wednesday, April 12, 2006

       * FIX: Applied patch to fix cookie method (RT#18493,Nobuaki ITO)
       * FIX: Berkeley DB 1.x exhibits a bug when used in conjunction with O_NOFOLLOW. Because of this,
         we've removed it from the db_file driver. It will still attempt to stop symlinks but the
         open itself has dropped the flag. (Matt LeBlanc)
       * FIX: json and yaml db_file tests now check for the presence of DB_File. (Matt LeBlanc)

   4.12 - Friday, April 7, 2006

       * SECURITY: Fix possible SQL injection attack. (RT#18578, DMUEY)

   4.11 - Friday, March 31, 2006

       * FIX: Since 4.10, using name() as a class method was broken. This has
         been fixed, and regression tests for both uses have been added. (Matt LeBlanc)

   4.10 - Tuesday, March 28, 2006

       * SECURITY: Hopefully this settles all of the problems with symlinks. Both the file
         and db_file drivers now use O_NOFOLLOW with open when the file should exist and
         O_EXCL|O_CREAT when creating the file. Tests added for symlinks. (Matt LeBlanc)
       * SECURITY: sqlite driver no longer attempts to use /tmp/sessions.sqlt when no
         Handle or DataSource is specified. This was a mistake from a security standpoint
         as anyone on the machine would then be able to create and therefore insert data
         into your sessions. (Matt LeBlanc)
       * NEW: name is now an instance method (RT#17979) (Matt LeBlanc)

   4.09 - Friday, March 16th, 2006

       * SECURITY: Applying security patch from: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=356555 (Julien Danjou)

   4.08 - Thursday, March 15th, 2006

       * FIX: DESTROY was sometimes wiping out exception handling. RT#18183, Matt LeBlanc.
       * SECURITY: Resolve some issues in: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=356555
         - db_file and file now check for symlinks either explicitly or by using O_EXCL on sysopen
         - file creation umask defaults to 660
       * NEW: db_file and file drivers now accepts a UMask option. (Matt LeBlanc)
       * INTERNAL: test suite clean up (Tyler MacDonald)

2 files changed, 6 insertions, 8 deletions

diff --git a/www/p5-CGI-Session/Makefile b/www/p5-CGI-Session/Makefile
index a71e6ee1904..bc42110db8f 100644
--- a/www/p5-CGI-Session/Makefile
+++ b/www/p5-CGI-Session/Makefile
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.7 2006/03/30 12:55:38 salo Exp $
+# $NetBSD: Makefile,v 1.7.6.1 2007/03/16 23:10:40 ghen Exp $
 
-DISTNAME=		CGI-Session-4.09
+DISTNAME=		CGI-Session-4.20
 PKGNAME=		p5-${DISTNAME}
 SVR4_PKGNAME=		p5ses
 CATEGORIES=		www perl5
@@ -9,8 +9,6 @@ MASTER_SITES=		${MASTER_SITE_PERL_CPAN:=CGI/}
 MAINTAINER=		pkgsrc-users@NetBSD.org
 COMMENT=		Perl5 module providing session management across HTTP requests
 
-DEPENDS+=		{p5-CGI>=2.66,perl>=5.6.1nb2}:../../www/p5-CGI
-
 PKG_INSTALLATION_TYPES=	overwrite pkgviews
 
 PERL5_PACKLIST=		auto/CGI/Session/.packlist
diff --git a/www/p5-CGI-Session/distinfo b/www/p5-CGI-Session/distinfo
index 0d96ca884f5..a37661df3a8 100644
--- a/www/p5-CGI-Session/distinfo
+++ b/www/p5-CGI-Session/distinfo
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.3 2006/03/30 12:55:38 salo Exp $
+$NetBSD: distinfo,v 1.3.6.1 2007/03/16 23:10:40 ghen Exp $
 
-SHA1 (CGI-Session-4.09.tar.gz) = d7260dc6c1794415fb9588e57f0bccc55623957b
-RMD160 (CGI-Session-4.09.tar.gz) = ae8e9c29aaafb0e21d1d47544753071253e43aec
-Size (CGI-Session-4.09.tar.gz) = 86128 bytes
+SHA1 (CGI-Session-4.20.tar.gz) = a8bdcc63b897ce53c965a5f20b07097c8cd085bf
+RMD160 (CGI-Session-4.20.tar.gz) = 75f6a62283c884442a0408954215a32f1f0c41e6
+Size (CGI-Session-4.20.tar.gz) = 70995 bytes