summaryrefslogtreecommitdiff
path: root/lang/php5/Makefile
AgeCommit message (Collapse)AuthorFilesLines
2012-06-16Remove php5 (PHP 5.2.17), please migra to php53 or php54.taca1-69/+0
2012-06-14Recursive PKGREVISION bump for libxml2 buildlink addition.sbd1-2/+2
2012-05-17lang/php5: Fix unwanted directory removalmarino1-3/+3
Replace OWN_DIRS with @pkgdir to avoid unwanted deletion of PHP extension directory when the only extension is deinstalled.
2012-05-13Add fix for CVE-2012-1823.taca1-2/+2
Bump PKGREVISION.
2011-06-24Change LICENSE to php from php-license.taca1-2/+2
2011-06-20Add LICENSE.taca1-1/+3
2011-06-15Add two security fix, CVE-2011-1938 and filename-injection from PHP 5.3'staca1-2/+2
repository. Bump PKGREVISION.
2011-03-21Apply changes by r308525 from PHP's repository to fix bug #54055taca1-2/+2
(buffer overrun with high values for precision ini setting). It fixes one of security fixes by PHP 5.3.6. Bump PKGREVISION.
2011-02-21Add patches to fix SA43328.taca1-2/+2
Bump PKGREVISION.
2011-02-15Re-enable DL_AUTO_VARS -- makes PHP CLI work again with extensions thatshattered1-1/+2
are linked to pthread (like mysql.so).
2010-12-13Update php5 package to 5.2.15 (PHP 5.2.15):taca1-2/+1
The PHP development team would like to announce the immediate availability of PHP 5.2.15. This release marks the end of support for PHP 5.2. All users of PHP 5.2 are encouraged to upgrade to PHP 5.3. This release focuses on improving the security and stability of the PHP 5.2.x branch with a small number, of predominatly security fixes. Security Enhancements and Fixes in PHP 5.2.15: * Fixed extract() to do not overwrite $GLOBALS and $this when using EXTR_OVERWRITE. * Fixed crash in zip extract method (possible CWE-170). * Fixed a possible double free in imap extension. * Fixed possible flaw in open_basedir (CVE-2010-3436). * Fixed NULL pointer dereference in ZipArchive::getArchiveComment. (CVE-2010-3709). * Fixed bug #52929 (Segfault in filter_var with FILTER_VALIDATE_EMAIL with large amount of data). Key enhancements in PHP 5.2.15 include: * Fixed bug #47643 (array_diff() takes over 3000 times longer than php 5.2.4). * Fixed bug #44248 (RFC2616 transgression while HTTPS request through proxy with SoapClient object). * To prepare for upgrading to PHP 5.3, now that PHP 5.2's support ended, a migration guide available on http://php.net/migration53, details the changes between PHP 5.2 and PHP 5.3. For a full list of changes in PHP 5.2.15 see the ChangeLog at http://www.php.net/ChangeLog-5.php#5.2.15.
2010-11-25- CVE-2010-4150 (php-imap)taca1-1/+2
http://svn.php.net/viewvc?view=revision&revision=305032 - CVE-2010-3710 (a part of SA41724) http://svn.php.net/viewvc?view=revision&revision=303885 - CVE-2010-3870 (a part of SA41724) http://svn.php.net/viewvc?view=revision&revision=305055 Bump PKGREVISION.
2010-07-24Update "php5" package to version 5.2.14. Changes since version 5.2.13:tron1-2/+1
- Reverted bug fix #49521 (PDO fetchObject sets values before calling constructor). (Felipe) - Updated timezone database to version 2010.5. (Derick) - Upgraded bundled PCRE to version 8.02. (Ilia) - Rewrote var_export() to use smart_str rather than output buffering, prevents data disclosure if a fatal error occurs (CVE-2010-2531). (Scott) - Fixed a possible interruption array leak in strrchr(). Reported by Péter Veres. (CVE-2010-2484) (Felipe) - Fixed a possible interruption array leak in strchr(), strstr(), substr(), chunk_split(), strtok(), addcslashes(), str_repeat(), trim(). (Felipe) - Fixed a possible memory corruption in substr_replace() (Dmitry) - Fixed SplObjectStorage unserialization problems (CVE-2010-2225). (Stas) - Fixed a possible stack exaustion inside fnmatch(). Reporeted by Stefan Esser (Ilia) - Reset error state in PDO::beginTransaction() reset error state. (Ilia) - Fixed a NULL pointer dereference when processing invalid XML-RPC requests (Fixes CVE-2010-0397, bug #51288). (Raphael Geissert) - Fixed handling of session variable serialization on certain prefix characters. Reported by Stefan Esser (Ilia) - Fixed a possible arbitrary memory access inside sqlite extension. Reported by Mateusz Kocielski. (Ilia) - Fixed a crash when calling an inexistent method of a class that inherits PDOStatement if instantiated directly instead of doing by the PDO methods. (Felipe) - Fixed bug #52317 (Segmentation fault when using mail() on a rhel 4.x (only 64 bit)). (Adam) - Fixed bug #52238 (Crash when an Exception occured in iterator_to_array). (Johannes) - Fixed bug #52237 (Crash when passing the reference of the property of a non-object). (Dmitry) - Fixed bug #52163 (SplFileObject::fgetss() fails due to parameter that can't be set). (Felipe) - Fixed bug #52162 (custom request header variables with numbers are removed). (Sriram Natarajan) - Fixed bug #52160 (Invalid E_STRICT redefined constructor error). (Felipe) - Fixed bug #52061 (memory_limit above 2G). (Felipe) - Fixed bug #52041 (Memory leak when writing on uninitialized variable returned from function). (Dmitry) - Fixed bug #52037 (Concurrent builds fail in install-programs). (seanius at debian dot org, Kalle) - Fixed bug #52019 (make lcov doesn't support TESTS variable anymore). (Patrick) - Fixed bug #52010 (open_basedir restrictions mismatch on vacuum command). (Ilia, Felipe) - Fixed bug #51943 (AIX: Several files are out of ANSI spec). (Kalle, coreystup at gmail dot com) - Fixed bug #51911 (ReflectionParameter::getDefaultValue() memory leaks with constant array). (Felipe) - Fixed bug #51905 (ReflectionParameter fails if default value is an array with an access to self::). (Felipe) - Fixed bug #51822 (Segfault with strange __destruct() for static class variables). (Dmitry) - Fixed bug #51671 (imagefill does not work correctly for small images). (Pierre) - Fixed bug #51670 (getColumnMeta causes segfault when re-executing query after calling nextRowset). (Pierrick) - Fixed bug #51629 (CURLOPT_FOLLOWLOCATION error message is misleading). (Pierre) - Fixed bug #51617 (PDO PGSQL still broken against PostGreSQL < 7.4). (Felipe, wdierkes at 5dollarwhitebox dot org) - Fixed bug #51615 (PHP crash with wrong HTML in SimpleXML). (Felipe) - Fixed bug #51609 (pg_copy_to: Invalid results when using fourth parameter). (Felipe) - Fixed bug #51608 (pg_copy_to: WARNING: nonstandard use of \\ in a string literal). (cbandy at jbandy dot com) - Fixed bug #51607 (pg_copy_from does not allow schema in the tablename argument). (cbandy at jbandy dot com) - Fixed bug #51604 (newline in end of header is shown in start of message). (Daniel Egeberg) - Fixed bug #51562 (query timeout in mssql can not be changed per query). (ejsmont dot artur at gmail dot com) - Fixed bug #51552 (debug_backtrace() causes segmentation fault and/or memory issues). (Dmitry) - Fixed bug #51532 (Wrong prototype for SplFileObject::fscanf()). (Etienne) - Fixed bug #51445 (var_dump() invalid/slow *RECURSION* detection). (Felipe) - Fixed bug #51393 (DateTime::createFromFormat() fails if format string contains timezone). (Adam) - Fixed bug #51374 (Wrongly initialized object properties). (Etienne) - Fixed bug #51338 (URL-Rewriter is still enabled if use_only_cookies is on). (Ilia, j dot jeising at gmail dot com) - Fixed bug #51273 (Faultstring property does not exist when the faultstring is empty) (Ilia, dennis at transip dot nl) - Fixed bug #51269 (zlib.output_compression Overwrites Vary Header). (Adam) - Fixed bug #51263 (imagettftext and rotated text uses wrong baseline) (cschneid at cschneid dot com, Takeshi Abe) - Fixed bug #51237 (milter SAPI crash on startup). (igmar at palsenberg dot com) - Fixed bug #51213 (pdo_mssql is trimming value of the money column). (Ilia, alexr at oplot dot com) - Fixed bug #51192 (FILTER_VALIDATE_URL will invalidate a hostname that includes '-'). (Adam, solar at azrael dot ws). - Fixed bug #51190 (ftp_put() returns false when transfer was successful). (Ilia) - Fixed bug #51183 (ext/date/php_date.c fails to compile with Sun Studio). (Sriram Natarajan) - Fixed bug #51171 (curl_setopt() doesn't output any errors or warnings when an invalid option is provided). (Ilia) - Fixed bug #51128 (imagefill() doesn't work with large images). (Pierre) - Fixed bug #51086 (DBA DB4 doesn't work with Berkeley DB 4.8). (Chris Jones) - Fixed bug #51062 (DBA DB4 uses mismatched headers and libraries). (Chris Jones) - Fixed bug #51023 (filter doesn't detect int overflows with GCC 4.4). (Raphael Geissert) - Fixed bug #50762 (in WSDL mode Soap Header handler function only being called if defined in WSDL). (mephius at gmail dot com) - Fixed bug #50698 (SoapClient should handle wsdls with some incompatiable endpoints). (Justin Dearing) - Fixed bug #50383 (Exceptions thrown in __call() / __callStatic() do not include file and line in trace). (Felipe) - Fixed bug #49730 (Firebird - new PDO() returns NULL). (Felipe) - Fixed bug #49723 (LimitIterator with empty SeekableIterator). (Etienne) - Fixed bug #49576 (FILTER_VALIDATE_EMAIL filter needs updating) (Rasmus) - Fixed bug #49320 (PDO returns null when SQLite connection fails). (Felipe) - Fixed bug #49267 (Linking fails for iconv). (Moriyosh) - Fixed bug #48601 (xpath() returns FALSE for legitimate query). (Rob) - Fixed bug #48289 (iconv_mime_encode() quoted-printable scheme is broken). (Adam, patch from hiroaki dot kawai at gmail dot com). - Fixed bug #43314 (iconv_mime_encode(), broken Q scheme). (Rasmus) - Fixed bug #33210 (getimagesize() fails to detect width/height on certain JPEGs). (Ilia) - Fixed bug #23229 (syslog() truncates messages). (Adam)
2010-03-04Update suhosin patch for PHP 5.2.13.taca1-1/+2
Bump PKGREVISION.
2010-02-27Update php5 package to 5.2.13.taca1-2/+1
25 Feb 2010, PHP 5.2.13 - Updated timezone database to version 2010.2. (Derick) - Upgraded bundled PCRE to version 7.9. (Ilia) - Removed automatic file descriptor unlocking happening on shutdown and/or stream close (on all OSes excluding Windows). (Tony, Ilia) - Changed tidyNode class to disallow manual node creation. (Pierrick) - Added missing host validation for HTTP urls inside FILTER_VALIDATE_URL. (Ilia) - Improved LCG entropy. (Rasmus, Samy Kamkar) - Fixed safe_mode validation inside tempnam() when the directory path does not end with a /). (Martin Jansen) - Fixed a possible open_basedir/safe_mode bypass in session extension identified by Grzegorz Stachowiak. (Ilia) - Fixed bug in bundled libgd causing spurious horizontal lines drawn by gdImageFilledPolygon (libgd #100). (Takeshi Abe) - Fixed build of mysqli with MySQL 5.5.0-m2. (Andrey) - Fixed bug #50940 Custom content-length set incorrectly in Apache sapis. (Brian France, Rasmus) - Fixed bug #50930 (Wrong date by php_date.c patch with ancient gcc/glibc versions). (Derick) - Fixed bug #50859 (build fails with openssl 1.0 due to md2 deprecation). (Ilia, hanno at hboeck dot de) - Fixed bug #50847 (strip_tags() removes all tags greater then 1023 bytes long). (Ilia) - Fixed bug #50832 (HTTP fopen wrapper does not support passwordless HTTP authentication). (Jani) - Fixed bug #50823 (ReflectionFunction::isDeprecated producing "cannot be called statically" error). (Jani, Felipe) - Fixed bug #50791 (Compile failure: Bad logic in defining fopencookie emulation). (Jani) - Fixed bug #50787 (stream_set_write_buffer() has no effect on socket streams). (vnegrier at optilian dot com, Ilia) - Fixed bug #50772 (mysqli constructor without parameters does not return a working mysqli object). (Andrey) - Fixed bug #50761 (system.multiCall crashes in xmlrpc extension). (hiroaki dot kawai at gmail dot com, Ilia) - Fixed bug #50732 (exec() adds single byte twice to $output array). (Ilia) - Fixed bug #50728 (All PDOExceptions hardcode 'code' property to 0). (Joey, Ilia) - Fixed bug #50727 (Accessing mysqli->affected_rows on no connection causes segfault). (Andrey, Johannes) - Fixed bug #50680 (strtotime() does not support eighth ordinal number). (Ilia) - Fixed bug #50661 (DOMDocument::loadXML does not allow UTF-16). (Rob) - Fixed bug #50657 (copy() with an empty (zero-byte) HTTP source succeeds but returns false). (Ilia) - Fixed bug #50636 (MySQLi_Result sets values before calling constructor). (Pierrick) - Fixed bug #50632 (filter_input() does not return default value if the variable does not exist). (Ilia) - Fixed bug #50576 (XML_OPTION_SKIP_TAGSTART option has no effect). (Pierrick) - Fixed bug #50575 (PDO_PGSQL LOBs are not compatible with PostgreSQL 8.5). (Matteo) - Fixed bug #50558 (Broken object model when extending tidy). (Pierrick) - Fixed bug #50540 (Crash while running ldap_next_reference test cases). (Sriram) - Fixed bug #50508 (compile failure: Conflicting HEADER type declarations). (Jani) - Fixed bug #50394 (Reference argument converted to value in __call). (Stas) - Fixed bug #49851 (http wrapper breaks on 1024 char long headers). (Ilia) - Fixed bug #49600 (imageTTFText text shifted right). (Takeshi Abe) - Fixed bug #49585 (date_format buffer not long enough for >4 digit years). (Derick, Adam) - Fixed bug #49463 (setAttributeNS fails setting default namespace). (Rob) - Fixed bug #48667 (Implementing Iterator and IteratorAggregate). (Etienne) - Fixed bug #48590 (SoapClient does not honor max_redirects). (Sriram) - Fixed bug #48190 (Content-type parameter "boundary" is not case-insensitive in HTTP uploads). (Ilia) - Fixed bug #47601 (defined() requires class to exist when testing for class constants). (Ilia) - Fixed bug #47409 (extract() problem with array containing word "this"). (Ilia, chrisstocktonaz at gmail dot com) - Fixed bug #47002 (Field truncation when reading from dbase dbs with more then 1024 fields). (Ilia, sjoerd-php at linuxonly dot nl) - Fixed bug #45599 (strip_tags() truncates rest of string with invalid attribute). (Ilia, hradtke) - Fixed bug #44827 (define() allows :: in constant names). (Ilia)
2010-01-17Recursive PKGREVISION bump for jpeg update to 8.wiz1-1/+2
2009-12-23Update lang/php5 to 5.2.12, security update.taca1-2/+1
Security Enhancements and Fixes in PHP 5.2.12: * Fixed a safe_mode bypass in tempnam() identified by Grzegorz Stachowiak. (CVE-2009-3557, Rasmus) * Fixed a open_basedir bypass in posix_mkfifo() identified by Grzegorz Stachowiak. (CVE-2009-3558, Rasmus) * Added "max_file_uploads" INI directive, which can be set to limit the number of file uploads per-request to 20 by default, to prevent possible DOS via temporary file exhaustion, identified by Bogdan Calin. (CVE-2009-4017, Ilia) * Added protection for $_SESSION from interrupt corruption and improved "session.save_path" check, identified by Stefan Esser. (CVE-2009-4143, Stas) * Fixed bug #49785 (insufficient input string validation of htmlspecialchars()). (CVE-2009-4142, Moriyoshi, hello at iwamot dot com) Key enhancements in PHP 5.2.12 include: * Fixed unnecessary invocation of setitimer when timeouts have been disabled. (Arvind Srinivasan) * Fixed crash in com_print_typeinfo when an invalid typelib is given. (Pierre) * Fixed crash in SQLiteDatabase::ArrayQuery() and SQLiteDatabase::SingleQuery() when calling using Reflection. (Felipe) * Fixed crash when instantiating PDORow and PDOStatement through Reflection. (Felipe) * Fixed memory leak in openssl_pkcs12_export_to_file(). (Felipe) * Fixed bug #50207 (segmentation fault when concatenating very large strings on 64bit linux). (Ilia) * Fixed bug #50162 (Memory leak when fetching timestamp column from Oracle database). (Felipe) * Fixed bug #50006 (Segfault caused by uksort()). (Felipe) * Fixed bug #50005 (Throwing through Reflection modified Exception object makes segmentation fault). (Felipe) * Fixed bug #49174 (crash when extending PDOStatement and trying to set queryString property). (Felipe) * Fixed bug #49098 (mysqli segfault on error). (Rasmus) * Over 50 other bug fixes.
2009-11-30Add fixes for http://secunia.com/advisories/37412/ from PHP's repositry.taca1-10/+10
1. CVE-2009-3292 is already fixed in 5.2.11. 2. CVE-2009-3558 http://svn.php.net/viewvc?view=revision&revision=288934 3. CVE-2009-3557 http://svn.php.net/viewvc?view=revision&revision=288945 http://svn.php.net/viewvc?view=revision&revision=288971 4. CVE-2009-4017 http://svn.php.net/viewvc?view=revision&revision=289990 http://svn.php.net/viewvc?view=revision&revision=290820 http://svn.php.net/viewvc?view=revision&revision=290885 Other pkgsrc changes: * Don't hardcord /usr/pkg in php.ini-dist and php.ini-recommended. * Add comments to some of patch files. Bump PKGREVISION.
2009-10-22Add patch to check byte sequence more strictly in htmlspecialchars().taca1-1/+2
http://bugs.php.net/bug.php?id=49785 These are patch refrects r289411, r289554, r289565, r289567 and r289605 in PHP svn repositry. Bump PKGREVISION.
2009-06-09Requires pkg-config to find openssl dependancy.sketch1-2/+2
2009-03-02The PHP development team would like to announce the immediate availability ↵adrianp1-2/+1
of PHP 5.2.9. This release focuses on improving the stability of the PHP 5.2.x branch with over 50 bug fixes, several of which are security related. All users of PHP are encouraged to upgrade to this release. Security Enhancements and Fixes in PHP 5.2.9: * Fixed security issue in imagerotate(), background colour isn't validated correctly with a non truecolour image. Reported by Hamid Ebadi, APA Laboratory (Fixes CVE-2008-5498). (Scott) * Fixed a crash on extract in zip when files or directories entry names contain a relative path. (Pierre) * Fixed explode() behavior with empty string to respect negative limit. (Shire) * Fixed a segfault when malformed string is passed to json_decode(). (Scott) Key enhancements in PHP 5.2.9 include: * Added optional sorting type flag parameter to array_unique(). Default is SORT_REGULAR. (Andrei) * Fixed bug #45996 (libxml2 2.7 causes breakage with character data in xml_parse()). (Rob) * A number of fixes in the mbstring extension (Moriyoshi) * Fixed bug #44336 (Improve pcre UTF-8 string matching performance). (frode at coretrek dot com, Nuno) * Fixed bug #46699 (xml_parse crash when parser is namespace aware). (Rob) * Fixed bug #46748 (Segfault when an SSL error has more than one error). (Scott) * Fixed bug #46889 (Memory leak in strtotime()). (Derick) * Fixed bug #47049 (SoapClient::__soapCall causes a segmentation fault). (Dmitry) * Fixed bug #47165 (Possible memory corruption when passing return value by reference). (Dmitry) * Fixed bug #47282 (FILTER_VALIDATE_EMAIL is marking valid email addresses as invalid). (Ilia) * Fixed bug #47422 (modulus operator returns incorrect results on 64 bit linux). (Matt) * Over 50 bug fixes.
2009-02-07Get SSL support working on OpenSolaris. Unfortunately on OpenSolairs theadrianp1-1/+2
OpenSSL install is split between /lib and /usr/include/openssl with plays havoc with the php ./configure as it assumes both have the same base directory (e.g. /usr). This patch uses a modified inbuilt check for OpenSSL instead of explicitly specifying a base using --with-openssl.
2008-12-10Update to 5.2.8.adrianp1-2/+1
Security Enhancements and Fixes in PHP 5.2.7: Upgraded PCRE to version 7.8 (Fixes CVE-2008-2371) Fixed missing initialization of BG(page_uid) and BG(page_gid), reported by Maksymilian Arciemowicz. Fixed incorrect php_value order for Apache configuration, reported by Maksymilian Arciemowicz. Fixed a crash inside gd with invalid fonts (Fixes CVE-2008-3658). Fixed a possible overflow inside memnstr (Fixes CVE-2008-3659). Fixed security issues detailed in CVE-2008-2665 and CVE-2008-2666. Fixed bug #45151 (Crash with URI/file..php (filename contains 2 dots)).(Fixes CVE-2008-3660) Fixed bug #42862 (IMAP toolkit crash: rfc822.c legacy routine buffer overflow). (Fixes CVE-2008-2829) Key enhancements in PHP 5.2.7 include: Fixed several memory leaks inside the readline and sqlite extensions A number of corrections relating to date parsing inside the date extension Fixed bugs relating to data retrieval in the PDO extension A series of crashes in various areas of code were resolved Several corrections were made to the strip_tags() function in terms of < and <?XML handling A number of bugs were fixed in extract() function when EXTR_REFS flag is being used Added the ability to log PHP errors to the SAPI (Ex. Apache log) logging facility Over 170 bug fixes. 5.2.8 Reverted bug fix Fixed bug #42718 that broke magic_quotes_gpc (Scott)
2008-12-08Revert to 5.2.6:adrianp1-1/+2
http://www.php.net/archive/2008.php#id2008-12-07-1 Thanks to tron@ for the heads up
2008-12-05Update to 5.2.7.adrianp1-2/+1
Security Enhancements and Fixes in PHP 5.2.7: Upgraded PCRE to version 7.8 (Fixes CVE-2008-2371) Fixed missing initialization of BG(page_uid) and BG(page_gid), reported by Maksymilian Arciemowicz. Fixed incorrect php_value order for Apache configuration, reported by Maksymilian Arciemowicz. Fixed a crash inside gd with invalid fonts (Fixes CVE-2008-3658). Fixed a possible overflow inside memnstr (Fixes CVE-2008-3659). Fixed security issues detailed in CVE-2008-2665 and CVE-2008-2666. Fixed bug #45151 (Crash with URI/file..php (filename contains 2 dots)).(Fixes CVE-2008-3660) Fixed bug #42862 (IMAP toolkit crash: rfc822.c legacy routine buffer overflow). (Fixes CVE-2008-2829) Key enhancements in PHP 5.2.7 include: Fixed several memory leaks inside the readline and sqlite extensions A number of corrections relating to date parsing inside the date extension Fixed bugs relating to data retrieval in the PDO extension A series of crashes in various areas of code were resolved Several corrections were made to the strip_tags() function in terms of < and <?XML handling A number of bugs were fixed in extract() function when EXTR_REFS flag is being used Added the ability to log PHP errors to the SAPI (Ex. Apache log) logging facility Over 170 bug fixes.
2008-08-17This adds ${PREFIX}/lib/php to the default include_path in php.iniadrianp1-2/+2
which makes integration with PEAR a little simpler. PKGREVISION++
2008-07-08Fix PEAR installs where PKG_SYSCONFDIR is not the default.adrianp1-2/+2
Fixes PR 39081 PKGREVISION++
2008-05-04Security Enhancements and Fixes in PHP 5.2.6:adrianp1-2/+1
Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin. Fixed integer overflow in printf() identified by Maksymilian Aciemowicz. Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh. Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz. Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser. Upgraded bundled PCRE to version 7.6 Key enhancements in PHP 5.2.6 include: * Fixed two possible crashes inside the posix extension. * Fixed bug 44069 (Huge memory usage with concatenation using . instead of .=) * Fixed bug 44141 (private parent constructor callable through static function). * Fixed bug 43589 (a possible infinite loop in bz2_filter.c). * Fixed bug 43450 (Memory leak on some functions with implicit object __toString() call). * Fixed bug 43201 (Crash on using uninitialized vals and __get/__set). * Fixed bug 42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql). * Fixed bug 42937 (__call() method not invoked when methods are called on parent from child class). * Fixed bug 42736 (xmlrpc_server_call_method() crashes). * Fixed bug 42369 (Implicit conversion to string leaks memory). * Fixed bug 41562 (SimpleXML memory issue). * Over 120 bug fixes. See http://www.php.net/ChangeLog-5.php#5.2.6 for all the details
2008-01-18Per the process outlined in revbump(1), perform a recursive revbumptnn1-1/+2
on packages that are affected by the switch from the openssl 0.9.7 branch to the 0.9.8 branch. ok jlam@
2007-11-23Update to 5.2.5adrianp1-2/+1
* Security Enhancements and Fixes in PHP 5.2.5: Fixed dl() to only accept filenames. Reported by Laurent Gaffie. Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887). Reported by Laurent Gaffie. Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences. Reported by Rasmus Lerdorf Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie. Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications. Reported by SecurityReason. Fixed bug 42869 (automatic session id insertion adds sessions id to non-local forms). Fixed bug 41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()). * Key enhancements in PHP 5.2.5 include: Upgraded PCRE to version 7.3 Updated timezone database to version 2007.9 Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc() functions Fixed bug 43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()) Fixed bug 42785 (json_encode() formats doubles according to locale rather then following standard syntax) Fixed bug 42549 (ext/mysql failed to compile with libmysql 3.23) Over 60 bug fixes. For all the details see: http://www.php.net/ChangeLog-5.php#5.2.5
2007-09-25add test target, as suggested by Chris Ross on pkgsrc-users@n.o.jdolecek1-1/+2
2007-09-04load extensions via dlopen(), in preference to using NsLinkModule() et.al. ↵jdolecek1-2/+2
on Mac OS X, so that symbols of loaded modules are available for other, dependant modules; dlopen() is native function since 10.4, so actually apparently preferable interface now this is necessary for PDO family of modules (pdo_* depends on symbols of PDO module), and for XSL module (which depends on symbols of DOM module); doing it this way allows for PDO and DOM modules to be also shared and dynamically loaded, this avoids need to compile them into main PHP binary bump PKGREVISION, this is functionality change for Mac OS X (no change for other platforms)
2007-09-04install PHP unstripped on Darwin/Mac OS X, so that modules load properly; bumpjdolecek1-2/+7
PKGREVISION PR: 36869 by Louis Guillaume
2007-09-03Stop the path to the wrapper "sed" script from ending up in "php-config".tron1-1/+3
Bump package revision.
2007-09-02Update lang/php5 to 5.2.4 - miscellaneous security fixes and over 120 otherjdolecek1-2/+1
bug fixes
2007-08-01- Add patches to fix CVE-2007-3806 referring CVS repository.taca1-2/+2
- Fix compile problem on NetBSD with mremap(2). Bump PKGREVISION.
2007-06-11Added support for installation to DESTDIR. patch-an had removed correctheinz1-9/+17
support for this before, probably unintentionally.
2007-06-08Fix the install path for the CGI binary so it ends up where we want it.adrianp1-3/+11
Pointed out by schmonz@ and taca@ Bump PKGREVISION
2007-06-07Add in the correct patch to fix CVE-2007-2872adrianp1-1/+2
Spotted by Takahiro Kambe
2007-06-06Update to php-5.2.3adrianp1-2/+2
Security Fixes * Fixed an integer overflow inside chunk_split() (by Gerhard Wagner, CVE-2007-2872) * Fixed possible infinite loop in imagecreatefrompng. (by Xavier Roche, CVE-2007-2756) * Fixed ext/filter Email Validation Vulnerability (MOPB-45 by Stefan Esser, CVE-2007-1900) * Fixed bug #41492 (open_basedir/safe_mode bypass inside realpath()) (by bugs dot php dot net at chsc dot dk) * Improved fix for CVE-2007-1887 to work with non-bundled sqlite2 lib. * Added mysql_set_charset() to allow runtime altering of connection encoding. * Upgraded bundled SQLite 3 to version 3.3.17. (Ilia) * Fixed gd build when used with freetype 1.x (Pierre, Tony) And a fair few bugs fixed, see: http://www.php.net/ChangeLog-5.php#5.2.3 for all the details.
2007-05-06Update 5.2.2adrianp1-2/+1
* Fixed CVE-2007-1001, GD wbmp used with invalid image size (by Ivan Fratric) * Fixed asciiz byte truncation inside mail() (MOPB-33 by Stefan Esser) * Fixed a bug in mb_parse_str() that can be used to activate register_globals (MOPB-26 by Stefan Esser) * Fixed unallocated memory access/double free in in array_user_key_compare() (MOPB-24 by Stefan Esser) * Fixed a double free inside session_regenerate_id() (MOPB-22 by Stefan Esser) * Added missing open_basedir & safe_mode checks to zip:// and bzip:// wrappers. (MOPB-21 by Stefan Esser). * Limit nesting level of input variables with max_input_nesting_level as fix for (MOPB-03 by Stefan Esser) * Fixed CRLF injection inside ftp_putcmd(). (by loveshell[at]Bug.Center.Team) * Fixed a possible super-global overwrite inside import_request_variables(). (by Stefano Di Paola, Stefan Esser) * Fixed a remotely trigger-able buffer overflow inside bundled libxmlrpc library. (by Stanislav Malyshev) * Fixed a header injection via Subject and To parameters to the mail() function (MOPB-34 by Stefan Esser) * Fixed wrong length calculation in unserialize S type (MOPB-29 by Stefan Esser) * Fixed substr_compare and substr_count information leak (MOPB-14 by Stefan Esser) (Stas, Ilia) * Fixed a remotely trigger-able buffer overflow inside make_http_soap_request() (by Ilia Alshanetsky) * Fixed a buffer overflow inside user_filter_factory_create(). (by Ilia Alshanetsky)
2007-05-05Remove PEAR from the default PHP installadrianp1-2/+2
2007-04-28Patch to fix PHP bug #40326 (cannot open file from cwd if parent folder notsborrill1-2/+2
readable). Patch will be in 5.2.2, so this patch can be removed once it has been released.
2007-02-25put back openssl extension, mistakely commented out in PHP 5.2.1 upgradejdolecek1-1/+2
noted by Manuel Bouyer
2006-11-06Update lang/php5 to 5.2.0.jdolecek1-2/+1
Changes since 5.1.6: The key features of PHP 5.2.0 include: * New memory manager for the Zend Engine with improved performance and a more accurate memory usage tracking. * Input filtering extension was added and enabled by default. * JSON extension was added and enabled by default. * ZIP extension for creating and editing zip files was introduced. * Hooks for tracking file upload progress were introduced. * Introduced E_RECOVERABLE_ERROR error mode. * Introduced DateTime and DateTimeZone objects with methods to manipulate date/time information. * Upgraded bundled SQLite, PCRE libraries. * Upgraded OpenSSL, MySQL and PostgreSQL client libraries for Windows installations. * Many performance improvements. * Over 200 bug fixes. Security Enhancements and Fixes in PHP 5.2.0: * Made PostgreSQL escaping functions in PostgreSQL and PDO extension keep track of character set encoding whenever possible. * Added allow_url_include, set to Off by default to disallow use of URLs for include and require. * Disable realpath cache when open_basedir and safe_mode are being used. * Improved safe_mode enforcement for error_log() function. * Fixed a possible buffer overflow in the underlying code responsible for htmlspecialchars() and htmlentities() functions. * Added missing safe_mode and open_basedir checks for the cURL extension. * Fixed overflow is str_repeat() & wordwrap() functions on 64bit machines. * Fixed handling of long paths inside the tempnam() function. * Fixed safe_mode/open_basedir checks for session.save_path, allowing them to account for extra parameters. * Fixed ini setting overload in the ini_restore() function. For a full list of changes in PHP 5.2.0, see the ChangeLog: http://www.php.net/ChangeLog-5.php#5.2.0 Also other notable extensions changes: * filePRO extension removed (not in PECL yet, php-filepro disabled for PHP5) * JSON added (not enabled by default, packaged in php-json) * filter added (enabled by default) * wddx rewritten to native libxml2, fixing several encoding bugs
2006-11-04Fix for CVE-2006-5465 from PHP CVSadrianp1-2/+2
http://www.hardened-php.net/advisory_132006.138.html
2006-10-22Fixes for CVE-2006-4812 and CVE-2006-4625adrianp1-2/+2
Bump nb
2006-10-20remove --enable-memory-limit - 8MB is too low, and this justjdolecek1-1/+2
duplicates process resource limits, which already provide necessary "safety net" protection against rogue scripts bump PKGREVISION for this adressess PR pkg/32007 by "pancake" also remove --enable-track-vars, since that configure argument is long gone from PHP
2006-08-19Remove special DIST_SUBDIR processing from Makefile.taca1-4/+1
2006-08-19Update php5 package to 5.1.5:taca1-2/+1
17 Aug 2006, PHP 5.1.5 - Fixed memory_limit on 64bit systems. (Stefan E.) - Fixed overflow on 64bit systems in str_repeat() and wordwrap(). (Stefan E.) - Disabled CURLOPT_FOLLOWLOCATION in curl when open_basedir or safe_mode are enabled. (Stefan E., Ilia) - Fixed bug #38322 (reading past array in sscanf() leads to arbitrary code execution). (Tony) - Fixed bug #38125 (undefined reference to spl_dual_it_free_storage). (Marcus) - Fixed bug #38112 (corrupted gif segfaults) (Pierre) - Fixed bug #37587 (var without attribute causes segfault). (Marcus) - Fixed bug #37576 (FastCGI env (cgi vars) table overflow). (Piotr) - Fixed bug #37496 (FastCGI output buffer overrun). (Piotr, Dmitry) - Fixed bug #37487 (oci_fetch_array() array-type should always default to OCI_BOTH). (Tony) - Fixed bug #37416 (iterator_to_array() hides exceptions thrown in rewind() method). (Tony) - Fixed bug #37392 (Unnecessary call to OCITransRollback() at the end of request). (Tony) - Fixed bug #37341 ($_SERVER in included file is shortened to two entries, if $_ENV gets used). (Dmitry) - Fixed bug #37313 (sigemptyset() used without including <signal.h>). (jdolecek) - Fixed bug #37346 (invalid colormap format) (Pierre) - Fixed bug #37360 (invalid gif size) (Pierre) - Fixed bug #37306 (max_execution_time = max_input_time). (Dmitry) - Fixed Bug #37278 (SOAP not respecting uri in __soapCall). (Dmitry) - Fixed bug #37265 (Added missing safe_mode & open_basedir checks to imap_body()). (Ilia) - Fixed bug #37256 (php-fastcgi dosen't handle connection abort). (Dmitry)
generated by cgit v1.2.3 (git 2.39.1) at 2024-09-05 07:05:17 +0000