Age | Commit message (Collapse) | Author | Files | Lines |
|
|
|
It is essentially a bugfix and maintenance release, with:
- portability fix (SunOS)
- additional tests (Config)
- API addition (String)
- quiet mode for configctl(1)
- support for compiling in a separate directory (OBJDIR)
|
|
|
|
Updated security/clamav-doc to 0.98.7
|
|
This release contains new scanning features and bug fixes.
- Improvements to PDF processing: decryption, escape sequence
handling, and file property collection.
- Scanning/analysis of additional Microsoft Office 2003 XML format.
- Fix infinite loop condition on crafted y0da cryptor file. Identified
and patch suggested by Sebastian Andrzej Siewior. CVE-2015-2221.
- Fix crash on crafted petite packed file. Reported and patch
supplied by Sebastian Andrzej Siewior. CVE-2015-2222.
- Fix false negatives on files within iso9660 containers. This issue
was reported by Minzhuan Gong.
- Fix a couple crashes on crafted upack packed file. Identified and
patches supplied by Sebastian Andrzej Siewior.
- Fix a crash during algorithmic detection on crafted PE file.
Identified and patch supplied by Sebastian Andrzej Siewior.
- Fix an infinite loop condition on a crafted "xz" archive file.
This was reported by Dimitri Kirchner and Goulven Guiheux.
CVE-2015-2668.
- Fix compilation error after ./configure --disable-pthreads.
Reported and fix suggested by John E. Krokes.
- Apply upstream patch for possible heap overflow in Henry Spencer's
regex library. CVE-2015-2305.
- Fix crash in upx decoder with crafted file. Discovered and patch
supplied by Sebastian Andrzej Siewior. CVE-2015-2170.
- Fix segfault scanning certain HTML files. Reported with sample by
Kai Risku.
- Improve detections within xar/pkg files.
|
|
|
|
|
|
* Fix build with Ruby 2.2.
Changelog:
0.59 - updated docs, removed some Cygwin-specific info
added support for login warnings
made bind variable buffers dynamic on the client side
added maxbindvars parameter on the server side
binding a NULL to an integer works with db2 now
moved getting started with DB docs into the cloud
added a semaphore to ensure that the listener doesn't hand off the
client to the connection until the connection is ready,
elimiating a race condition on the handoff socket that could
occur if the connection timed out waiting for the listener
just after the listener had decided to use that connection
oracle temp tables that need to be truncated at the end of the session
are truncated with "truncate table xxx" now rather than
"delete from xxx"
oracle temp tables that need to be dropped at the end of the session
are truncated first, rather than the connection re-logging in
an ora-14452 error (basically indicating that a temp table can only be
dropped after being truncated, or if the current session ends)
does not automatically trigger a re-login any more
updated cachemanager to use directory::read() directly instead of
directory::getChildName(index)
added cache and opencache commands to sqlrsh
made cache ttl a 64-bit number
added enabled="yes"/"no" parameter to logger modules
updated odbc connection code to use new/delete and rudiments methods
rather than malloc/free and native calls
retired Ruby DBI driver
fixed command line client crash when using -id "instance" with an
instance that uses authtier="database"
fixed bugs that could make reexecuted db2 selects fail and cause a
database re-login loop
tweaked spec file to remove empty directories on uninstall
fixed typo that could sometimes cause a listener crash
postgresql and mdbtools return error code of 1 rather than 0 for all
errors now
tweaked odbc driver to work with Oracle Heterogenous Agent (dblinks)
fixed bugs related to autocommit with db's that support transaction
blocks
implemented the ODBC driver-manager dialog for windows
updated windows installer to install ODBC registry settings
ODBC driver copies references now
fixed various bugs in sqlrconfigfile that caused sqlr-start with no
-id to crash or behave strangely sometimes
refactored build process to use nmake and be compatible with many
different versions of MS Visual Studio
updated the slow query logger to show the date/time that the query
was executed
consolidated c, c++ and server source/includes down a few levels
implemented column-remapping for get db/table/column commands to
enable different formats for mysql, odbc, etc.
odbc connection correctly returns database/table lists now
added support for maxselectlistsize/maxitembuffersize to MySQL
connection
updated mysql connection to fetch blob columns in chunks and not be
bound by maxitembuffersize
fixed a misspelling in sqlrelay.dtd
swapped order of init directory detection, looking for /etc/init.d
ahead of /etc/rc.d/init.d to resolve conflict with dkms on
SuSE Enterprise
C# api and tests compile and work under Mono on unix/linux now
sqlr-start spawns a new window on Windows now
added global temp table tracking for firebird
added droptemptables parameter for firebird
added globaltemptables parameter for oracle and firebird
updated mysql connection to allow mysql_init to allocate a mysql
struct on platforms that support mysql_init, rather than
using a static struct
fixed subtle noon/midnight-related bugs in date/time translation
updated mysql connection to get affected rows when not using the
statement api
updated mysql connection not to use the statement API on windows,
for now
disabled mysql_change_user, for now
fixed blob-input binds on firebird
0.58 - updated spawn() calls to detach on windows
added support for sqlrelay.conf.d
removed support for undocumented ~/.sqlrelay.conf
fixed detection of oracle jdk 7 and 8 on debian and ubuntu systems
added ini files for PHP and PDO modules
added resultsetbuffersize, dontgetcolumninfo and nullsasnulls connect
string variables to the PHP PDO driver
refactored sqlr-status and removed dependency on libsqlrserver
cleaned up and refactored server-side classes quite a bit
fixed a bug where sqlrsh was losing the timezone when binding dates
server-devel headers are now installed
removed backupschema script
moved triggers, translations, resultsettranslations and parser into
separate project
blobs work when using fake input binds now
replaced sqlr-stop script with a binary (for Windows)
preliminary support for server components on Windows
sessionhandler="thread" is now forced on Windows
added various compile flags for clang's aggressive -Wall
added support for sybase 16.0
removed unnecessary -lsybdb/-lsybdb64 for sybase 15+
fixed PQreset, PQresetStart, PQresetPoll in postgresql drop-in
replacement lib
added debug-to-file support to PHP PDO driver
fixed subtle row-fetch bug in sybase/freetds drivers that could cause
the total row count to be set to garbage
fixed support for older versions of perl (5.00x)
fixed a bug in the DB2 connoutpection that caused blob input binds to be
truncated at the first null
added support for binding streams to output bind blobs in the PHP PDO
driver
updated PHP PDO guide with notes about bind variable formats
integrated Samat Yusup's dbh driver methods for PHP PDO
added stmt driver methods for suspending/resuming result sets to the
PHP PDO driver
added row cache to mysql drop-in replacement library to fix issues on
systems with 32-bit pointers
fixed subtle db2 output bind bfers the entire result set by default now
implemented an ext_SQLR_Debug database handle attribute for perl DBI
added support for type, length, precision, scale bind variable
attributes in perl DBI
output bind clobs and blobs work in perl DBI now
addd support for perl DBI ParamValues, ParamTypes and ParamArrays
attributes
tweaked the odbc driver so it works with the jdbc-odbc bridge and
jmeter
added custom db/statement attributes to perl DBI for
DontGetColumnInfo, GetNullsAsEmptyStrings and
ResultSetBufferSize
added note about JDBC-ODBC bridge removal in Oracle Java 8
made threaded listener the default
tweaks to sqlr-connection/sqlr-scaler processes to deal with lack of
SIGCHLD/waitpid() on windows
the signal on semaphore 2 is now undone manually when sqlr-connections
shut down and doesn't rely on semaphore undo's for normal
operation
subtly tweaked freeing of Oracle column-info buffers to work around
a crash that could occur after using a cursor bind
|
|
|
|
|
|
|
|
Upstream changes:
CHANGES FROM 2.61 to 3.00
* Code redesign from Howard Wulf, AF5NE
CHANGES FROM 2.60 to 2.61
* Bug fix from Matthias Rustler
CHANGES FROM 2.50 to 2.60
* New maths functions and append mode support from Edmond Orignac
* Bug fixes
|
|
|
|
|
|
|
|
Upstream changes:
version 2.16 at 2015-05-19 17:23:47 +0000
-----------------------------------------
Change: e5c5a2f18fce4f450f0926c80323527825ab1b8d
Author: Chris 'BinGOs' Williams <chris@bingosnet.co.uk>
Date : 2015-05-19 18:23:47 +0000
Updated for v5.22.0-RC1
|
|
|
|
Upstream changes:
1.2.0 2015-04-14 07:13:00+0000
- [core] bundle libyaml #248 (Kazuho Oku)
- [core] implement master-worker process mode and daemon mode (bundles Server::Starter) #258 #270 (Kazuho Oku)
- [file] more mime-types by default #250 #254 #280 (Tatsuhiko Kubo, George Liu, Kazuho Oku)
- [file][http1] fix connection being closed if the length of content is zero #276 (Kazuho Oku)
- [headers] fix heap overrun during configuration #251 (Kazuho Oku)
- [http2] do not delay sending PUSH_PROMISE #221 (Kazuho Oku)
- [http2] reduce memory footprint under high load #271 (Kazuho Oku)
- [http2] fix incorrect error sent when number of streams exceed the limit #268 (Kazuho Oku)
- [proxy] fix heap overrun when building request sent to upstream #266 #269 (Moto Ishizawa, Kazuho Oku)
- [proxy] fix laggy response in case the length of content is zero #274 #276 (Kazuho Oku)
- [SSL] fix potential stall while reading data from client #268 (Kazuho Oku)
- [SSL] bundle LibreSSL #236 #272 (Kazuho Oku)
- [SSL] obtain source-level compatibility with BoringSSL #228 (Kazuho Oku)
- [SSL] add directive `listen.ssl.cipher-preference` for controlling the selection logic of cipher-suites #233 (Kazuho Oku)
- [SSL] disable TLS compression #252 (bisho)
- [libh2o] fix C++ compatibility (do not use empty struct) #225 (Kazuho Oku)
- [libh2o] search external dependencies using pkg-config #227 (Kazuho Oku)
- [misc] fix GCC version detection bug used for controlling compiler warnings #224 (Kazuho Oku)
- [misc] check merory allocation failures in socket pool #265 (Tatsuhiko Kubo)
1.1.1 2015-03-09 06:12:00+0000
- [proxy] fix crash on NetBSD when upstream connection is persistent #217 (Kazuho Oku)
- [misc] fix compile error on FreeBSD #211 #212 (Syohei Yoshida)
1.1.0 2015-03-06 06:41:00+0000
- [core][file] send redirects appending '/' as abs-path redirects #209 (Kazuho Oku)
- [headers] add directives for manipulating response headers #204 (Kazuho Oku)
- [http2] do not send a corrupt response if header value is longer than 126 bytes #193 (Kazuho Oku)
- [http2] fix interoperability issue with nghttp2 0.7.5 and above 5c42eb1 (Kazuho Oku)
- [proxy] send `via` header to upstream #191 (Kazuho Oku)
- [proxy] resolve hostname asynchronously #207 (Kazuho Oku)
- [proxy] distribute load between upstream servers (using `rand()`) #208 (Kazuho Oku)
- [proxy] fix a bug that may cause a corrupt `location` header being forwarded #190 (Kazuho Oku)
- [reproxy] add support for `x-reproxy-url` header #187 #197 (Daisuke Maki, Kazuho Oku)
1.0.1 2015-02-23 05:50:00+0000
- [core] change backlog size from 65,536 to 65,535 #183 (Tatsuhiko Kubo)
- [http2] fix assertion failure in HPACK encoder #186 (Kazuho Oku)
- [http2] add `extern` to some global variables that were not marked as such #178 (Kazuho Oku)
- [proxy] close persistent upstream connection if client abruptly closes the stream #188 (Kazuho Oku)
- [proxy] fix internal state corruption in case upstream sends response headers divided into multpile packets #189 (Kazuho Oku)
- [SSL] add host header to OCSP request #176 (Masaaki Hirose)
- [libh2o] do not require header files under `deps/` when using libh2o #173 (Kazuho Oku)
- [libh2o] fix compile error in examples when compiled with `H2O_USE_LIBUV=0` #177 (Kazuho Oku)
- [libh2o] in example, add missing / after the reference path #180 (Matthieu Garrigues)
- [misc] fix invalid HTML in sample page #175 (Deepak Prakash)
1.0.0 2015-02-18 20:01:00+0000
- [core] add redirect handler #150 (Kazuho Oku)
- [core] add `pid-file` directive for specifying the pid file #164 (Kazuho Oku)
- [core] connections accepted by host-specific listeners should not be handled by handlers of other hosts #163 (Kazuho Oku)
- [core] (FreeBSD) fix a bug that prevented the standalone server from booting when run as root #160 (Kazuho Oku)
- [core] switch to pipe-based interthread messaging #154 (Kazuho Oku)
- [core] use kqueue on all BSDs #156 (Kazuho Oku)
- [access-log] more logging directives: %H, %m, %q, %U, %V, %v #158 (Kazuho Oku)
- [access-log] bugfix: header values were not logged when specified using uppercase letters #157 (Kazuho Oku)
- [file] add application/json to defalt MIME-types #159 (Tatsuhiko Kubo)
- [http2] add support for the finalized version of HTTP/2 #166 (Kazuho Oku)
- [http2] fix issues reported by h2spec v0.0.6 #165 (Kazuho Oku)
- [proxy] merge the cookie headers before sending to upstream #161 (Kazuho Oku)
- [proxy] simplify the configuration directives (and make persistent upstream connections as default) #162 (Kazuho Oku)
- [SSL] add configuration directive to preload DH params #148 (Jeff Marrison)
- [libh2o] separate versioning scheme using H2O_LIBRARY_VERSION_* #167 (Kazuho Oku)
0.9.2 2015-02-10 04:17:00+0000
- [core] graceful shutdown on SIGTERM #119 (Kazuho Oku)
- [core] less TCP errors under high load #81 (Kazuho Oku)
- [file] add support for HEAD requests #110 (Mark Hoersken)
- [http1] MSIE workaround (send `Cache-Control: private` in place of Vary) #114 (Kazuho Oku)
- [http2] support server-push #133 (Kazuho Oku)
- [http2] fix spurious RST_STREAMS being sent #132 (Kazuho Oku)
- [http2] weight-based distribution of bandwidth #135 (Kazuho Oku)
- [proxy] added configuration directive `proxy.preserve-host` #112 (Masahiro Nagano)
- [proxy] sends X-Forwarded-For and X-Forwarded-Proto headers #112 (Masahiro Nagano)
- [proxy] stability improvements #61 (Kazuho Oku)
- [misc] adjustments to make the source code more analyzer-friendly #113,#117 (Nick Desaulniers, Maks Naumov)
0.9.1 2015-01-19 21:13:00+0000
- added configuration directives: ssl/cipher-suite, ssl/ocsp-update-interval, ssl/ocsp-max-failures, expires, file.send-gzip
- [http2] added support for draft-16 (draft-14 is also supported)
- [http2] dependency-based prioritization
- [http2] improved conformance to the specification
- [SSL] OCSP stapling (automatically enabled by default)
- [SSL] fix compile error with OpenSSL below version 1.0.1
- [file] content negotiation (serving .gz files)
- [expires] added support for Cache-Control: max-age
- [libh2o] libh2o and the header files installed by `make install`
- [libh2o] fix compile error when used from C++
- automatically setuids to nobody when run as root and if `user` directive is not set
- automatically raises RLIMIT_NOFILE
- uses all CPU cores by default
- now compiles on NetBSD and other BSD-based systems
|
|
|
|
Upstream changes:
0.160001 2015-05-14 20:40:10+02:00 Europe/Amsterdam
[ BUG FIXES ]
* GH #893, #895: Catch config parse errors when Config::Any doesn't throw
them. (Russell Jenkins)
* GH #899: Minimum YAML version supported is v0.86 (Shlomi Fish)
* GH #906: send_file - missing import and fix logic error for streaming
by default (Russell Jenkins)
[ DOCUMENTATION ]
* GH #897: Remove docs for unimplemented 'load' keyword (Fayland Lam)
[ ENHANCEMENT ]
* GH #894, #898: Add status and headers methods to ::Response::Delayed
(Yanick Champoux, Charlie Gonzalez)
|
|
|
|
- Better .if checks
- Improved handling for "-" mode
- Improved suffix handling
- Recognize bitrig
|
|
was incomplete and not using cvs import.
|
|
|
|
|
|
|
|
An approximate changelog 5.0.3 to 5.1.2 (resolved issues from Jira):
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Bug ROL-2057
Missing NPE check in Roller PageServlet class
Unassigned Kohei Nozaki Major 30/Mar/15
Bug ROL-2058
No salt renewal on POST request
David Johnson Kohei Nozaki Major 30/Mar/15
Bug ROL-2059
Comment preview is invisible in Gaurav theme
David Johnson Kohei Nozaki Major 30/Mar/15
Bug ROL-2061
Wrong next month link of Calendar
David Johnson Kohei Nozaki Major 30/Mar/15
Bug ROL-2062
Missing NPE check in IndexOperation#getDocument()
David Johnson Kohei Nozaki Major 30/Mar/15
Improvement ROL-2064
Add viewport meta tag to Gaurav theme
David Johnson Kohei Nozaki Trivial 30/Mar/15
Bug ROL-2065
Gaurav sometimes displaying empty summary as unresolved "$entry.summary"
David Johnson Kohei Nozaki Minor 30/Mar/15
Bug ROL-2066
Comment URLs using https:// not saving properly in Gaurav theme
David Johnson Kohei Nozaki Trivial 30/Mar/15
Bug ROL-2067
Velocity configuration improvement
David Johnson David Johnson Major 30/Mar/15
Documentation ROL-2056
Wrong pointer (section number) in Install Guide at section 11.2
Unassigned Kohei Nozaki Minor 05/Jan/15
Bug ROL-2052
Custom stylesheets not being updated correctly when user switches between shared and custom themes.
Unassigned Glen Mazza Major 06/Oct/14
Bug ROL-2051
Roller not falling back to standard theme renditions when mobile one unavailable.
Unassigned Glen Mazza Critical 02/Oct/14
Bug ROL-1387
In creating tag aggregate counts, count tags only from published blog entries
Glen Mazza linda skrocki Major 02/Oct/14
Bug ROL-1620
Plus signs in categories lead to a 404 category RSS/Atom feeds
Glen Mazza linda skrocki Major 02/Oct/14
Bug ROL-2055
Comment search should be case insensitive
Glen Mazza Glen Mazza Minor 02/Oct/14
Bug ROL-2054
Newly saved categories not appearing on blog
Glen Mazza Glen Mazza Major 02/Oct/14
Bug ROL-1974
Roller's ROME Propono dependency needs updating to use newer JARs
David Johnson Glen Mazza Minor 25/Aug/14
Bug ROL-1973
ROME dependency used by Roller needs updating
David Johnson Glen Mazza Minor 25/Aug/14
Bug ROL-1942
Uploaded media file not selectable in media file view
Greg Huber Budi Ariyanto Major 25/Aug/14
Bug ROL-1948
getRealPath() null not handled
Unassigned Jürgen Weber Major 25/Aug/14
Task ROL-2039
Rename webpage and roller_templatecode tables
Glen Mazza Glen Mazza Major 25/Aug/14
Improvement ROL-2041
gaurav theme -- render full blog entries on main blog page if no summary given
Gaurav Saini Glen Mazza Major 25/Aug/14
Improvement ROL-1999
Switch from Referrers to storing tracking codes (e.g., Google Analytics)
Unassigned Glen Mazza Major 25/Aug/14
Bug ROL-1980
When deleting categories, Roller allows you to move its entries to invisible "root" category.
Glen Mazza Glen Mazza Major 25/Aug/14
Bug ROL-1981
Allow user to specify order of blog categories
Glen Mazza Glen Mazza Major 25/Aug/14
Task ROL-1979
Remove subcategory functionality from Roller 5.1
Glen Mazza Glen Mazza Major 25/Aug/14
Bug ROL-1554
Listing Box "Invite a new user to join..." does not have a horizontal scrolling bar
Glen Mazza Davis Nguyen Major 25/Aug/14
Improvement ROL-2038
Add dualTheme element to themes.xml descriptor
Glen Mazza Glen Mazza Blocker 25/Aug/14
Improvement ROL-1938
Switch to mobile template only in standard template's index page
Unassigned Tiger Gui Major 25/Aug/14
Improvement ROL-1937
Standard and Mobile template switch improvement patch
Unassigned Tiger Gui Major 25/Aug/14
New Feature ROL-1934
LDAP Comment Authenticator
Dave Johnson (Inactive) Nick Padilla Major 25/Jan/12 25/Aug/14
Task ROL-1977
Remove unused properties from ApplicationResources.properties
Glen Mazza Anil Gangolli Minor 25/Aug/14
Improvement ROL-1881
Add delete blog entry option to entries page
Unassigned Nicolas Muller Major 25/Aug/14
Bug ROL-1571
missing graphic alt text
Unassigned mike duigou Major 25/Aug/14
Bug ROL-1928
Missing 500-to-510-migration.vm file in Roller Mobile branch
David Johnson David Johnson Major 25/Aug/14
Task ROL-2043
Switch from YUI3 to JQuery UI for autocomplete, tabs, dialogs
Glen Mazza Glen Mazza Major 25/Aug/14
Task ROL-2022
Add Categories, demote tags from gaurav theme
Gaurav Saini Glen Mazza Major 25/Aug/14
Task ROL-2008
In "switch to (media) folder" drop-down, don't list the current folder the user is in.
Greg Huber Glen Mazza Major 25/Aug/14
Bug ROL-1273
resource item error
Glen Mazza Jian Liu Major 25/Aug/14
Task ROL-1434
lots of UI messaging needs to be converted to i18n keys in resource bundles
Glen Mazza Allen Gilliland Major 25/Aug/14
Bug ROL-2044
Member management page allows user to remove himself from blog.
Glen Mazza Glen Mazza Major 25/Aug/14
Bug ROL-1966
Search highlight problem
Glen Mazza Maciej Rumianowski Major 25/Aug/14
Bug ROL-1957
Unable to find RSD template
Unassigned Harsh Gupta Major 25/Aug/14
Bug ROL-1792
Hit count increments with <link rel="stylesheet" type="text/css" media="all" href="$model.weblog.stylesheet">
Greg Huber Greg Huber Trivial 25/Aug/14
Bug ROL-1716
a bug found when call getPopularTags with the limit=-1 (v4 m1)
Unassigned guoweizhan Major 25/Aug/14
Bug ROL-1414
Email scrambler not detecting hyphens in email addresses
Allen Gilliland linda skrocki Major 25/Aug/14
Improvement ROL-1649
Korean translation resource file
Unassigned Woonsan Ko Minor 25/Aug/14
Bug ROL-1930
Saving Template causes Null Pointer Exception
David Johnson David Johnson Blocker 25/Aug/14
Task ROL-1983
Only expose AJAX User List Servlet to admin users
Glen Mazza Glen Mazza Major 25/Aug/14
Task ROL-1986
Stop sending re-confirmation email after blogger approves comment.
Greg Huber Glen Mazza Minor 25/Aug/14
Improvement ROL-1978
Switch to more SEO-friendly hyphens instead of underscores to separate blog titles
Glen Mazza Glen Mazza Minor 25/Aug/14
Bug ROL-1616
Input fields not emptied after creating a new user
Unassigned Ronald Iwema Minor 25/Aug/14
Bug ROL-1638
Problem with themes on case sensitive file systems
Unassigned German Eichberger Major 25/Aug/14
New Feature ROL-1021
Referrer queue warning / filling up in logs. unclosed sessions.
Unassigned Rob Wilson Major 25/Aug/14
Bug ROL-1927
Roller 5 MSSQL Issues/Fixes
David Johnson Nick Padilla Major 25/Aug/14
Improvement ROL-2034
Hide Profile Password fields with SSO
Glen Mazza Jürgen Weber Major 25/Aug/14
Bug ROL-1794
file uploads with spaces in their names are 404ing (incorrect URL escaping?)
Greg Huber Dick Davies Major 25/Aug/14
Improvement ROL-1370
Support of email notifications preference for blog commentors
Unassigned linda skrocki Major 25/Aug/14
Bug ROL-1346
Weblog Calendar incorrectly assuming Sunday is first day of week for every locale.
Unassigned Vahid Zaboli Major 25/Aug/14
Test ROL-2033
Test Roller 5.1 with a weblog client
David Johnson David Johnson Major 25/Aug/14
Task ROL-2010
Update User's Guide with new app screen shots
Glen Mazza Glen Mazza Major 25/Aug/14
Bug ROL-2002
https:// URLs not being processed correctly in the comment URL field
Greg Huber Glen Mazza Major 25/Aug/14
Task ROL-1994
Switch to Apache Commons Collections 4.0
Unassigned Glen Mazza Minor 25/Aug/14
Bug ROL-1870
Duplicate bookmarks not showing
Unassigned Greg Huber Major 25/Aug/14
Bug ROL-1925
Patch for the bug of OpenID only authentication
Glen Mazza Shutra Major 25/Aug/14
Improvement ROL-929
Resign | "Are you sure?" Confirmation
Glen Mazza Greg Hamer Minor 25/Aug/14
Improvement ROL-2015
Add a description element to theme descriptor file (theme.xml)
Greg Huber Glen Mazza Major 25/Aug/14
Task ROL-1997
Switch WeblogEntry's pub status fields (DRAFT, PUBLISHED, PENDING, SCHEDULED) to an enum type
Unassigned Glen Mazza Minor 25/Aug/14
Task ROL-1995
Switch to JPA Typed Queries
Glen Mazza Glen Mazza Major 25/Aug/14
Task ROL-1984
./app/src/test/resources/WEB-INF/security.xml needs updating to Spring & Spring Security 3.x namespaces
Unassigned Glen Mazza Major 25/Aug/14
Bug ROL-1738
Charset of E-Mail Subject Needs to be configurable
Unassigned SATO Naoki Major 25/Aug/14
Bug ROL-1715
SiteModel's getWeblogsByLetterPager not documented correctly
Glen Mazza David Johnson Minor 25/Aug/14
Task ROL-2028
Separate the Basic Theme into Basic and Basic Mobile Themes
David Johnson Glen Mazza Major 25/Aug/14
Bug ROL-2018
"Notify me of new comments" not working on trunk.
Glen Mazza Glen Mazza Major 25/Aug/14
Task ROL-2000
Change current rol_ prefix for two newest tables
Unassigned Glen Mazza Minor 25/Aug/14
Bug ROL-1992
Blogroll OPML import page raising 500 Security Error
Unassigned Glen Mazza Major 25/Aug/14
Task ROL-1991
Switch publish date pop-up calendar to one with year entry option
Unassigned Glen Mazza Minor 25/Aug/14
Improvement ROL-1907
Inefficient use of key set iterator.
Unassigned Shelan Perera Minor 25/Aug/14
Bug ROL-2032
Test Roller 5.1 with blogs.apache.org database & themes
David Johnson David Johnson Major 25/Aug/14
Bug ROL-2007
Changing values in Media File Editor frequently results in permissions error.
Greg Huber Glen Mazza Major 25/Aug/14
Bug ROL-1988
Category search not working if space exists in category
Glen Mazza Glen Mazza Major 25/Aug/14
Bug ROL-1952
Roller 5.0.1 does not work with PostgreSQL 9.1
Unassigned Matthias Wimmer Major 25/Aug/14
Bug ROL-1746
Uploaded file names are lower-cased with AtomPub.
Greg Huber Tatsuya Noyori Major 25/Aug/14
Bug ROL-1596
Frontpage theme lose record!
Glen Mazza xiaojf Major 25/Aug/14
Improvement ROL-1430
French Translation (based on version 4.0 files)
Unassigned Denis Balazuc Minor 25/Aug/14
Improvement ROL-1965
Searching with locale on Multi Language blog
Glen Mazza Maciej Rumianowski Major 25/Aug/14
Bug ROL-2016
roller-startup.log not created on startup
Greg Huber Greg Huber Minor 25/Aug/14
Bug ROL-2009
Custom template theme folder creation isn't working
Unassigned Glen Mazza Major 25/Aug/14
Improvement ROL-1947
Provide a blog entry-level description field that can go into HTML header field
Dave Johnson (Inactive) Glen Mazza Major 25/Aug/14
Bug ROL-1956
ValidateSaltFilter not working on file upload
Greg Huber Matthias Wimmer Major 25/Aug/14
Bug ROL-1954
user weblogs cannot be managed when admin logs in and select any user via Server Aministration and clicks on eit
Unassigned Harsh Gupta Major 25/Aug/14
Bug ROL-1795
Posting comments with SchemeEnforcementFilter in operation.
Greg Huber Greg Huber Minor 25/Aug/14
Task ROL-2030
Replace Xinha editor with something more recent
Unassigned Glen Mazza Minor 25/Aug/14
Task ROL-1968
Upgrade Spring Security from 2.0.7 to 3.1.4
Unassigned Glen Mazza Major 25/Aug/14
Improvement ROL-1964
SearchServlet does not preserve locale
Unassigned Maciej Rumianowski Minor 25/Aug/14
Task ROL-2005
Switch to top-level folders only for Media Files
Unassigned Glen Mazza Major 25/Aug/14
Bug ROL-1739
Missing constraint on weblogentrytagagg table
Glen Mazza David Johnson Major 25/Aug/14
Bug ROL-1778
Blog entry preview before first publish not working with Derby database
Glen Mazza José Arthur Benetasso Villanova Major 25/Aug/14
|
|
PKGREVISION++
|
|
Upstream changelog:
Catalina
++++++++
fix Correct typo in the message shown by HttpServlet for unexpected
HTTP method. (kkolinko)
add Allow to configure RemoteAddrValve and RemoteHostValve to adopt
behavior depending on the connector port. Implemented by
optionally adding the connector port to the string compared with
the patterns allow and deny. Configured using addConnectorPort
attribute on valve. (rjung)
fix 56608: Fix IllegalStateException for JavaScript files when
switching from Writer to OutputStream. The special handling of
this case in the DefaultServlet was broken due to a MIME type
change for JavaScript. (markt)
fix 57675: Correctly quote strings when using the extended access
log. (markt)
Coyote
++++++
fix 57234: Make SSL protocol filtering to remove insecure protocols
case insensitive. Correct spelling of filterInsecureProtocols
method. (kkolinko/schultz)
fix When applying the maxSwallowSize limit to a connection read
that many bytes first before closing the connection to give
the client a chance to read the response. (markt)
fix 57544: Fix a potential infinite loop when preparing a kept
alive HTTP connection for the next request. (markt)
add 57570: Make the processing of chunked encoding trailing headers
optional and disabled by default. (markt)
fix 57581: Change statistics byte counter in coyote Request object
to be long to allow values above 2Gb. (kkolinko)
update Update the minimum recommended version of the Tomcat Native
library (if used) to 1.1.33. (markt)
Jasper
++++++
fix Fix potential issue with BeanELResolver when running under a
security manager. Some classes may not be accessible but may
have accessible interfaces. (markt)
fix Simplify code in ProtectedFunctionMapper class of Jasper
runtime. (kkolinko)
fix 57801: Improve the error message in the start script in case
the PID read from the PID file is already owned by a process.
(rjung)
Web applications
++++++++++++++++
fix Update documentation for CGI servlet. Recommend to copy the
servlet declaration into web application instead of enabling
it globally. Correct documentation for cgiPathPrefix. (kkolinko)
update Improve Tomcat Manager documentation. Rearrange, add section
on HTML GUI, document /expire command and Server Status page.
(kkolinko)
add 54143: Add display of the memory pools usage (including PermGen)
to the Status page of the Manager web application. (kkolinko)
fix Fix several issues with status.xsd schema in Manager web
application, testing it against actual output of
StatusTransformer class. (kkolinko)
update Align algorithm that generates anchor names in Tomcat
documentation with Tomcat 7/8/9. No visible changes, but may
help with future updates to the documentation. (kkolinko)
fix 56058: Add links to the AccessLogValve documentation for
configuring reverse proxies and/or Tomcat to ensure that the
desired information is used entered in the access log when
Tomcat is running behind a reverse proxy. (markt)
fix 57503: Make clear that the JULI integration for log4j only
works with log4j 1.2.x. (markt)
update 57644: Update examples to use Apache Standard Taglib 1.2.5.
(jboynes/kkolinko)
fix 57706: Clarify the documentation for the AJP connector to make
clearer that when using tomcatAuthentication="false" the user
provided by the reverse proxy will not be associated with any
roles. (markt)
fix Correct the documentation for deployOnStartup to make clear
that if a WAR file is updated while Tomcat is stopped and
unpackWARs is true, Tomcat will not detect the changed WAR
file when it starts and will not replace the unpacked WAR file
with the contents of the updated WAR. (markt)
add 57759: Add information to the keyAlias documentation to make
it clear that the order keys are read from the keystore is
implementation dependent. (markt)
fix 57864: Update the documentation web application to make it
clearer that hex values are not valid for cluster send options.
Based on a patch by Kyohei Nakamura. (markt)
Other
+++++
add 57344: Provide sha1 checksum files for Tomcat downloads.
(kkolinko)
fix 57558: Change catalina-tasks.xml to use all jars in
${catalina.home}/lib to define Tomcat Ant tasks. This fixes
a NoClassDefFoundError with validate task. (kkolinko)
update Update to Tomcat Native Library version 1.1.33 to pick up the
Windows binaries that are based on OpenSSL 1.0.1m and APR 1.5.1.
(markt)
|
|
|
|
Release notes:
TortoiseHg 3.4 is a regularly scheduled feature release.
Bug Fixes
bookmark, matching, sign, tag: allow to resize horizontally while
having fixed height (refs #4043)
bookmark, tag, update: avoid combo box taking too much space (fixes #4043)
commit: prompt for new largefiles first to skip extra confirmation
(fixes #1954)
filedata: rewrite copy detection by using copies.pathcopies() (fixes #3949)
merge: discard p2 changes without using debugsetparents (fixes #3856)
mergetools: add $output to meld to change which file will be saved
(fixes #4134)
quickop: do not calculate status unnecessarily in GUI process (refs #1828)
quickop: catch known exceptions raised from repo.status() (fixes #1828)
repomodel: clear cache of latest tags on repository change (fixes #4137)
repoview: ignore corrupted column_widths saved in QSettings (fixes #1456)
repowidget: refresh commit tab after rollback or custom hg command
(fixes #3981)
revset: set appropriate size policy to status bar of query dialog
(fixes #834)
sync: get host fingerprint asynchronously by extension command
(fixes #4114)
Improvements
bookmark: add simple bookmark dialog to sync screen (fixes #322)
commit: do not overwrite username if ui.askusername is set (closes #4064)
filectxactions: enable shortcuts only if the owner or its children has focus
filectxactions: add shortcut to delete unversioned file (closes #3681)
fileview, status: enable annotate mode for working directory
rebase: mention command line options in checkbox labels
sync: add "unbundle" to "repository" menu (fixes #4067)
workbench: add default merge action to main menu and toolbar (closes #222)
|
|
https://www.altsci.com/ipsec/
Patch obtained from src/crypto/dist/ipsec-tools/src/racoon/gssapi.c
Bump PKGREVISION
|
|
|
|
2015.05.13, Version 0.12.3 (Stable)
* V8: update to 3.28.71.19
* uv: upgrade to 1.5.0
* npm: upgrade to 2.9.1
* V8: don't busy loop in v8 cpu profiler thread (Mike Tunnicliffe)
* V8: fix issue with let bindings in for loops (adamk)
* debugger: don't spawn child process in remote mode (Jackson Tian)
* net: do not set V4MAPPED on FreeBSD (Julien Gilli)
* repl: make 'Unexpected token' errors recoverable (Julien Gilli)
* src: backport ignore ENOTCONN on shutdown race (Ben Noordhuis)
* src: fix backport of SIGINT crash fix on FreeBSD (Julien Gilli)
|
|
|
|
Changelog:
0.50 - added dictionary::detach and dictionary::getValue(key)
added xmldom::getNullNode()
improved xml printing for text nodes
signalmanager::waitForSignal(NULL) works as expected now
updated charstring::httpEscape not to escape legal symbols
added flush() method to stdio classes
added detection and support for vsnprintf_s
fixed serviceentry, protocolentry and rpcentry on windows
updated *entry classes for NULL and uninitialization safety
implemented filesystem::initialize(fd) for Windows
updated filesystem::initialize() with NULL and -1 to behave in
predictable ways now, updated documentation for them too
abstracted _get_osfhandle calls and added an invalid parameter callback
updated filedescriptor to use bit fields for all of its flags
implemented file::changeOwner() for windows
removed xattrs stuff
removed SSL-related ifdef's from headers and implemented degenerate
SSL routines for when SSL isn't supported
timezone conversion works on windows now
refactored bytebuffer and stringbuffer to be extent-based
fixed a subtle stringbuffer with initialcontents bug
refactored stringbuffer to use bytebuffer::write/appendFormatted
directly instead of charstring::parseNumber
implemented dynamicarray and staticarray classes
refactored build process to use nmake and be compatible with many
different versions of MS Visual Studio
updated vsnprintf_s calls for platforms where it's not defined
added configure test for bool and true/false and definitions for
platforms that don't define them
updated timed semaphore waits - if seconds or nanoseconds are negative
then the timed wait acts like an un-timed wait
added support for getsockopt with size_t optlen parameter
fixed strncasecmp on windows when str2 is longer than str1
xmlsax uses memorymap on Windows now
fixed file::lockFile() and file::unlockFile() on Windows
fixed charstring::printf on Solaris 2.5.1
fixed datetime::getSystemDateAndTime() for Windows without 64-bit
integers
fixed potential double-CloseHandle in thread class
0.49:
Full changelog follows:
combined passswdentry and shadowentry classes into userentry class
updated file::sync() to use FlushFileBuffers directly
implemented sys::sync(), reboot(), halt() and shutdown() for windows
implemented various sys::getXXX() methods for windows
added "detached" option to process::spawn()
crash-related methods in process class catch SIGABRT, SIGFPE, SIGILL, SIGBUS, SIGIOT, SIGEMT and SIGSYS in addition to SIGSEGV now
shutdown-related methods in process class catch SIGQUIT and SIGHUP in addition to SIGINT and SIGTERM now
on windows, signal classes now support catching, sending/raising SIGABRT, SIGFPE, SIGILL, SIGINT, SIGSEGV and SIGTERM and sending/raising SIGKILL
disabled threads outright on OSR5
fixed threads detection for solaris 2.6
codetree bails properly at end of string now
fixed a break-related condition that could cause codetree to loop indefinitely
added support for a beginning-of-line character to codetree
added support for recursive breaks to codetree
made charstring::compareIgnoringCase null-safe for platforms that don't have str(n)casecmp
improved Windows support in signal classes
-Wno-overloaded-virtual is now set when clang is used
fixed some subtle kqueue-related bugs
added sys/byteorder.h and htonll/ntohll for solaris 11
fixed endian-detection macros for solaris 10 and older
added support for SIGLARM and signalmanager::alarm() on windows
improved windows implementation of semaphoreset
added sys::signalsInterruptSystemCalls()
added process::supportsFork()
|
|
|
|
|
|
|
|
* Fix build with Ruby 2.2.
* Use setup.rb instead of extconf.rb.
* Use GITHUB framework.
Changelog:
Not available.
|
|
|
|
|
|
Changelog:
----------------------------------------------------------------------
OmegaT 3.4 (2015-04-20)
----------------------------------------------------------------------
11 Enhancements
4 Bug fixes
3 Localisation updates
----------------------------------------------------------------------
3.4 vs 3.1.9 update 1
Implemented requests:
- Improve OmegaT look and feel
https://sourceforge.net/p/omegat/feature-requests/1082/
- Better statistics layout for l10n UI
https://sourceforge.net/p/omegat/feature-requests/820/
- Increase the size or better layout of the statistics window
https://sourceforge.net/p/omegat/feature-requests/820/
- Add Close button to Statistics window
https://sourceforge.net/p/omegat/feature-requests/859/
- Automatically detect input file encoding when possible
https://sourceforge.net/p/omegat/feature-requests/1075/
- Improve fuzzy match difference granularity in Chinese
https://sourceforge.net/p/omegat/feature-requests/1077/
Other changes:
- New XML Spreadsheet 2003 filter. This allows translating Excel document
exported in XML 2003 format. As the extension is .xml, other filters may
"steal" the file. In that case, they have to be disabled. The XML
Spreadhsheet 2003 filter limit itself to documents where the first tag
is "Workbook".
- In Options > File Filters, the filters used by the current project
are displayed in bold
- New "Trafficlight" theme in the Switch Colour Theme script
- Options > Tag Validation was renamed to Tag Processing. In that dialog,
there's now an option to decide whether protected text (from the XLIFF filter)
and custom tags should be counted in statistics. The option is on by default.
In previous versions, protected text was not counted in the statistics, so
the option has to be disabled to get the same value as before.
- The font selected in Options > Fonts can be applied now also to statistics
Bug fixes:
- Editor title overflows with long filename
https://sourceforge.net/p/omegat/bugs/739/
- Valid XML characters outside the BMP are stripped from input
https://sourceforge.net/p/omegat/bugs/740/
- Scripting window: now ScriptsDir is displayed like "foo\scripts" instead
of "foo\.\scripts"
- OmegaT does not look nice on Mac retina display
https://sourceforge.net/p/omegat/bugs/712/
Localisation updates:
- Dutch localisation updated to 3.4 (UI, documentation, scripts, readme)
- Italian localisation updated to 3.4 (UI, documentation, scripts)
- Japanese localisation updated to 3.4 (UI, readme)
----------------------------------------------------------------------
OmegaT 3.1.9 update 1 (2015-04-15)
----------------------------------------------------------------------
1 Enhancement
3 Bug fixes
0 Localisation update
----------------------------------------------------------------------
3.1.9 update 1 vs. 3.1.9
Implemented requests:
- Change auto-completion mode access keys
https://sourceforge.net/p/omegat/feature-requests/1073/
Bug fixes:
- The OK and Cancel buttons of Options > Editing Behaviour were not
displayed correctly
- Newly assigned scripts execute several times
https://sourceforge.net/p/omegat/bugs/737/
- The project-specific file filter configuration was deleted when
quitting OmegaT
----------------------------------------------------------------------
OmegaT 3.1.9 (2015-03-09)
----------------------------------------------------------------------
21 Enhancements
13 Bug fixes
6 Localisation updates
----------------------------------------------------------------------
3.1.9 vs. 3.1.8
Implemented requests:
- Machine translation with Yandex
https://sourceforge.net/p/omegat/feature-requests/790/
- Use selection for text Search from "Fuzzy Match" or "Glossary" panes
https://sourceforge.net/p/omegat/feature-requests/877/
- Allow to insert selection into translation from the Fuzzy Matches pane
https://sourceforge.net/p/omegat/feature-requests/1057/
- Warn user if the Enter key is hit while "Use TAB to Advance" is checked
https://sourceforge.net/p/omegat/feature-requests/1061/
- Support XLIFF equiv-text in tooltips, simplify tooltip prefs
https://sourceforge.net/p/omegat/feature-requests/1064/
- Show the number of non-unique segment instances in the segment markers
https://sourceforge.net/p/omegat/feature-requests/1068/
- Contextual menu to jump to another instance of non-unique segments
https://sourceforge.net/p/omegat/feature-requests/1067/
- Make it easy to "brand" OmegaT for custom deployments
https://sourceforge.net/p/omegat/feature-requests/1069/
- Make it easy to find specific files by name or path
https://sourceforge.net/p/omegat/feature-requests/1070/
- Improve resizing behavior of Project Files dialog
https://sourceforge.net/p/omegat/feature-requests/1071/
- Make segment numbers visible for all segments
https://sourceforge.net/p/omegat/feature-requests/1038/
Other enhancements:
- ILIAS Language File filter. Those files can have the .lang or
.lang.local extensions. As .lang files are also loaded by the Lang
Mozilla filter, it has to be unabled to load them with the ILIAS filter.
- Machine translation requests are now cached. That means that a
source segment already translated will not be requested again during
the same session (i.e., until OmegaT is closed).
- The initial location and the layout when resized of various dialogs
were improved. The OK button was set as the default button for all dialogs.
- The Custom Colours dialog was improved. It can be closed with Escape,
changes are remembered immediately and all colours can be reset at once.
There's also a new tab for colour selection.
- The Project Files dialog can be hidden on project load via hidden preference
(project_files_show_on_load)
- It is possible to define the text and background colour of modification
information and the active segment's source and target
- Dialogs are now centered against the main window instead of the screen
- The Visio filter was updated to remove unneeded tags in Visio 2010 documents
- For versions including Java, the JRE is now 1.8.0_31 instead of 1.7
- The appearance of the Project Files dialog has been improved on OS X.
The new styling has been applied to all platforms.
Bug fixes:
- There's now a 3-second retry when OmegaT attempts to rename files
- java.io.IOException: Error rename new file to glossary in team projects
https://sourceforge.net/p/omegat/bugs/695/
- In some specific cases, the content of Mozilla DTD files was not
loaded
- License information was missing from the lib folder of binary
distributions
- Wrong Swedish segmentation exception corrected
- Newline characters are lost in Japanese target documents
https://sourceforge.net/p/omegat/bugs/721/
- Filtering after a search with no live segments freezes OmegaT
https://sourceforge.net/p/omegat/bugs/692/
- Ellipses missing in several menu items
https://sourceforge.net/p/omegat/bugs/728/
- Both menu items for alternative translation are enabled
https://sourceforge.net/p/omegat/bugs/731/
- Incorrect handling of typographic apostrophe (U+2019)
https://sourceforge.net/p/omegat/bugs/598/
- The project-specific filter configuration was not saved when creating a
new project
- Mac OS X: A workaround was added for the full-screen window sizing
bug on OS X + Java 1.8. See https://bugs.openjdk.java.net/browse/JDK-8065739
for the bug description.
- The font set in Options > Font was only used after the change when
Apply this font to the Project Files dialog was used
Localisation updates:
- Belarusian localisation updated to 3.1.9 (UI, tutorial, scripts, readme)
- Basque localisation updated to 3.1.9 (UI, tutorial, scripts, readme)
- Dutch localisation updated to 3.1.9 (UI, documentation, scripts, readme)
- Italian localisation updated to 3.1.9 (UI, documentation, scripts, readme)
- Japanese localisation updated to 3.1.9 (UI, documentation, readme)
- Russian localisation updated to 3.1.9 (UI, tutorial, scripts, readme)
----------------------------------------------------------------------
OmegaT 3.1.8 (2014-12-04)
----------------------------------------------------------------------
6 Enhancements
10 Bug fixes
5 Localisation updates
----------------------------------------------------------------------
3.1.8 vs. 3.1.7
Implemented requests:
- Allow custom background/foreground colors for different elements in the editor
https://sourceforge.net/p/omegat/feature-requests/1035/
- Show dialog for unsupported SVN errors
https://sourceforge.net/p/omegat/feature-requests/1041/
- Allow configurable diff-style colours in fuzzy matching
https://sourceforge.net/p/omegat/feature-requests/900/
Other enhancements:
- It is now possible to customise colours used in the Fuzzy Matches pane
- All OmegaT windows (Search and Scripting windows) now use the OmegaT icon
instead of the standard Java ones
- Revised user manual
Bug fixes:
- Project specific segmentation rules cannot be disabled
https://sourceforge.net/p/omegat/bugs/694/
- Colours were not working in the Fuzzy Matches pane
- The text colour was not applied in the Editor
- If there was a double click in the search result entries pane in the
Search window before the first searching execution, the cursor (i.e.,
mouse pointer) changed to the Wait icon and could not be restored
- Strange glossary behavior - removing of newly added terms
https://sourceforge.net/p/omegat/bugs/696/
- OmegaT keeps temporary files project_save.tmx-based_on_revision_number.new
https://sourceforge.net/p/omegat/bugs/683/
- Git team project saving failure with 3.1.6
https://sourceforge.net/p/omegat/bugs/714/
- Fuzzy match segment not shown entirely when Ctrl+Arrow/Num is typed
https://sourceforge.net/p/omegat/bugs/720/
- PO comments also included as source text
https://sourceforge.net/p/omegat/bugs/705/
- In team projects, OmegaT was sometimes failing to rename files (perhaps
blocked by antivirus or cache software). There's now a 3-second retry.
Localisation updates:
- Dutch localisation updated to 3.1.7 (UI)
- Interlingua localisation updated to 3.1.7 (UI, documentation)
- Italian localisation updated to 3.1.7 (UI)
- Japanese localisation updated to 3.1.8 (UI, documentation)
- French localisation updated to 3.1.8 (UI, readme, documentation)
|
|
|
|
|
|
|
|
While here restore old behaviour of not alphabetically sorting memos by default.
Changes since 1.8.1:
1.8.2 - 05/18/14
Many bug fixes
Fixed VCard output
Added export for B-Folders
Added export for KeePassX
Changed the "enye" letter in Manana an "n", got tired of it causing problems
(Ma\303\261ana to Manana)
Made lots of stupid code changes to make the compiler warnings go away
|
|
|
|
pkgsrc changes:
- adapt to upstream support for clang
- more comprehensive sweep for 64-bit time_t related stuff
- XXX pjsip has its own time related stuff that is 32-bit only
-----
The Asterisk Development Team has announced security releases for Certified
Asterisk 1.8.28, 11.6, and 13.1 and Asterisk 1.8, 11, 12, and 13. The available
security releases are released as versions 1.8.28.cert-5, 1.8.32.3, 11.6-cert11,
11.17.1, 12.8.2, 13.1-cert2, and 13.3.2.
The release of these versions resolves the following security vulnerability:
* AST-2015-003: TLS Certificate Common name NULL byte exploit
When Asterisk registers to a SIP TLS device and and verifies the server,
Asterisk will accept signed certificates that match a common name other than
the one Asterisk is expecting if the signed certificate has a common name
containing a null byte after the portion of the common name that Asterisk
expected. This potentially allows for a man in the middle attack.
For more information about the details of this vulnerability, please read
security advisory AST-2015-003, which was released at the same time as this
announcement.
For a full list of changes in the current releases, please see the ChangeLogs:
http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-11.17.1
The security advisory is available at:
* http://downloads.asterisk.org/pub/security/AST-2015-003.pdf
Thank you for your continued support of Asterisk!
-----
The Asterisk Development Team has announced the release of Asterisk 11.17.0.
The release of Asterisk 11.17.0 resolves several issues reported by the
community and would have not been possible without your participation.
Thank you!
The following are the issues resolved in this release:
New Features made in this release:
-----------------------------------
* ASTERISK-17899 - Handle crypto lifetime in SDES-SRTP negotiation
(Reported by Dwayne Hubbard)
Bugs fixed in this release:
-----------------------------------
* ASTERISK-24742 - [patch] Fix ast_odbc_find_table function in
res_odbc (Reported by ibercom)
* ASTERISK-22436 - [patch] No BYE to masqueraded channel on INVITE
with replaces (Reported by Eelco Brolman)
* ASTERISK-24479 - Enable REF_DEBUG for module references
(Reported by Corey Farrell)
* ASTERISK-24701 - Stasis: Write timeout on WebSocket fails to
fully disconnect underlying socket, leading to events being
dropped with no additional information (Reported by Matt Jordan)
* ASTERISK-24772 - ODBC error in realtime sippeers when device
unregisters under MariaDB (Reported by Richard Miller)
* ASTERISK-24451 - chan_iax2: reference leak in sched_delay_remove
(Reported by Corey Farrell)
* ASTERISK-24799 - [patch] make fails with undefined reference to
SSLv3_client_method (Reported by Alexander Traud)
* ASTERISK-24787 - [patch] - Microsoft exchange incompatibility
for playing back messages stored in IMAP - play_message: No
origtime (Reported by Graham Barnett)
* ASTERISK-24814 - asterisk/lock.h: Fix syntax errors for non-gcc
OSX with 64 bit integers (Reported by Corey Farrell)
* ASTERISK-24796 - Codecs and bucket schema's prevent module
unload (Reported by Corey Farrell)
* ASTERISK-24724 - 'httpstatus' Web Page Produces Incomplete HTML
(Reported by Ashley Sanders)
* ASTERISK-24797 - bridge_softmix: G.729 codec license held
(Reported by Kevin Harwell)
* ASTERISK-24800 - Crash in __sip_reliable_xmit due to invalid
thread ID being passed to pthread_kill (Reported by JoshE)
* ASTERISK-17721 - Incoming SRTP calls that specify a key lifetime
fail (Reported by Terry Wilson)
* ASTERISK-23214 - chan_sip WARNING message 'We are requesting
SRTP for audio, but they responded without it' is ambiguous and
wrong in some cases (Reported by Rusty Newton)
* ASTERISK-15434 - [patch] When ast_pbx_start failed, both an
error response and BYE are sent to the caller (Reported by
Makoto Dei)
* ASTERISK-18105 - most of asterisk modules are unbuildable in
cygwin environment (Reported by feyfre)
* ASTERISK-24828 - Fix Frame Leaks (Reported by Kevin Harwell)
* ASTERISK-24838 - chan_sip: Locking inversion occurs when
building a peer causes a peer poke during request handling
(Reported by Richard Mudgett)
* ASTERISK-24825 - Caller ID not recognized using
Centrex/Distinctive dialing (Reported by Richard Mudgett)
* ASTERISK-24739 - [patch] - Out of files -- call fails --
numerous files with inodes from under /usr/share/zoneinfo,
mostly posixrules (Reported by Ed Hynan)
* ASTERISK-23390 - NewExten Event with application AGI shows up
before and after AGI runs (Reported by Benjamin Keith Ford)
* ASTERISK-24786 - [patch] - Asterisk terminates when playing a
voicemail stored in LDAP (Reported by Graham Barnett)
* ASTERISK-24808 - res_config_odbc: Improper escaping of
backslashes occurs with MySQL (Reported by Javier Acosta)
* ASTERISK-20850 - [patch]Nested functions aren't portable.
Adapting RAII_VAR to use clang/llvm blocks to get the
same/similar functionality. (Reported by Diederik de Groot)
* ASTERISK-19470 - Documentation on app_amd is incorrect (Reported
by Frank DiGennaro)
* ASTERISK-21038 - Bad command completion of "core set debug
channel" (Reported by Richard Kenner)
* ASTERISK-18708 - func_curl hangs channel under load (Reported by
Dave Cabot)
* ASTERISK-16779 - Cannot disallow unknown format '' (Reported by
Atis Lezdins)
* ASTERISK-24876 - Investigate reference leaks from
tests/channels/local/local_optimize_away (Reported by Corey
Farrell)
* ASTERISK-24817 - init_logger_chain: unreachable code block
(Reported by Corey Farrell)
* ASTERISK-24880 - [patch]Compilation under OpenBSD (Reported by
snuffy)
* ASTERISK-24879 - [patch]Compilation fails due to 64bit time
under OpenBSD (Reported by snuffy)
Improvements made in this release:
-----------------------------------
* ASTERISK-24790 - Reduce spurious noise in logs from voicemail -
Couldn't find mailbox %s in context (Reported by Graham Barnett)
For a full list of changes in this release, please see the ChangeLog:
http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-11.17.0
Thank you for your continued support of Asterisk!
-----
The Asterisk Development Team has announced the release of Asterisk 11.16.0.
The release of Asterisk 11.16.0 resolves several issues reported by the
community and would have not been possible without your participation.
Thank you!
The following are the issues resolved in this release:
Bugs fixed in this release:
-----------------------------------
* ASTERISK-24472 - Asterisk Crash in OpenSSL when calling over WSS
from JSSIP (Reported by Badalian Vyacheslav)
* ASTERISK-24614 - Deadlock when DEBUG_THREADS compiler flag
enabled (Reported by Richard Mudgett)
* ASTERISK-24449 - Reinvite for T.38 UDPTL fails if SRTP is
enabled (Reported by Andreas Steinmetz)
* ASTERISK-24619 - [patch]Gcc 4.10 fixes in r413589 (1.8) wrongly
casts char to unsigned int (Reported by Walter Doekes)
* ASTERISK-24337 - Spammy DEBUG message needs to be at a higher
level - 'Remote address is null, most likely RTP has been
stopped' (Reported by Rusty Newton)
* ASTERISK-23733 - 'reload acl' fails if acl.conf is not present
on startup (Reported by Richard Kenner)
* ASTERISK-24628 - [patch] chan_sip - CANCEL is sent to wrong
destination when 'sendrpid=yes' (in proxy environment) (Reported
by Karsten Wemheuer)
* ASTERISK-24672 - [PATCH] Memory leak in func_curl CURLOPT
(Reported by Kristian Høgh)
* ASTERISK-20744 - [patch] Security event logging does not work
over syslog (Reported by Michael Keuter)
* ASTERISK-23850 - Park Application does not respect Return
Context Priority (Reported by Andrew Nagy)
* ASTERISK-23991 - [patch]asterisk.pc file contains a small error
in the CFlags returned (Reported by Diederik de Groot)
* ASTERISK-24288 - [patch] - ODBC usage with app_voicemail -
voicemail is not deleted after review, hangup (Reported by LEI
FU)
* ASTERISK-24048 - [patch] contrib/scripts/install_prereq selects
32-bit packages on 64-bit hosts (Reported by Ben Klang)
* ASTERISK-24709 - [patch] msg_create_from_file used by MixMonitor
m() option does not queue an MWI event (Reported by Gareth
Palmer)
* ASTERISK-24355 - [patch] chan_sip realtime uses case sensitive
column comparison for 'defaultuser' (Reported by
HZMI8gkCvPpom0tM)
* ASTERISK-24719 - ConfBridge recording channels get stuck when
recording started/stopped more than once (Reported by Richard
Mudgett)
* ASTERISK-24715 - chan_sip: stale nonce causes failure (Reported
by Kevin Harwell)
* ASTERISK-24728 - tcptls: Bad file descriptor error when
reloading chan_sip (Reported by Kevin Harwell)
* ASTERISK-24676 - Security Vulnerability: URL request injection
in libCURL (CVE-2014-8150) (Reported by Matt Jordan)
* ASTERISK-24711 - DTLS handshake broken with latest OpenSSL
versions (Reported by Jared Biel)
* ASTERISK-24646 - PJSIP changeset 4899 breaks TLS (Reported by
Stephan Eisvogel)
For a full list of changes in this release, please see the ChangeLog:
http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-11.16.0
Thank you for your continued support of Asterisk!
|
|
uses Qt5 with cmake.
|