summaryrefslogtreecommitdiff
path: root/www/apache/Makefile
AgeCommit message (Collapse)AuthorFilesLines
2006-03-04Point MAINTAINER to pkgsrc-users@NetBSD.org in the case where nojlam1-2/+2
developer is officially maintaining the package. The rationale for changing this from "tech-pkg" to "pkgsrc-users" is that it implies that any user can try to maintain the package (by submitting patches to the mailing list). Since the folks most likely to care about the package are the folks that want to use it or are already using it, this would leverage the energy of users who aren't developers.
2006-02-21Fix config file handling; fix CHECK_PLIST build. Bump PKGREVISION.wiz1-3/+3
2006-02-05Recursive revision bump / recommended bump for gettext ABI change.joerg1-2/+2
2006-01-24Bump BUILDLINK_RECOMMENDED of textproc/expat to 2.0.0 becausewiz1-2/+2
of the shlib major bump. PKGREVISION++ for the dependencies.
2006-01-09Fix httpd linkage on DragonFly: -Wl,-E is needed, otherwise ap-phpjoerg1-2/+2
can't use ap_block_alarms. Bump revision. Problem noticed by Justin Sherrill on DragonFly's bugs list.
2006-01-05Use SUBST framework instead of manual sedding.joerg1-7/+10
2006-01-05Fix the default config and ServerRoot paths in apache and apache2 manpages,ghen1-2/+15
as suggested by PR pkg/32300, bump PKGREVISION. Ok by tron, wiz.
2005-12-29Remove USE_PKGINSTALL from pkgsrc now that mk/install/pkginstall.mkjlam1-2/+1
automatically detects whether we want the pkginstall machinery to be used by the package Makefile.
2005-12-15Add fix for security vulnerability reported in CVE-2005-3352 taken fromtron1-1/+2
Apache SVN repository. Bump package revision because of that.
2005-12-05Ran "pkglint --autofix", which corrected some of the quoting issues inrillig1-4/+4
CONFIGURE_ARGS.
2005-12-05Fixed pkglint warnings. The warnings are mostly quoting issues, forrillig1-6/+6
example MAKE_ENV+=FOO=${BAR} is changed to MAKE_ENV+=FOO=${BAR:Q}. Some other changes are outlined in http://mail-index.netbsd.org/tech-pkg/2005/12/02/0034.html
2005-10-19Update to 1.3.34. This is a security fix release, fix pkg/31868 bybouyer1-5/+4
Zafer Aydogan. Changes from 1.3.33: *) hsregex: fix potential core dumping on 64 bit machines, such as AMD64. PR 31858. [Glenn Strauss < gs-apache-dev gluelogic.com>] *) SECURITY: core: If a request contains both Transfer-Encoding and Content-Length headers, remove the Content-Length, mitigating some HTTP Request Splitting/Spoofing attacks. This has no impact on mod_proxy_http, yet affects any module which supports chunked encoding yet fails to prefer T-E: chunked over the Content-Length purported value. [Paul Querna, Joe Orton] *) Added TraceEnable [on|off|extended] per-server directive to alter the behavior of the TRACE method. This addresses a flaw in proxy conformance to RFC 2616 - previously the proxy server would accept a TRACE request body although the RFC prohibited it. The default remains 'TraceEnable on'. [William Rowe] *) mod_digest: Fix another nonce string calculation issue. [Eric Covener]
2005-10-05Remove some more *LEGACY* settings that are over a month old andwiz1-3/+1
thus were before 2005Q3.
2005-09-16Update ap-ssl to version 2.8.24.salo1-4/+4
- Fix a security issue (CAN-2005-2700) where "SSLVerifyClient require" was not enforced in per-location context if "SSLVerifyClient optional" was configured in the global virtual host configuration. Sync apache with the latest ap-ssl.
2005-08-23The real user name in PKG_USERS does not need to be escaped with doublerillig1-2/+2
backslashes anymore. A single backslash is enough. Changed the definition in all affected packages. For those that are not caught, an additional check is placed into bsd.pkginstall.mk.
2005-08-20Use REQD_DIRS instead of MAKE_DIRS for directories under ${PREFIX} sojlam1-4/+4
that these directories will be conditionally removed (based on reference counts), regardless of the value of PKG_CONFIG. Bump the PKGREVISION for packages that were modified as a result.
2005-08-19Merge CONF_FILES/SUPPORT_FILES and CONF_FILES_PERMS/SUPPORT_FILES_PERMSjlam1-3/+3
as the INSTALL and DEINSTALL scripts no longer distinguish between the two types of files. Drop SUPPORT_FILES{,_PERMS} and modify the packages in pkgsrc accordingly.
2005-05-31Remove some obsolete variables from BUILD_DEFS.wiz1-3/+1
2005-05-31Packages have no business modifying PKG_DEFAULT_OPTIONS -- it's adillo1-8/+4
user settable variable. Set PKG_SUGGESTED_OPTIONS instead. Also, make use of PKG_OPTIONS_LEGACY_VARS. Reviewed by wiz.
2005-05-17apxs needs perl.jlam1-1/+2
2005-05-06Revert:wiz1-3/+3
Remove an instance of ${TYPE} from pkgsrc. The use of the private variable _INSTALL_CMD is only temporary until we switch over to the new tools framework. The committed version has an additional | (pipe) character in it, breaking the sed and causing an empty apxs file. Replacing the pipes with commas does not help either, because then the backquoted command gets embedded into apxs instead of the correct pathname. Bump PKGREVISION because this broke at least ap-php and ap-ssl.
2005-05-03Remove an instance of ${TYPE} from pkgsrc. The use of the privatejlam1-2/+2
variable _INSTALL_CMD is only temporary until we switch over to the new tools framework.
2005-04-18Remove custom "restart" code from startup script so that Apache reallywiz1-2/+2
gets restarted when "/etc/rc.d/apache restart" is used. This fixes PR pkg/24179 for the "apache" package. Based on a similar change for the apache2 package. Bump PKGREVISION.
2005-04-11Remove USE_BUILDLINK3 and NO_BUILDLINK; these are no longer used.tv1-2/+1
2005-02-28Update apache to apache_1-3.33nb3:abs1-2/+2
Previously rc.d/apache was updated to run stop & start for restart. '/etc/rc.d/apache restart' then picked up startssl if apache was not running, but if apache was running it has a large chance of the start running before the stop completes, leaving no httpd running. Instead, add a restartssl option to apachectl, and use it.
2004-12-28The default location of the pkgsrc-installed rc.d scripts is nowreed1-2/+2
under share/examples/rc.d. The variable name already was named RCD_SCRIPTS_EXAMPLEDIR. This is from ideas from Greg Woods and others. Also bumped PKGREVISION for all packages using RCD_SCRIPTS mechanism (as requested by wiz).
2004-11-26Pass the DL_* flags to the compiler when building httpd so that dlopenjlam1-1/+3
will work correctly on NetBSD-2.x. This should fix PR pkg/29398.
2004-11-22Replace USE_GCC_SHLIB with USE_LANGUAGES=c c++ and a nice big comment whywiz1-2/+5
we add c++ to the variable.
2004-11-15Use ${VARBASE} instead of hardcoded /var.sketch1-4/+4
2004-10-29Update apache to 1.3.33abs1-2/+2
The main security vulnerabilities addressed in 1.3.33 are: * CAN-2004-0940 (cve.mitre.org) Fix potential buffer overflow with escaped characters in SSI tag string. * CAN-2004-0492 (cve.mitre.org) Reject responses from a remote server if sent an invalid (negative) Content-Length. New features * Win32: Improve error reporting after a failed attempt to spawn a piped log process or rewrite map process. * Added new compile-time flag: UCN_OFF_HONOR_PHYSICAL_PORT. It controls how UseCanonicalName Off determines the port value if the client doesn't provide one in the Host header. If defined during compilation, UseCanonicalName Off will use the physical port number to generate the canonical name. If not defined, it tries the current Port value followed by the default port for the current scheme. The following bugs were found in Apache 1.3.31 (or earlier) and have been fixed in Apache 1.3.33: * mod_rewrite: Fix query string handling for proxied URLs. PR 14518. * mod_rewrite: Fix 0 bytes write into random memory position. PR 31036. * mod_digest: Fix nonce string calculation since 1.3.31 which would force re-authentication for every connection if AuthDigestRealmSeed was not configured. PR 30920. * Fix trivial bug in mod_log_forensic that caused the child to seg fault when certain invalid requests were fired at it with forensic logging is enabled. PR 29313. * No longer breaks mod_dav, frontpage and others. Repair a patch in 1.3.31 which prevented discarding the request body for requests that will be keptalive but are not currently keptalive. PR 29237.
2004-10-25Update "apache" package to version 1.3.32. Changes since version 1.3.31:tron1-5/+4
- mod_rewrite: Fix query string handling for proxied URLs. PR 14518. [michael teitler <michael.teitler cetelem.fr>, Jan Kratochvil <rcpt-dev.AT.httpd.apache.org jankratochvil.net>] - mod_rewrite: Fix 0 bytes write into random memory position. PR 31036. [André Malo] - mod_digest: Fix nonce string calculation since 1.3.31 which would force re-authentication for every connection if AuthDigestRealmSeed was not configured. PR 30920. [Joe Orton] - Trigger an error when a LoadModule directive attempts to load a module which is built-in. This is a common error when switching from a DSO build to a static build. [Jeff Trawick, Geoffrey Young] - Fix trivial bug in mod_log_forensic that caused the child to seg fault when certain invalid requests were fired at it with forensic logging is enabled. PR 29313. [Will Slater <Will Slater orbisuk.com>] - Fix memory leak in the cache handling of mod_rewrite. PR 27862. [chunyan sheng <shengperson yahoo.com>, André Malo] - mod_rewrite no longer confuses the RewriteMap caches if different maps defined in different virtual hosts use the same map name. PR 26462. [André Malo] - mod_setenvif: Remove "support" for Remote_User variable which never worked at all. PR 25725. [André Malo] - mod_usertrack: Escape the cookie name before pasting into the regexp. [André Malo] - Win32: Improve error reporting after a failed attempt to spawn a piped log process or rewrite map process. [Jeff Trawick] - SECURITY: CAN-2004-0492 (cve.mitre.org) Reject responses from a remote server if sent an invalid (negative) Content-Length. [Mark Cox] - Fix a bunch of cases where the return code of the regex compiler was not checked properly. This affects mod_usertrack and core. PR 28218. [André Malo] - No longer breaks mod_dav, frontpage and others. Repair a patch in 1.3.31 which prevented discarding the request body for requests that will be keptalive but are not currently keptalive. PR 29237. [Jim Jagielski, Rasmus Lerdorf] - COMPATIBILITY: Added new compile-time flag: UCN_OFF_HONOR_PHYSICAL_PORT. It controls how UseCanonicalName Off determines the port value if the client doesn't provide one in the Host header. If defined during compilation, UseCanonicalName Off will use the physical port number to generate the canonical name. If not defined, it tries the current Port value followed by the default port for the current scheme. [Jim Jagielski]
2004-10-18Use "mod_ssl-2.8.20" sources for SSL hooks, bump package revision.tron1-3/+3
2004-10-03Libtool fix for PR pkg/26633, and other issues. Update libtool to 1.5.10tv1-2/+2
in the process. (More information on tech-pkg.) Bump PKGREVISION and BUILDLINK_DEPENDS of all packages using libtool and installing .la files. Bump PKGREVISION (only) of all packages depending directly on the above via a buildlink3 include.
2004-09-24Apply fix for security vulnerability in proxy module reported intron1-2/+2
CAN-2004-0492. Bump package revision package of this.
2004-08-22Change the way that legacy USE_* and FOO_USE_* options are convertedjlam1-11/+6
into the bsd.options.mk framework. Instead of appending to ${PKG_OPTIONS_VAR}, it appends to PKG_DEFAULT_OPTIONS. This causes the default options to be the union of PKG_DEFAULT_OPTIONS and any old USE_* and FOO_USE_* settings. This fixes PR pkg/26590.
2004-08-02Update apache to 1.3.31nb4:abs1-2/+2
Fix rc.d/apache restart to 'apache_doit stop; apache_doit start' Now in the case of apache_start=startssl and apache not running, 'rc.d/apache restart' will start apache with startssl.
2004-07-30Convert to use bsd.options.mk. The relevant options variable to setjlam1-3/+19
for each package can be determined by invoking: make show-var VARNAME=PKG_OPTIONS_VAR The old options are still supported unless the variable named in PKG_OPTIONS_VAR is set within make(1) (usually via /etc/mk.conf).
2004-07-17Use "mod_ssl-2.8.19" sources for SSL hooks, bump package revision.tron1-3/+3
2004-05-30Compile with version 2.8.18 of "mod_ssl" instead with the (reported totron1-5/+5
be vulnerable) version 2.8.17. Bump package revision because of this.
2004-05-13Update apache package to 1.3.31.taca1-5/+4
Apache 1.3.31 Major changes Security vulnerabilities * CAN-2003-0987 (cve.mitre.org) In mod_digest, verify whether the nonce returned in the client response is one we issued ourselves. This problem does not affect mod_auth_digest. * CAN-2003-0020 (cve.mitre.org) Escape arbitrary data before writing into the errorlog. * CAN-2004-0174 (cve.mitre.org) Fix starvation issue on listening sockets where a short-lived connection on a rarely-accessed listening socket will cause a child to hold the accept mutex and block out new connections until another connection arrives on that rarely-accessed listening socket. * CAN-2003-0993 (cve.mitre.org) Fix parsing of Allow/Deny rules using IP addresses without a netmask; issue is only known to affect big-endian 64-bit platforms New features New features that relate to specific platforms: * Linux 2.4+: If Apache is started as root and you code CoreDumpDirectory, core dumps are enabled via the prctl() syscall. New features that relate to all platforms: * Add mod_whatkilledus and mod_backtrace (experimental) for reporting diagnostic information after a child process crash. * Add fatal exception hook for running diagnostic code after a crash. * Forensic logging module added (mod_log_forensic) * '%X' is now accepted as an alias for '%c' in the LogFormat directive. This allows you to configure logging to still log the connection status even with mod_ssl Bugs fixed The following noteworthy bugs were found in Apache 1.3.29 (or earlier) and have been fixed in Apache 1.3.31: * Fix memory corruption problem with ap_custom_response() function. The core per-dir config would later point to request pool data that would be reused for different purposes on different requests. * mod_usertrack no longer inspects the Cookie2 header for the cookie name. It also no longer overwrites other cookies. * Fix bug causing core dump when using CookieTracking without specifying a CookieName directly. * UseCanonicalName off was ignoring the client provided port information.
2004-04-26Convert to use bdb.buildlink3.mk and fix sources so that we can use db4.jlam1-24/+9
2004-04-25Convert to buildlink3.snj1-5/+5
2004-04-24Relinquish maintainership of packages to tech-pkg@NetBSD.org.jlam1-2/+2
2004-04-07Fix patch checksums and bump package revision again because the securitytron1-2/+2
patches weren't applied before.
2004-04-07Add three patches to resolve security issue:reed1-1/+2
SECURITY [CAN-2003-0020]: escape arbitrary data before writing into the errorlog The three patches are from Apache cvs. http://cvs.apache.org/viewcvs.cgi/apache-1.3/src/ Also bump PKGREVISION too.
2004-02-28Forgot to commit this part. MAKE_ENV needs CHGRP="${CHGRP}".snj1-2/+2
2004-02-18Include "../../mk/compiler.mk" to get the value of CC_VERSION beforejlam1-1/+3
testing it.
2004-02-09USE_GCC[23], USE_SUNPRO, and USE_MIPSPRO are all deprecated.jlam1-2/+2
2003-11-02Updated apache to 1.3.29.grant1-5/+4
Major changes since 1.3.28: Security vulnerabilities * CAN-2003-0542 (cve.mitre.org) Fix buffer overflows in mod_alias and mod_rewrite which occurred if one configured a regular expression with more than 9 captures. Bugs fixed The following noteworthy bugs were found in Apache 1.3.28 (or earlier) and have been fixed in Apache 1.3.29: * Within ap_bclose(), ap_pclosesocket() is now called * consistently for sockets and ap_pclosef() for files. Also, closesocket() is used consistenly to close socket fd's. The previous confusion between socket and file fd's would cause problems with some applications now that we proactively close fd's to prevent leakage. * Fixed mod_usertrack to not get false positive matches on the user-tracking cookie's name. * Prevent creation of subprocess Zombies when using CGI wrappers such as suEXEC and cgiwrap.
2003-10-29Import security fix from 1.3.29 distribution for a buffer overflow incube1-2/+2
mod_rewrite and mod_alias, referenced CAN-2003-0542. Bump PKGREVISION.
generated by cgit v1.2.3 (git 2.39.1) at 2025-03-27 06:36:28 +0000