Pullup ticket #4558 - requested by taca

www/contao33: security update

Revisions pulled up:
- www/contao/Makefile.common                            1.83,1.85 via patch
- www/contao33/Makefile                                 1.6
- www/contao33/PLIST                                    1.7
- www/contao33/distinfo                                 1.7-1.8

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Sun Nov  2 01:19:55 UTC 2014

   Modified Files:
   	pkgsrc/www/contao: Makefile.common
   	pkgsrc/www/contao33: PLIST distinfo

   Log Message:
   Update contao33 to 3.3.6.

   Version 3.3.6 (2014-10-31)
   --------------------------

   ### Fixed
   Always pass a DC object in the `toggleVisibility` callback (see #7314).

   ### Fixed
   Correctly render the "read more" and article navigation links (see #7300).

   ### Fixed
   Fix the markup of the form submit button (see #7396).

   ### Fixed
   Do not generally remove insert tags from page titles (see #7198).

   ### Fixed
   Consider the `useSSL` flag of the root page when generating URLs (see #7390).

   ### Fixed
   Correctly create the template object in `BaseTemplate::insert()` (see #7366).

   ### Updated
   Updated TinyMCE to version 4.1.6 and added the "lists" plugin (see #7349).

   ### Fixed
   Fixed the FAQ sorting in the back end (see #7362).

   ### Fixed
   Added the `Widget::__isset()` method (see #7290).

   ### Fixed
   Correctly handle dynamic parent tables in the `DC_Table` driver (see #7335).

   ### Fixed
   Correctly shortend HTML strings in `String::substrHtml()` (see #7311).

   ### Updated
   Updated MooTools to version 1.5.1 (see #7267).

   ### Fixed
   Updated swipe.js to version 2.0.1 (see #7307).

   ### Fixed
   Use an `.invisible` class which plays nicely with screen readers (see #7372).

   ### Fixed
   Handle disabled modules in the module loader (see #7380).

   ### Fixed
   Fixed the "link_target" insert tag.

   ### Fixed
   Correctly mark CAPTCHA fields as mandatory (see #7283).

   ### Updated
   Updated the ACE editor to version 1.1.6 (see #7278).

   ### Fixed
   Fix the `Database::list_fields()` method (see #7277).

   ### Fixed
   Correctly assign "col_first" and "col_last" in the image gallery (see #7250).

   ### Fixed
   Set the correct path to TCPDF in `system/config/tcpdf.php` (see #7264).

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Mon Nov 24 13:30:49 UTC 2014

   Modified Files:
   	pkgsrc/www/contao: Makefile.common
   	pkgsrc/www/contao33: Makefile distinfo

   Log Message:
   Update contao33 to 3.3.7, security release.

   Version 3.3.7 (2014-11-24)
   --------------------------

   ### Fixed
   Fixed a potential directory traversal vulnerability.

   ### Fixed
   Fixed a severe XSS vulnerability. In this context, the insert tag flags
   `base64_encode` and `base64_decode` have been removed.

   ### Fixed
   Handle nested insert tags in strip_insert_tags().

   ### Fixed
   Correctly store the model in Dbafs::addResource() (see #7440).

   ### Fixed
   Send the request token when toggling the visibility of an element (see #7406).

   ### Fixed
   Always apply the IE security fix in the Environment class (see #7453).

   ### Fixed
   Correctly handle archives being part of multiple RSS feeds (see #7398).

   ### Fixed
   Correctly handle `0` in utf8_convert_encoding() (see #7403).

   ### Fixed
   Send a 301 redirect to forward to the language root page (see #7420).

4 files changed, 66 insertions, 68 deletions

diff --git a/www/contao/Makefile.common b/www/contao/Makefile.common
index ba1971d85c4..00dbb676558 100644
--- a/www/contao/Makefile.common
+++ b/www/contao/Makefile.common
@@ -1,11 +1,11 @@
-# $NetBSD: Makefile.common,v 1.81.2.1 2014/11/25 14:53:03 tron Exp $
+# $NetBSD: Makefile.common,v 1.81.2.2 2014/11/25 15:01:15 tron Exp $
 #
 # used by www/contao32/Makefile
 # used by www/contao33/Makefile
 
 # current release
 CT32_VERSION=	3.2.16
-CT33_VERSION=	3.3.5
+CT33_VERSION=	3.3.7
 
 CT_VERS?=	32
 
diff --git a/www/contao33/Makefile b/www/contao33/Makefile
index 6efa233c689..234eba0be3f 100644
--- a/www/contao33/Makefile
+++ b/www/contao33/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.5 2014/07/30 03:28:34 taca Exp $
+# $NetBSD: Makefile,v 1.5.2.1 2014/11/25 15:01:15 tron Exp $
 #
 
 DISTNAME=	contao-${CT_PKGVER}
@@ -60,9 +60,9 @@ REPLACE.php.old=	.*php[^ ]*
 REPLACE.php.new=	${PREFIX}/bin/php
 REPLACE_FILES.php=	system/bin/automator system/bin/filesync \
 	system/bin/ide_compat system/bin/txpurge system/bin/version \
-	vendor/bin/pscss vendor/contao/tcpdf/tools/tcpdf_addfont.php \
+	vendor/bin/pscss vendor/tecnick.com/tcpdf/tools/tcpdf_addfont.php \
 	vendor/leafo/lessphp/lessify vendor/leafo/lessphp/plessc \
-	vendor/leafo/scssphp/pscss
+	vendor/leafo/scssphp/bin/pscss
 
 SUBST_CLASSES+=		conf
 SUBST_FILES.conf+=	${WRKDIR}/contao.conf
diff --git a/www/contao33/PLIST b/www/contao33/PLIST
index 5d76318d9b0..e1d1a9f3c60 100644
--- a/www/contao33/PLIST
+++ b/www/contao33/PLIST
@@ -1,53 +1,53 @@
-@comment $NetBSD: PLIST,v 1.6 2014/08/29 14:35:30 taca Exp $
+@comment $NetBSD: PLIST,v 1.6.2.1 2014/11/25 15:01:15 tron Exp $
 ${CT_WEBDIR}/.htaccess.default
 ${CT_WEBDIR}/README.md
-${CT_WEBDIR}/assets/ace/1.1.3/ace.js
-${CT_WEBDIR}/assets/ace/1.1.3/ext-searchbox.js
-${CT_WEBDIR}/assets/ace/1.1.3/ext-spellcheck.js
-${CT_WEBDIR}/assets/ace/1.1.3/ext-static_highlight.js
-${CT_WEBDIR}/assets/ace/1.1.3/ext-textarea.js
-${CT_WEBDIR}/assets/ace/1.1.3/keybinding-emacs.js
-${CT_WEBDIR}/assets/ace/1.1.3/keybinding-vim.js
-${CT_WEBDIR}/assets/ace/1.1.3/mode-asciidoc.js
-${CT_WEBDIR}/assets/ace/1.1.3/mode-css.js
-${CT_WEBDIR}/assets/ace/1.1.3/mode-diff.js
-${CT_WEBDIR}/assets/ace/1.1.3/mode-html.js
-${CT_WEBDIR}/assets/ace/1.1.3/mode-ini.js
-${CT_WEBDIR}/assets/ace/1.1.3/mode-java.js
-${CT_WEBDIR}/assets/ace/1.1.3/mode-javascript.js
-${CT_WEBDIR}/assets/ace/1.1.3/mode-json.js
-${CT_WEBDIR}/assets/ace/1.1.3/mode-jsp.js
-${CT_WEBDIR}/assets/ace/1.1.3/mode-jsx.js
-${CT_WEBDIR}/assets/ace/1.1.3/mode-less.js
-${CT_WEBDIR}/assets/ace/1.1.3/mode-livescript.js
-${CT_WEBDIR}/assets/ace/1.1.3/mode-markdown.js
-${CT_WEBDIR}/assets/ace/1.1.3/mode-mysql.js
-${CT_WEBDIR}/assets/ace/1.1.3/mode-perl.js
-${CT_WEBDIR}/assets/ace/1.1.3/mode-pgsql.js
-${CT_WEBDIR}/assets/ace/1.1.3/mode-php.js
-${CT_WEBDIR}/assets/ace/1.1.3/mode-python.js
-${CT_WEBDIR}/assets/ace/1.1.3/mode-rdoc.js
-${CT_WEBDIR}/assets/ace/1.1.3/mode-rhtml.js
-${CT_WEBDIR}/assets/ace/1.1.3/mode-ruby.js
-${CT_WEBDIR}/assets/ace/1.1.3/mode-scss.js
-${CT_WEBDIR}/assets/ace/1.1.3/mode-sh.js
-${CT_WEBDIR}/assets/ace/1.1.3/mode-sql.js
-${CT_WEBDIR}/assets/ace/1.1.3/mode-text.js
-${CT_WEBDIR}/assets/ace/1.1.3/mode-textile.js
-${CT_WEBDIR}/assets/ace/1.1.3/mode-xml.js
-${CT_WEBDIR}/assets/ace/1.1.3/mode-xquery.js
-${CT_WEBDIR}/assets/ace/1.1.3/mode-yaml.js
-${CT_WEBDIR}/assets/ace/1.1.3/theme-clouds.js
-${CT_WEBDIR}/assets/ace/1.1.3/theme-textmate.js
-${CT_WEBDIR}/assets/ace/1.1.3/theme-vibrant_ink.js
-${CT_WEBDIR}/assets/ace/1.1.3/worker-coffee.js
-${CT_WEBDIR}/assets/ace/1.1.3/worker-css.js
-${CT_WEBDIR}/assets/ace/1.1.3/worker-html.js
-${CT_WEBDIR}/assets/ace/1.1.3/worker-javascript.js
-${CT_WEBDIR}/assets/ace/1.1.3/worker-json.js
-${CT_WEBDIR}/assets/ace/1.1.3/worker-lua.js
-${CT_WEBDIR}/assets/ace/1.1.3/worker-php.js
-${CT_WEBDIR}/assets/ace/1.1.3/worker-xquery.js
+${CT_WEBDIR}/assets/ace/1.1.6/ace.js
+${CT_WEBDIR}/assets/ace/1.1.6/ext-searchbox.js
+${CT_WEBDIR}/assets/ace/1.1.6/ext-spellcheck.js
+${CT_WEBDIR}/assets/ace/1.1.6/ext-static_highlight.js
+${CT_WEBDIR}/assets/ace/1.1.6/ext-textarea.js
+${CT_WEBDIR}/assets/ace/1.1.6/keybinding-emacs.js
+${CT_WEBDIR}/assets/ace/1.1.6/keybinding-vim.js
+${CT_WEBDIR}/assets/ace/1.1.6/mode-asciidoc.js
+${CT_WEBDIR}/assets/ace/1.1.6/mode-css.js
+${CT_WEBDIR}/assets/ace/1.1.6/mode-diff.js
+${CT_WEBDIR}/assets/ace/1.1.6/mode-html.js
+${CT_WEBDIR}/assets/ace/1.1.6/mode-ini.js
+${CT_WEBDIR}/assets/ace/1.1.6/mode-java.js
+${CT_WEBDIR}/assets/ace/1.1.6/mode-javascript.js
+${CT_WEBDIR}/assets/ace/1.1.6/mode-json.js
+${CT_WEBDIR}/assets/ace/1.1.6/mode-jsp.js
+${CT_WEBDIR}/assets/ace/1.1.6/mode-jsx.js
+${CT_WEBDIR}/assets/ace/1.1.6/mode-less.js
+${CT_WEBDIR}/assets/ace/1.1.6/mode-livescript.js
+${CT_WEBDIR}/assets/ace/1.1.6/mode-markdown.js
+${CT_WEBDIR}/assets/ace/1.1.6/mode-mysql.js
+${CT_WEBDIR}/assets/ace/1.1.6/mode-perl.js
+${CT_WEBDIR}/assets/ace/1.1.6/mode-pgsql.js
+${CT_WEBDIR}/assets/ace/1.1.6/mode-php.js
+${CT_WEBDIR}/assets/ace/1.1.6/mode-python.js
+${CT_WEBDIR}/assets/ace/1.1.6/mode-rdoc.js
+${CT_WEBDIR}/assets/ace/1.1.6/mode-rhtml.js
+${CT_WEBDIR}/assets/ace/1.1.6/mode-ruby.js
+${CT_WEBDIR}/assets/ace/1.1.6/mode-scss.js
+${CT_WEBDIR}/assets/ace/1.1.6/mode-sh.js
+${CT_WEBDIR}/assets/ace/1.1.6/mode-sql.js
+${CT_WEBDIR}/assets/ace/1.1.6/mode-text.js
+${CT_WEBDIR}/assets/ace/1.1.6/mode-textile.js
+${CT_WEBDIR}/assets/ace/1.1.6/mode-xml.js
+${CT_WEBDIR}/assets/ace/1.1.6/mode-xquery.js
+${CT_WEBDIR}/assets/ace/1.1.6/mode-yaml.js
+${CT_WEBDIR}/assets/ace/1.1.6/theme-clouds.js
+${CT_WEBDIR}/assets/ace/1.1.6/theme-textmate.js
+${CT_WEBDIR}/assets/ace/1.1.6/theme-vibrant_ink.js
+${CT_WEBDIR}/assets/ace/1.1.6/worker-coffee.js
+${CT_WEBDIR}/assets/ace/1.1.6/worker-css.js
+${CT_WEBDIR}/assets/ace/1.1.6/worker-html.js
+${CT_WEBDIR}/assets/ace/1.1.6/worker-javascript.js
+${CT_WEBDIR}/assets/ace/1.1.6/worker-json.js
+${CT_WEBDIR}/assets/ace/1.1.6/worker-lua.js
+${CT_WEBDIR}/assets/ace/1.1.6/worker-php.js
+${CT_WEBDIR}/assets/ace/1.1.6/worker-xquery.js
 ${CT_WEBDIR}/assets/contao/css/debug-uncompressed.css
 ${CT_WEBDIR}/assets/contao/css/debug.css
 ${CT_WEBDIR}/assets/contao/css/form-uncompressed.css
@@ -222,14 +222,14 @@ ${CT_WEBDIR}/assets/mootools/colorpicker/1.4/images/moor_slider.png
 ${CT_WEBDIR}/assets/mootools/colorpicker/1.4/images/moor_woverlay.png
 ${CT_WEBDIR}/assets/mootools/colorpicker/1.4/js/mooRainbow-uncompressed.js
 ${CT_WEBDIR}/assets/mootools/colorpicker/1.4/js/mooRainbow.js
-${CT_WEBDIR}/assets/mootools/core/1.5.0/mootools-core-uncompressed.js
-${CT_WEBDIR}/assets/mootools/core/1.5.0/mootools-core.js
-${CT_WEBDIR}/assets/mootools/core/1.5.0/mootools-mobile-uncompressed.js
-${CT_WEBDIR}/assets/mootools/core/1.5.0/mootools-mobile.js
-${CT_WEBDIR}/assets/mootools/core/1.5.0/mootools-more-uncompressed.js
-${CT_WEBDIR}/assets/mootools/core/1.5.0/mootools-more.js
-${CT_WEBDIR}/assets/mootools/core/1.5.0/mootools-uncompressed.js
-${CT_WEBDIR}/assets/mootools/core/1.5.0/mootools.js
+${CT_WEBDIR}/assets/mootools/core/1.5.1/mootools-core-uncompressed.js
+${CT_WEBDIR}/assets/mootools/core/1.5.1/mootools-core.js
+${CT_WEBDIR}/assets/mootools/core/1.5.1/mootools-mobile-uncompressed.js
+${CT_WEBDIR}/assets/mootools/core/1.5.1/mootools-mobile.js
+${CT_WEBDIR}/assets/mootools/core/1.5.1/mootools-more-uncompressed.js
+${CT_WEBDIR}/assets/mootools/core/1.5.1/mootools-more.js
+${CT_WEBDIR}/assets/mootools/core/1.5.1/mootools-uncompressed.js
+${CT_WEBDIR}/assets/mootools/core/1.5.1/mootools.js
 ${CT_WEBDIR}/assets/mootools/datepicker/2.2.0/datepicker.css
 ${CT_WEBDIR}/assets/mootools/datepicker/2.2.0/datepicker.js
 ${CT_WEBDIR}/assets/mootools/datepicker/2.2.0/icon.gif
@@ -332,6 +332,7 @@ ${CT_WEBDIR}/assets/tinymce4/plugins/image/plugin.min.js
 ${CT_WEBDIR}/assets/tinymce4/plugins/importcss/plugin.min.js
 ${CT_WEBDIR}/assets/tinymce4/plugins/legacyoutput/plugin.min.js
 ${CT_WEBDIR}/assets/tinymce4/plugins/link/plugin.min.js
+${CT_WEBDIR}/assets/tinymce4/plugins/lists/plugin.min.js
 ${CT_WEBDIR}/assets/tinymce4/plugins/paste/plugin.min.js
 ${CT_WEBDIR}/assets/tinymce4/plugins/searchreplace/plugin.min.js
 ${CT_WEBDIR}/assets/tinymce4/plugins/tabfocus/plugin.min.js
@@ -362,13 +363,10 @@ ${CT_WEBDIR}/assets/tinymce4/skins/contao/skin.json
 ${CT_WEBDIR}/assets/tinymce4/skins/contao/skin.min.css
 ${CT_WEBDIR}/assets/tinymce4/skins/lightgray/content.inline.min.css
 ${CT_WEBDIR}/assets/tinymce4/skins/lightgray/content.min.css
-${CT_WEBDIR}/assets/tinymce4/skins/lightgray/fonts/readme.md
-${CT_WEBDIR}/assets/tinymce4/skins/lightgray/fonts/tinymce-small.dev.svg
 ${CT_WEBDIR}/assets/tinymce4/skins/lightgray/fonts/tinymce-small.eot
 ${CT_WEBDIR}/assets/tinymce4/skins/lightgray/fonts/tinymce-small.svg
 ${CT_WEBDIR}/assets/tinymce4/skins/lightgray/fonts/tinymce-small.ttf
 ${CT_WEBDIR}/assets/tinymce4/skins/lightgray/fonts/tinymce-small.woff
-${CT_WEBDIR}/assets/tinymce4/skins/lightgray/fonts/tinymce.dev.svg
 ${CT_WEBDIR}/assets/tinymce4/skins/lightgray/fonts/tinymce.eot
 ${CT_WEBDIR}/assets/tinymce4/skins/lightgray/fonts/tinymce.svg
 ${CT_WEBDIR}/assets/tinymce4/skins/lightgray/fonts/tinymce.ttf
diff --git a/www/contao33/distinfo b/www/contao33/distinfo
index f9136f100a1..817cead8830 100644
--- a/www/contao33/distinfo
+++ b/www/contao33/distinfo
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.6 2014/08/29 14:35:30 taca Exp $
+$NetBSD: distinfo,v 1.6.2.1 2014/11/25 15:01:15 tron Exp $
 
-SHA1 (contao-3.3.5.tar.gz) = 556624ea5c62d1edc3d82a369f6893579cde52f6
-RMD160 (contao-3.3.5.tar.gz) = 6ea173d270bc9648f0b29edfac8ca418c508aac6
-Size (contao-3.3.5.tar.gz) = 10970027 bytes
+SHA1 (contao-3.3.7.tar.gz) = a865dcf9e18d26868d886aa15a2bc951c4ed8c2e
+RMD160 (contao-3.3.7.tar.gz) = 9f1f6bc4fa30b52c04b3bdc163296c0a5c4f3913
+Size (contao-3.3.7.tar.gz) = 11473249 bytes