summaryrefslogtreecommitdiff
path: root/lang/php5/Makefile
AgeCommit message (Collapse)AuthorFilesLines
2007-12-05Pullup ticket 2239 - requested by adrianpghen1-2/+1
security update for php5 - pkgsrc/lang/php5/Makefile 1.62 - pkgsrc/lang/php5/Makefile.common 1.28 - pkgsrc/lang/php5/distinfo 1.50 - pkgsrc/lang/php5/patches/patch-ao removed - pkgsrc/lang/php5/patches/patch-ar removed Module Name: pkgsrc Committed By: adrianp Date: Fri Nov 23 13:20:01 UTC 2007 Modified Files: pkgsrc/lang/php5: Makefile Makefile.common distinfo Removed Files: pkgsrc/lang/php5/patches: patch-ao patch-ar Log Message: Update to 5.2.5 * Security Enhancements and Fixes in PHP 5.2.5: Fixed dl() to only accept filenames. Reported by Laurent Gaffie. Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887). Reported by Laurent Gaffie. Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences. Reported by Rasmus Lerdorf Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie. Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications. Reported by SecurityReason. Fixed bug 42869 (automatic session id insertion adds sessions id to non-local forms). Fixed bug 41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()). * Key enhancements in PHP 5.2.5 include: Upgraded PCRE to version 7.3 Updated timezone database to version 2007.9 Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc() functions Fixed bug 43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()) Fixed bug 42785 (json_encode() formats doubles according to locale rather then following standard syntax) Fixed bug 42549 (ext/mysql failed to compile with libmysql 3.23) Over 60 bug fixes. For all the details see: http://www.php.net/ChangeLog-5.php#5.2.5
2007-09-25add test target, as suggested by Chris Ross on pkgsrc-users@n.o.jdolecek1-1/+2
2007-09-04load extensions via dlopen(), in preference to using NsLinkModule() et.al. ↵jdolecek1-2/+2
on Mac OS X, so that symbols of loaded modules are available for other, dependant modules; dlopen() is native function since 10.4, so actually apparently preferable interface now this is necessary for PDO family of modules (pdo_* depends on symbols of PDO module), and for XSL module (which depends on symbols of DOM module); doing it this way allows for PDO and DOM modules to be also shared and dynamically loaded, this avoids need to compile them into main PHP binary bump PKGREVISION, this is functionality change for Mac OS X (no change for other platforms)
2007-09-04install PHP unstripped on Darwin/Mac OS X, so that modules load properly; bumpjdolecek1-2/+7
PKGREVISION PR: 36869 by Louis Guillaume
2007-09-03Stop the path to the wrapper "sed" script from ending up in "php-config".tron1-1/+3
Bump package revision.
2007-09-02Update lang/php5 to 5.2.4 - miscellaneous security fixes and over 120 otherjdolecek1-2/+1
bug fixes
2007-08-01- Add patches to fix CVE-2007-3806 referring CVS repository.taca1-2/+2
- Fix compile problem on NetBSD with mremap(2). Bump PKGREVISION.
2007-06-11Added support for installation to DESTDIR. patch-an had removed correctheinz1-9/+17
support for this before, probably unintentionally.
2007-06-08Fix the install path for the CGI binary so it ends up where we want it.adrianp1-3/+11
Pointed out by schmonz@ and taca@ Bump PKGREVISION
2007-06-07Add in the correct patch to fix CVE-2007-2872adrianp1-1/+2
Spotted by Takahiro Kambe
2007-06-06Update to php-5.2.3adrianp1-2/+2
Security Fixes * Fixed an integer overflow inside chunk_split() (by Gerhard Wagner, CVE-2007-2872) * Fixed possible infinite loop in imagecreatefrompng. (by Xavier Roche, CVE-2007-2756) * Fixed ext/filter Email Validation Vulnerability (MOPB-45 by Stefan Esser, CVE-2007-1900) * Fixed bug #41492 (open_basedir/safe_mode bypass inside realpath()) (by bugs dot php dot net at chsc dot dk) * Improved fix for CVE-2007-1887 to work with non-bundled sqlite2 lib. * Added mysql_set_charset() to allow runtime altering of connection encoding. * Upgraded bundled SQLite 3 to version 3.3.17. (Ilia) * Fixed gd build when used with freetype 1.x (Pierre, Tony) And a fair few bugs fixed, see: http://www.php.net/ChangeLog-5.php#5.2.3 for all the details.
2007-05-06Update 5.2.2adrianp1-2/+1
* Fixed CVE-2007-1001, GD wbmp used with invalid image size (by Ivan Fratric) * Fixed asciiz byte truncation inside mail() (MOPB-33 by Stefan Esser) * Fixed a bug in mb_parse_str() that can be used to activate register_globals (MOPB-26 by Stefan Esser) * Fixed unallocated memory access/double free in in array_user_key_compare() (MOPB-24 by Stefan Esser) * Fixed a double free inside session_regenerate_id() (MOPB-22 by Stefan Esser) * Added missing open_basedir & safe_mode checks to zip:// and bzip:// wrappers. (MOPB-21 by Stefan Esser). * Limit nesting level of input variables with max_input_nesting_level as fix for (MOPB-03 by Stefan Esser) * Fixed CRLF injection inside ftp_putcmd(). (by loveshell[at]Bug.Center.Team) * Fixed a possible super-global overwrite inside import_request_variables(). (by Stefano Di Paola, Stefan Esser) * Fixed a remotely trigger-able buffer overflow inside bundled libxmlrpc library. (by Stanislav Malyshev) * Fixed a header injection via Subject and To parameters to the mail() function (MOPB-34 by Stefan Esser) * Fixed wrong length calculation in unserialize S type (MOPB-29 by Stefan Esser) * Fixed substr_compare and substr_count information leak (MOPB-14 by Stefan Esser) (Stas, Ilia) * Fixed a remotely trigger-able buffer overflow inside make_http_soap_request() (by Ilia Alshanetsky) * Fixed a buffer overflow inside user_filter_factory_create(). (by Ilia Alshanetsky)
2007-05-05Remove PEAR from the default PHP installadrianp1-2/+2
2007-04-28Patch to fix PHP bug #40326 (cannot open file from cwd if parent folder notsborrill1-2/+2
readable). Patch will be in 5.2.2, so this patch can be removed once it has been released.
2007-02-25put back openssl extension, mistakely commented out in PHP 5.2.1 upgradejdolecek1-1/+2
noted by Manuel Bouyer
2006-11-06Update lang/php5 to 5.2.0.jdolecek1-2/+1
Changes since 5.1.6: The key features of PHP 5.2.0 include: * New memory manager for the Zend Engine with improved performance and a more accurate memory usage tracking. * Input filtering extension was added and enabled by default. * JSON extension was added and enabled by default. * ZIP extension for creating and editing zip files was introduced. * Hooks for tracking file upload progress were introduced. * Introduced E_RECOVERABLE_ERROR error mode. * Introduced DateTime and DateTimeZone objects with methods to manipulate date/time information. * Upgraded bundled SQLite, PCRE libraries. * Upgraded OpenSSL, MySQL and PostgreSQL client libraries for Windows installations. * Many performance improvements. * Over 200 bug fixes. Security Enhancements and Fixes in PHP 5.2.0: * Made PostgreSQL escaping functions in PostgreSQL and PDO extension keep track of character set encoding whenever possible. * Added allow_url_include, set to Off by default to disallow use of URLs for include and require. * Disable realpath cache when open_basedir and safe_mode are being used. * Improved safe_mode enforcement for error_log() function. * Fixed a possible buffer overflow in the underlying code responsible for htmlspecialchars() and htmlentities() functions. * Added missing safe_mode and open_basedir checks for the cURL extension. * Fixed overflow is str_repeat() & wordwrap() functions on 64bit machines. * Fixed handling of long paths inside the tempnam() function. * Fixed safe_mode/open_basedir checks for session.save_path, allowing them to account for extra parameters. * Fixed ini setting overload in the ini_restore() function. For a full list of changes in PHP 5.2.0, see the ChangeLog: http://www.php.net/ChangeLog-5.php#5.2.0 Also other notable extensions changes: * filePRO extension removed (not in PECL yet, php-filepro disabled for PHP5) * JSON added (not enabled by default, packaged in php-json) * filter added (enabled by default) * wddx rewritten to native libxml2, fixing several encoding bugs
2006-11-04Fix for CVE-2006-5465 from PHP CVSadrianp1-2/+2
http://www.hardened-php.net/advisory_132006.138.html
2006-10-22Fixes for CVE-2006-4812 and CVE-2006-4625adrianp1-2/+2
Bump nb
2006-10-20remove --enable-memory-limit - 8MB is too low, and this justjdolecek1-1/+2
duplicates process resource limits, which already provide necessary "safety net" protection against rogue scripts bump PKGREVISION for this adressess PR pkg/32007 by "pancake" also remove --enable-track-vars, since that configure argument is long gone from PHP
2006-08-19Remove special DIST_SUBDIR processing from Makefile.taca1-4/+1
2006-08-19Update php5 package to 5.1.5:taca1-2/+1
17 Aug 2006, PHP 5.1.5 - Fixed memory_limit on 64bit systems. (Stefan E.) - Fixed overflow on 64bit systems in str_repeat() and wordwrap(). (Stefan E.) - Disabled CURLOPT_FOLLOWLOCATION in curl when open_basedir or safe_mode are enabled. (Stefan E., Ilia) - Fixed bug #38322 (reading past array in sscanf() leads to arbitrary code execution). (Tony) - Fixed bug #38125 (undefined reference to spl_dual_it_free_storage). (Marcus) - Fixed bug #38112 (corrupted gif segfaults) (Pierre) - Fixed bug #37587 (var without attribute causes segfault). (Marcus) - Fixed bug #37576 (FastCGI env (cgi vars) table overflow). (Piotr) - Fixed bug #37496 (FastCGI output buffer overrun). (Piotr, Dmitry) - Fixed bug #37487 (oci_fetch_array() array-type should always default to OCI_BOTH). (Tony) - Fixed bug #37416 (iterator_to_array() hides exceptions thrown in rewind() method). (Tony) - Fixed bug #37392 (Unnecessary call to OCITransRollback() at the end of request). (Tony) - Fixed bug #37341 ($_SERVER in included file is shortened to two entries, if $_ENV gets used). (Dmitry) - Fixed bug #37313 (sigemptyset() used without including <signal.h>). (jdolecek) - Fixed bug #37346 (invalid colormap format) (Pierre) - Fixed bug #37360 (invalid gif size) (Pierre) - Fixed bug #37306 (max_execution_time = max_input_time). (Dmitry) - Fixed Bug #37278 (SOAP not respecting uri in __soapCall). (Dmitry) - Fixed bug #37265 (Added missing safe_mode & open_basedir checks to imap_body()). (Ilia) - Fixed bug #37256 (php-fastcgi dosen't handle connection abort). (Dmitry)
2006-08-19More fix of PLIST, now pkg_delete should always succeed.taca1-2/+2
2006-08-17Correct PLIST to fix a binary package:taca1-2/+2
- remove an extra directory. - handle empty directories.
2006-08-10Add security fix for Secunia Advisory SA21403 from PHP's CVS repository.taca1-2/+2
Bump PKGREVISION.
2006-07-18Fix for CVE-2006-3011adrianp1-2/+2
Bump to nb2
2006-07-08Change DIST_SUBDIR because the current distfile path was already used beforeminskim1-2/+2
for a different tarball.
2006-06-06Note in the MESSAGE file the path to the PHP CGI binary to answer an FAQ.jlam1-1/+2
2006-06-05This package needs lex to build. Add it to USE_TOOLS.minskim1-2/+2
2006-05-17Use PKGNAME_NOREV for DIST_SUBDIR (instead of just PKGNAME).reed1-2/+2
As reported by Christopher W. Richardson on tech-pkg.
2006-05-16Tarball on php.net has changed to include the pear installation fileadrianp1-15/+3
Modify the package to not seperately fetch the pear file from php.net Problem found by Christopher W. Richardson on tech-pkg@ Bump PKGREVISION
2006-05-07Added missing DIST_SUBDIRmartti1-2/+2
2006-05-07fetch PEAR installation archive too, to avoid use of wget by PHP installationjdolecek1-1/+16
PR: pkg/33432 by Martti Kuparinen XXX PEAR should be moved to separate package
2006-05-06Update lang/php5 to 5.1.4.jdolecek1-7/+2
Some of the key changes include: * Disallow certain characters in session names. * Fixed a buffer overflow inside the wordwrap() function. * Prevent jumps to parent directory via the 2nd parameter of the tempnam() function. * Enforce safe_mode for the source parameter of the copy() function. * Fixed cross-site scripting inside the phpinfo() function. * Fixed offset/length parameter validation inside the substr_compare() function. * Fixed a heap corruption inside the session extension. * Fixed a bug that would allow variable to survive unset(). * Fixed a number of crashes in the DOM, SOAP and PDO extensions. * Upgraded bundled PCRE library to version 6.6 * The use of the var keyword to declare properties no longer raises a deprecation E_STRICT. * FastCGI interface was completely reimplemented. * Multitude of improvements to the SPL, SimpleXML, GD, CURL and Reflection extensions. * Over 120 various bug fixes. See release annoucement on: http://www.php.net/release_5_1_3.php And ChangeLog: http://www.php.net/ChangeLog-5.php#5.1.3
2006-04-14PHP4/5 security changes... They're not critical issues; secunia classescube1-2/+2
them between "not critical" and "less critical". Fix CVE-2006-0996, CVE-2006-1494, CVE-2006-1608, CVE-2006-1490. See: http://secunia.com/advisories/19383/ http://secunia.com/advisories/19599/ Patches were extracted from CVS. I had to translate the one for CVE-2006-1608 on php4 because it has not made its way to the php4.4 branch (I don't know why; I can confirm it fixes the issue). While here, add PATCHDIR to the list of variables php5's Makefile.php defines. That way, ap-php gets patched too...
2006-02-17Install bin/pear with correct file permissionsadam1-3/+3
2006-02-06Updated lang/php5 to 5.1.2martti1-2/+2
* HTTP Response Splitting has been addressed in ext/session and in the header() function. * Fixed format string vulnerability in ext/mysqli. * Fixed possible cross-site scripting problems in certain error conditions. * Hash & XMLWriter extensions added and enabled by default. * Upgraded OCI8 extension. * Over 85 various bug fixes. (I haven't heard anything from the MAINTAINER but since this works fine on my servers and as this fixes security issues I checked in this)
2006-02-05Recursive revision bump / recommended bump for gettext ABI change.joerg1-2/+2
2006-02-02Added two missing files to the PLIST. Bumped PKGREVISION.rillig1-2/+2
2006-01-04Use PKGMANDIR instead of "man".reed1-2/+2
2005-12-29Remove USE_PKGINSTALL from pkgsrc now that mk/install/pkginstall.mkjlam1-2/+1
automatically detects whether we want the pkginstall machinery to be used by the package Makefile.
2005-12-06patch php.ini-dist and php.ini-recommended to comment out extension_dirjdolecek1-2/+2
and to uncomment and explicitly set upload_tmp_dir, so that this works out of box (patches adapted from www/php4) pointed out by Martti Kuparinen on tech-pkg@
2005-12-04patch pear to use -n post-install - it cannot be done using normaljdolecek1-2/+6
patch framework, the file is part of binary .phar archive and is created during installation this has been submitted as PHP bug #35544, so this may be adressed upstream hopefully
2005-12-03Update PHP5 to version 5.1.1. Some of the key features include:jdolecek1-2/+2
* A complete rewrite of date handling code, with improved timezone support. * Significant performance improvements compared to PHP 5.0.X. * PDO extension is now enabled by default (separate pkg for pkgsrc) * Over 30 new functions in various extensions and built-in functionality. * Bundled libraries, PCRE and SQLite upgraded to latest versions. * Over 400 various bug fixes. * PEAR upgraded to version 1.4.5 This release also fixes various security problems discovered in 5.0.X.
2005-11-21Allow choosing of CGI or FastCGI as SAPI for the PHP interpreter.joerg1-1/+11
This is done via an option group, default is CGI. Note that the FastCGI interpreter can still be used for normal CGI, but there might be security issues involved in doing so.
2005-10-08add inet6 to list of supported options; this effectively enables IPv6jdolecek1-2/+2
support by default, since the USE_INET6 mapping now properly kicks in
2005-10-08Unfortunately PHP has several openssl hooks, which are only enabledjdolecek1-2/+2
when the base PHP is compiled with openssl extension (e.g. ssl://, tls:// stream support, and couple others). These don't work when SSL support is loaded via extension. For this reason, make openssl extension unconditionally built-in into the main PHP package, and g/c security/php-openssl.
2005-09-08Update php5 to version 5.0.5. This is maintenance release, aimed atjdolecek1-13/+3
bug fixes only with only few and minor new features. Full changelog available at: http://mirrors.inway.cz/ChangeLog-5.php#5.0.5
2005-09-04Move some options that only apply to the PHP CGI package from Makefile.phpjlam1-1/+4
(shared with ap-php) into the php package Makefile.
2005-09-03Update php5 to 5.0.4nb1 to address XML_RPC security issue(s)adrianp1-3/+13
Fix based on work done by tron@ for the PHP 4.x branch fix PLIST fixup to correctly remove @PREFIX@/lib/php
2005-05-22Remove USE_GNU_TOOLS and replace with the correct USE_TOOLS definitions:jlam1-2/+2
USE_GNU_TOOLS -> USE_TOOLS awk -> gawk m4 -> gm4 make -> gmake sed -> gsed yacc -> bison
generated by cgit v1.2.3 (git 2.39.1) at 2024-06-05 06:52:44 +0000