summaryrefslogtreecommitdiff
path: root/www/apache2
AgeCommit message (Collapse)AuthorFilesLines
2010-03-18Make sure abs_srcdir is patched for the DESTDIR case too. Bump revision.joerg1-3/+3
2010-02-17DESTDIR supportjoerg1-16/+20
2010-01-17Recursive PKGREVISION bump for jpeg update to 8.wiz2-4/+4
2009-11-27Call the real shlibtool, not some non-existing copy. Bump revision.joerg3-7/+16
2009-09-04Build fixes for openssl-1.0.wiz4-1/+43
2009-08-12Back out previous PKG_REVISION bump, hoping that it was in 40 minutes...taca1-2/+2
2009-08-12Bump PKGREVISION reflecting update of devel/apr0.taca1-2/+2
2009-06-14Convert @exec/@unexec to @pkgdir or drop it.joerg1-29/+2
2009-03-20Simply and speed up buildlink3.mk files and processing.joerg1-13/+6
This changes the buildlink3.mk files to use an include guard for the recursive include. The use of BUILDLINK_DEPTH, BUILDLINK_DEPENDS, BUILDLINK_PACKAGES and BUILDLINK_ORDER is handled by a single new variable BUILDLINK_TREE. Each buildlink3.mk file adds a pair of enter/exit marker, which can be used to reconstruct the tree and to determine first level includes. Avoiding := for large variables (BUILDLINK_ORDER) speeds up parse time as += has linear complexity. The include guard reduces system time by avoiding reading files over and over again. For complex packages this reduces both %user and %sys time to half of the former time.
2008-10-15Fix pkg/33191 (affects only SunOS 5.8 so I didn't bumpà revision).martti1-1/+2
2008-09-06Recursive PKGREVISION/ABI-depends bump for db4 4.6->4.7 update (shlibwiz2-4/+4
name change).
2008-08-09CVE-2008-2939kefren3-3/+15
bump PKGREVISION
2008-07-10Fix abs_srcdir definition as done in apache22. Also installjoerg2-3/+15
mkdir.sh as expected e.g. by www/ap2-fcgid. Bump revision.
2008-06-22As indicated by comments on pkgsrc-c, move PKGREVISION setting tohe2-3/+3
individual Makefile files and out of Makefile.common.
2008-06-20Apply the patch for CVE-2008-2364 from apache.he3-2/+74
Bump pkg revision.
2008-05-26Second round of explicit pax dependencies. As reminded by tnn@,joerg1-3/+3
many packages used to use ${PAX}. Use the common way of directly calling pax, it is created as tool after all.
2008-04-12Convert to use PLIST_VARS instead of manually passing "@comment "jlam3-14/+10
through PLIST_SUBST to the plist module.
2008-01-21Add comment that this file is used by devel/apr0/Makefile detectedtaca1-1/+3
by pkglint.
2008-01-21Update apache package to 2.0.63.taca2-6/+5
Changes with Apache 2.0.63 *) winnt_mpm: Resolve modperl issues by redirecting console mode stdout to /Device/Nul as the server is starting up, mirroring unix MPM's. PR: 43534 [Tom Donovan <Tom.Donovan acm.org>, William Rowe] *) winnt_mpm: Restore Win32DisableAcceptEx On directive and Win9x platform by recreating the bucket allocator each time the trans pool is cleared. PR: 11427 #16 (follow-on) [Tom Donovan <Tom.Donovan acm.org>] Changes with Apache 2.0.62 (not released) *) SECURITY: CVE-2007-6388 (cve.mitre.org) mod_status: Ensure refresh parameter is numeric to prevent a possible XSS attack caused by redirecting to other URLs. Reported by SecurityReason. [Mark Cox, Joe Orton] *) SECURITY: CVE-2007-5000 (cve.mitre.org) mod_imagemap: Fix a cross-site scripting issue. Reported by JPCERT. [Joe Orton] *) Introduce the ProxyFtpDirCharset directive, allowing the administrator to identify a default, or specific servers or paths which list their contents in other-than ISO-8859-1 charset (e.g. utf-8). [Ruediger Pluem] *) log.c: Ensure Win32 resurrects its lost robust logger processes. [William Rowe] *) mpm_winnt: Eliminate wait_for_many_objects. Allows the clean shutdown of the server when the MaxClients is higher then 257, in a more responsive manner [Mladen Turk, William Rowe] *) Add explicit charset to the output of various modules to work around possible cross-site scripting flaws affecting web browsers that do not derive the response character set as required by RFC2616. One of these reported by SecurityReason [Joe Orton] *) http_protocol: Escape request method in 405 error reporting. This has no security impact since the browser cannot be tricked into sending arbitrary method strings. [Jeff Trawick] *) http_protocol: Escape request method in 413 error reporting. Determined to be not generally exploitable, but a flaw in any case. PR 44014 [Victor Stinner <victor.stinner inl.fr>]
2008-01-21Start update of apr0 pacakge to 0.9.17 and apache2 package to 2.0.63.taca1-3/+3
2008-01-18Per the process outlined in revbump(1), perform a recursive revbumptnn2-4/+4
on packages that are affected by the switch from the openssl 0.9.7 branch to the 0.9.8 branch. ok jlam@
2008-01-12db4 update related revision bumpadam2-3/+4
2007-09-07Remove obsolete patch files.tron2-131/+0
2007-09-07Update "apr" package to version 0.9.16.2.0.61 and "apache2" packagetron4-14/+12
to version 2.0.61. This update is a bug and security fix release. The following security problem hasn't been fixed in "pkgsrc" before: - CVE-2007-3847: mod_proxy: Prevent reading past the end of a buffer when parsing date-related headers.
2007-09-07Convert packages that test and use USE_INET6 to use the options frameworkjlam1-2/+2
and to support the "inet6" option instead. Remaining usage of USE_INET6 was solely for the benefit of the scripts that generate the README.html files. Replace: BUILD_DEFS+= USE_INET6 with BUILD_DEFS+= IPV6_READY and teach the README-generation tools to look for that instead. This nukes USE_INET6 from pkgsrc proper. We leave a tiny bit of code to continue to support USE_INET6 for pkgsrc-wip until it has been nuked from there as well.
2007-08-28PR/36855 - Michael -- don't create duplicate Listen directivesjnemeth1-4/+2
2007-07-04Make it easier to build and install packages "unprivileged", wherejlam2-4/+6
the owner of all installed files is a non-root user. This change affects most packages that require special users or groups by making them use the specified unprivileged user and group instead. (1) Add two new variables PKG_GROUPS_VARS and PKG_USERS_VARS to unprivileged.mk. These two variables are lists of other bmake variables that define package-specific users and groups. Packages that have user-settable variables for users and groups, e.g. apache and APACHE_{USER,GROUP}, courier-mta and COURIER_{USER,GROUP}, etc., should list these variables in PKG_USERS_VARS and PKG_GROUPS_VARS so that unprivileged.mk can know to set them to ${UNPRIVILEGED_USER} and ${UNPRIVILEGED_GROUP}. (2) Modify packages to use PKG_GROUPS_VARS and PKG_USERS_VARS.
2007-06-28Fixes for security issues and PKGREVISION bump;lkundrak4-3/+136
CVE-2006-5752 XSS in mod_status with ExtendedStatus on CVE-2007-1863 remote crash when mod_cache enabled
2007-06-10Force upper bound for Apache2, as pkg_add would choose Apache 2.2joerg1-2/+2
otherwise, which breaks buildlink.
2007-06-10Reorder include of devel/apr0/b3.mk to be before the refiningjoerg1-2/+2
dependency is added, as the wildcard pattern in apr0 is necessary to pick the right version of APR.
2007-06-08PKGREVISION bump for db4 shlib name change.wiz2-4/+4
2007-02-22Whitespace cleanup, courtesy of pkglint.wiz2-8/+8
Patch provided by Sergey Svishchev in private mail.
2007-01-24devel/apr:epg2-4/+4
Update to 1.2.8 (formerly in devel/apr1), no longer build from the httpd distfile. devel/rapidsvn: devel/subversion-base: parallel/ganglia-monitor-core: security/hydra: www/apache2: Use devel/apr0. www/apache22: Use devel/apr and devel/apr-util.
2007-01-23Fix perl interpreter path for libexec/cgi-bin/printenv. Bump PKGREVISION forghen1-2/+4
apache, apache2 and apache22.
2006-12-09There's no need for CONFLICT between apache2 and apache22,xtraeme1-2/+2
cube said so.
2006-12-08This package cannot co-exist with apache22, update CONFLICTSxtraeme1-3/+3
properly. Bump PKGREVISION.
2006-11-05Fix the path to libtool on build so that it gets set correctly in theadrianp1-4/+4
installed config_vars.mk. Any package pulling in config_vars.mk will now find libtool. PKGREVISION++ ok'ed tron@
2006-08-30The directories for configuration files and log files are now set in therillig4-9/+14
config.layout file instead of CONFIGURE_ARGS, to avoid defining things twice. No actual change, since the paths are still the same. Added all necessary variables to BUILD_DEFS, as reported by pkglint.
2006-07-28Make sure that the directory "share/httpd/manual/style/lang" is createdtron2-2/+4
when installing a binary package. Problem pointed out by Lubomir Sedlacik in private e-mail. Bump package revision because of this fix.
2006-07-28Update "apr" package to version 0.9.12.2.0.59 and "apache2" packagetron4-24/+24
to version 2.0.59. Changes since *2.0.58: - SECURITY: CVE-2006-3747 (cve.mitre.org) mod_rewrite: Fix an off-by-one security problem in the ldap scheme handling. For some RewriteRules this could lead to a pointer being written out of bounds. Reported by Mark Dowd of McAfee.
2006-07-10Fixed some pkglint warnings.rillig2-33/+29
2006-07-08Change the format of BUILDLINK_ORDER to contain depth information as well,jlam1-2/+2
and add a new helper target and script, "show-buildlink3", that outputs a listing of the buildlink3.mk files included as well as the depth at which they are included. For example, "make show-buildlink3" in fonts/Xft2 displays: zlib fontconfig iconv zlib freetype2 expat freetype2 Xrender renderproto
2006-07-08Track information in a new variable BUILDLINK_ORDER that informs usjlam1-1/+2
of the order in which buildlink3.mk files are (recursively) included by a package Makefile.
2006-05-07Update "apr" package to version 0.9.12.2.0.58 and "apache" packagetron6-47/+17
to version 2.0.58. Change since Apache relase 2.0.55: - Legal: Restored original years in copyright notices. - mod_cgid: run the get_suexec_identity hook within the request-handler instead of within cgid. Apache#36410. - core: Prevent read of unitialized memory in ap_rgetline_core. Apache#39282. - mod_proxy: Report the proxy server name correctly in the "Via:" header, when UseCanonicalName is Off. Apache#11971. - mod_isapi: Various trivial code-fixes to permit mod_isapi to load and run on Unix. - HTML-escape the Expect error message. Not classed as security as an attacker has no way to influence the Expect header a victim will send to a target site. Reported by Thiago Zaninotti <thiango nstalker.com>. - SECURITY: CVE-2005-3357 (cve.mitre.org) mod_ssl: Fix a possible crash during access control checks if a non-SSL request is processed for an SSL vhost (such as the "HTTP request received on SSL port" error message when an 400 ErrorDocument is configured, or if using "SSLEngine optional"). Apache#37791. - SECURITY: CVE-2005-3352 (cve.mitre.org) mod_imap: Escape untrusted referer header before outputting in HTML to avoid potential cross-site scripting. Change also made to ap_escape_html so we escape quotes. Reported by JPCERT. - Add APR/APR-Util Compiled and Runtime Version numbers to the output of 'httpd -V'. - Ensure that the proper status line is written to the client, fixing incorrect status lines caused by filters which modify r->status without resetting r->status_line, such as the built-in byterange filter. - Default handler: Don't return output filter apr_status_t values. Apache#31759. - mod_speling: Stop crashing with certain non-file requests. - keep the Content-Length header for a HEAD with no response body. Apache#18757 - Modify apr[util] .h detection to avoid breakage on VPATH builds using Solaris make (amoung others) and avoid breakage in ./buildconf when srclib/apr[-util] are symlinks rather than directories proper. - Avoid server-driven negotiation when a CGI script has emitted an explicit "Status:" header. Apache#38070. - mod_log_config now logs all Set-Cookie headers if the %{Set-Cookie}o format is used. Apache#27787. - mod_cache: Correctly handle responses with a 301 status. Apache#37347. - mod_proxy_http: Prevent data corruption of POST request bodies when client accesses proxied resources with SSL. Apache#37145. - Elimiated the NET_TIME filter, restructuring the timeout logic. This provides a working mod_echo on all platforms, and ensures any custom protocol module is at least given an initial timeout value based on the <VirtualHost > context's Timeout directive. - mod_ssl: Correct issue where mod_ssl does not pick up the ssl-unclean-shutdown setting when configured. Apache#34452. - Document the ReceiveBufferSize change done in r157583. - mod_deflate: Merge the Vary header, instead of Setting it. Fixes applications that send the Vary Header themselves. Apache#37559. - mod_dav: Fix a null pointer dereference in an error code path during the handling of MKCOL. - mod_mime_magic: Handle CRLF-format magic files so that it works with the default installation on Windows. - Write message to error log if AuthGroupFile cannot be opened. Apache#37566. - Add ReceiveBufferSize directive to control the TCP receive buffer. - mod_cache: Fix 'Vary: *' behavior to be RFC compliant. Apache#16125. - Remove the base href tag from proxy_ftp, as it breaks relative links for clients not using an Authorization header. - http_request.c: Add missing va_end call. - Add httxt2dbm to support/ for creating RewriteMap DBM Files. - support/check_forensic: Fix temp file usage - Chunk filter: Fix chunk filter to create correct chunks in the case that a flush bucket is surrounded by data buckets. - mod_cgi(d): Remove block on OPTIONS method so that scripts can respond to OPTIONS directly rather than via server default. Apache#15242 - Added new module mod_version, which provides version dependent configuration containers. - Add core version query function (ap_get_server_revision) and accompanying ap_version_t structure (minor MMN bump).
2006-04-24Set APACHE_MODULES with ?= *before* bsd.prefs.mk, because that's the onlytv1-2/+7
way that using APACHE_MODULES+= (additive) in mk.conf can work correctly.
2006-04-23Fix ownership permissions on installed filesadrianp1-2/+37
Change behaviour of APACHE_MODULES and DFLT_APACHE_MODULES If you do not define APACHE_MODULES this change will not impact you, the default behaviour of the package modules has not been changed. The new functionality is as follows: 1) If you need to add an additional module to be installed with apache you would use: APACHE_MODULES+= spelling This would include mod_spelling as a static module in addition to the default modules installed. 2) If you need a highly customised version of apache and would like to explicitly list which modules are installed by default you would use: APACHE_MODULES= spelling access auth include env autoindex This would install _only_ the listed modules as static modules with apache. If you use APACHE_MODULES= please read the apache documentation at: http://httpd.apache.org/docs/2.0/ To determine which modules you will need to install to get the level of functionality you require. By default when using APACHE_MODULES= apache only includes with the following static modules: core.c prefork.c http_core.c mod_so.c
2006-04-23Modify packages that set PKG_USERS and PKG_GROUPS to follow the newjlam1-2/+2
syntax as specified in pkgsrc/mk/install/bsd.pkginstall.mk:1.47.
2006-04-22Removed the superfluous "quotes" and 'quotes' from variables that don'trillig1-4/+4
need them, for example RESTRICTED and SUBST_MESSAGE.*.
2006-04-12Aligned the last line of the buildlink3.mk files with the first line, sorillig1-2/+2
that they look nicer.
2006-04-06Over 1200 files touched but no revisions bumped :)reed2-5/+5
RECOMMENDED is removed. It becomes ABI_DEPENDS. BUILDLINK_RECOMMENDED.foo becomes BUILDLINK_ABI_DEPENDS.foo. BUILDLINK_DEPENDS.foo becomes BUILDLINK_API_DEPENDS.foo. BUILDLINK_DEPENDS does not change. IGNORE_RECOMMENDED (which defaulted to "no") becomes USE_ABI_DEPENDS which defaults to "yes". Added to obsolete.mk checking for IGNORE_RECOMMENDED. I did not manually go through and fix any aesthetic tab/spacing issues. I have tested the above patch on DragonFly building and packaging subversion and pkglint and their many dependencies. I have also tested USE_ABI_DEPENDS=no on my NetBSD workstation (where I have used IGNORE_RECOMMENDED for a long time). I have been an active user of IGNORE_RECOMMENDED since it was available. As suggested, I removed the documentation sentences suggesting bumping for "security" issues. As discussed on tech-pkg. I will commit to revbump, pkglint, pkg_install, createbuildlink separately. Note that if you use wip, it will fail! I will commit to pkgsrc-wip later (within day).
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-22 13:47:19 +0000