summaryrefslogtreecommitdiff
path: root/www/apache2
AgeCommit message (Collapse)AuthorFilesLines
2013-12-12When recursively chowning, ensure the -P flag is specified. This is defaultjperkin1-4/+4
on BSD but not on strict POSIX implementations, leading to failures when building as an unprivileged user in the presence of symlinks. Fixes recent breakage on SunOS when the '-h' flag was removed for MirBSD.
2013-12-03Remove -h from the chown commands in post-install. The chown manpage (onbsiegert1-4/+4
MirBSD) says: "The -R and -h options are mutually exclusive."
2013-12-01Revbump from devel/apr updateryoon2-3/+4
2013-08-04Update apache2 to 2.0.65.obache3-16/+9
Changes with Apache 2.0.65 *) SECURITY: CVE-2013-1862 (cve.mitre.org) mod_rewrite: Ensure that client data written to the RewriteLog is escaped to prevent terminal escape sequences from entering the log file. [Eric Covener, Jeff Trawick, Joe Orton] *) SECURITY: CVE-2012-0053 (cve.mitre.org) Fix an issue in error responses that could expose "httpOnly" cookies when no custom ErrorDocument is specified for status code 400. [Eric Covener] *) SECURITY: CVE-2012-0031 (cve.mitre.org) Fix scoreboard issue which could allow an unprivileged child process to cause the parent to crash at shutdown rather than terminate cleanly. [Joe Orton] *) SECURITY: CVE-2011-3368 (cve.mitre.org) Reject requests where the request-URI does not match the HTTP specification, preventing unexpected expansion of target URLs in some reverse proxy configurations. [Joe Orton] *) SECURITY: CVE-2011-3192 (cve.mitre.org) core: Fix handling of byte-range requests to use less memory, to avoid denial of service. If the sum of all ranges in a request is larger than the original file, ignore the ranges and send the complete file. bug#51714. [Jeff Trawick, Stefan Fritsch, Jim Jagielski, Ruediger Pluem, Eric Covener, <lowprio20 gmail.com>] *) SECURITY: CVE-2011-3607 (cve.mitre.org) Fix integer overflow in ap_pregsub() which, when the mod_setenvif module is enabled, could allow local users to gain privileges via a .htaccess file. [Stefan Fritsch, Greg Ames] NOTE: it remains possible to exhaust all memory using a carefully crafted .htaccess rule, which will not be addressed in 2.0; enabling processing of .htaccess files authored by untrusted users is the root of such security risks. Upgrade to httpd 2.2.25 or later to limit this specific risk. *) core: Add MaxRanges directive to control the number of ranges permitted before returning the entire resource, with a default limit of 200. [Eric Covener, Rainer Jung] *) Set 'Accept-Ranges: none' in the case Ranges are being ignored with MaxRanges none. [Eric Covener, Rainer Jung] *) mod_rewrite: Allow merging RewriteBase down to subdirectories if new option 'RewriteOptions MergeBase' is configured. [Eric Covener] *) mod_rewrite: Fix the RewriteEngine directive to work within a location. Previously, once RewriteEngine was switched on globally, it was impossible to switch off. [Graham Leggett] *) mod_rewrite: Add "AllowAnyURI" option. bug#52774. [Joe Orton] *) htdigest: Fix buffer overflow when reading digest password file with very long lines. bug#54893. [Rainer Jung] *) mod_ssl: Add "SSLHonorCipherOrder" directive to enable the OpenSSL 0.9.7 flag which uses the server's cipher order rather than the client's. bug#28665. [Jim Schneider <jschneid netilla.com>] *) mod_include: Prevent a case of SSI timefmt-smashing with filter chains including multiple INCLUDES filters. bug#39369 [Joe Orton] *) mod_rewrite: When evaluating a proxy rule in directory context, do escape the filename by default. bug#46428 [Joe Orton] *) Improve platform detection for bundled PCRE by updating config.guess and config.sub. [Rainer Jung] *) ssl-std.conf: Disable AECDH ciphers in example config. bug#51363. [Rob Stradling <rob comodo com>] *) ssl-std.conf: Change the SSLCipherSuite default to a shorter, whitelist oriented definition. [Rainer Jung, Kaspar Brand] *) ssl-std.conf: Only select old MSIE browsers for the downgrade in http/https behavior. [Greg Stein, Stefan Fritsch]
2013-07-12Bump PKGREVISION of all packages which create users, to pick up change ofjperkin1-2/+2
sysutils/user_* packages.
2013-05-31Bump all packages for perl-5.18, thatwiz1-2/+2
a) refer 'perl' in their Makefile, or b) have a directory name of p5-*, or c) have any dependency on any p5-* package Like last time, where this caused no complaints.
2013-02-20Add apxs to buildlink3, so that packages that use apxs will build properlyfhajny1-1/+8
under restricted pbulk.
2013-02-06PKGREVISION bumps for the security/openssl 1.0.1d update.jperkin2-4/+4
2012-12-16recursive bump from cyrus-sasl libsasl2 shlib major bump.obache2-4/+4
2012-10-28Drop superfluous PKG_DESTDIR_SUPPORT, "user-destdir" is default these days.asau1-3/+1
2012-10-03Bump all packages that use perl, or depend on a p5-* package, orwiz1-2/+2
are called p5-*. I hope that's all of them.
2011-12-18Add a patch for CVE-2011-3192.obache2-2/+10
Bump PKGREVISION.
2011-09-21Remove www.NetBSD.org from MASTER_SITES, not using sitedrivenby.gif logoobache1-3/+2
2011-09-14Use chown -h to explicitly not dereference any symlinks. Fixes build on SunOS.hans1-4/+4
2010-11-01Changes 2.0.64:adam12-223/+183
* SECURITY: CVE-2010-1452 (cve.mitre.org) mod_dav: Fix Handling of requests without a path segment. * SECURITY: CVE-2009-1891 (cve.mitre.org) Fix a potential Denial-of-Service attack against mod_deflate or other modules, by forcing the server to consume CPU time in compressing a large file after a client disconnects. * SECURITY: CVE-2009-3095 (cve.mitre.org) mod_proxy_ftp: sanity check authn credentials. * SECURITY: CVE-2009-3094 (cve.mitre.org) mod_proxy_ftp: NULL pointer dereference on error paths. * SECURITY: CVE-2009-3555 (cve.mitre.org) mod_ssl: Comprehensive fix of the TLS renegotiation prefix injection attack when compiled against OpenSSL version 0.9.8m or later. Introduces the 'SSLInsecureRenegotiation' directive to reopen this vulnerability and offer unsafe legacy renegotiation with clients which do not yet support the new secure renegotiation protocol, RFC 5746. * SECURITY: CVE-2009-3555 (cve.mitre.org) mod_ssl: A partial fix for the TLS renegotiation prefix injection attack for OpenSSL versions prior to 0.9.8l; reject any client-initiated renegotiations. Forcibly disable keepalive for the connection if there is any buffered data readable. Any configuration which requires renegotiation for per-directory/location access control is still vulnerable, unless using openssl 0.9.8l or later. * SECURITY: CVE-2010-0434 (cve.mitre.org) Ensure each subrequest has a shallow copy of headers_in so that the parent request headers are not corrupted. Elimiates a problematic optimization in the case of no request body. * SECURITY: CVE-2008-2364 (cve.mitre.org) mod_proxy_http: Better handling of excessive interim responses from origin server to prevent potential denial of service and high memory usage. * SECURITY: CVE-2010-0425 (cve.mitre.org) mod_isapi: Do not unload an isapi .dll module until the request processing is completed, avoiding orphaned callback pointers. * SECURITY: CVE-2008-2939 (cve.mitre.org) mod_proxy_ftp: Prevent XSS attacks when using wildcards in the path of the FTP URL. Discovered by Marc Bevand of Rapid7. * Fix recursive ErrorDocument handling. * mod_ssl: Do not do overlapping memcpy. * Add Set-Cookie and Set-Cookie2 to the list of headers allowed to pass through on a 304 response. * apxs: Fix -A and -a options to ignore whitespace in httpd.conf
2010-03-18Make sure abs_srcdir is patched for the DESTDIR case too. Bump revision.joerg1-3/+3
2010-02-17DESTDIR supportjoerg1-16/+20
2010-01-17Recursive PKGREVISION bump for jpeg update to 8.wiz2-4/+4
2009-11-27Call the real shlibtool, not some non-existing copy. Bump revision.joerg3-7/+16
2009-09-04Build fixes for openssl-1.0.wiz4-1/+43
2009-08-12Back out previous PKG_REVISION bump, hoping that it was in 40 minutes...taca1-2/+2
2009-08-12Bump PKGREVISION reflecting update of devel/apr0.taca1-2/+2
2009-06-14Convert @exec/@unexec to @pkgdir or drop it.joerg1-29/+2
2009-03-20Simply and speed up buildlink3.mk files and processing.joerg1-13/+6
This changes the buildlink3.mk files to use an include guard for the recursive include. The use of BUILDLINK_DEPTH, BUILDLINK_DEPENDS, BUILDLINK_PACKAGES and BUILDLINK_ORDER is handled by a single new variable BUILDLINK_TREE. Each buildlink3.mk file adds a pair of enter/exit marker, which can be used to reconstruct the tree and to determine first level includes. Avoiding := for large variables (BUILDLINK_ORDER) speeds up parse time as += has linear complexity. The include guard reduces system time by avoiding reading files over and over again. For complex packages this reduces both %user and %sys time to half of the former time.
2008-10-15Fix pkg/33191 (affects only SunOS 5.8 so I didn't bumpà revision).martti1-1/+2
2008-09-06Recursive PKGREVISION/ABI-depends bump for db4 4.6->4.7 update (shlibwiz2-4/+4
name change).
2008-08-09CVE-2008-2939kefren3-3/+15
bump PKGREVISION
2008-07-10Fix abs_srcdir definition as done in apache22. Also installjoerg2-3/+15
mkdir.sh as expected e.g. by www/ap2-fcgid. Bump revision.
2008-06-22As indicated by comments on pkgsrc-c, move PKGREVISION setting tohe2-3/+3
individual Makefile files and out of Makefile.common.
2008-06-20Apply the patch for CVE-2008-2364 from apache.he3-2/+74
Bump pkg revision.
2008-05-26Second round of explicit pax dependencies. As reminded by tnn@,joerg1-3/+3
many packages used to use ${PAX}. Use the common way of directly calling pax, it is created as tool after all.
2008-04-12Convert to use PLIST_VARS instead of manually passing "@comment "jlam3-14/+10
through PLIST_SUBST to the plist module.
2008-01-21Add comment that this file is used by devel/apr0/Makefile detectedtaca1-1/+3
by pkglint.
2008-01-21Update apache package to 2.0.63.taca2-6/+5
Changes with Apache 2.0.63 *) winnt_mpm: Resolve modperl issues by redirecting console mode stdout to /Device/Nul as the server is starting up, mirroring unix MPM's. PR: 43534 [Tom Donovan <Tom.Donovan acm.org>, William Rowe] *) winnt_mpm: Restore Win32DisableAcceptEx On directive and Win9x platform by recreating the bucket allocator each time the trans pool is cleared. PR: 11427 #16 (follow-on) [Tom Donovan <Tom.Donovan acm.org>] Changes with Apache 2.0.62 (not released) *) SECURITY: CVE-2007-6388 (cve.mitre.org) mod_status: Ensure refresh parameter is numeric to prevent a possible XSS attack caused by redirecting to other URLs. Reported by SecurityReason. [Mark Cox, Joe Orton] *) SECURITY: CVE-2007-5000 (cve.mitre.org) mod_imagemap: Fix a cross-site scripting issue. Reported by JPCERT. [Joe Orton] *) Introduce the ProxyFtpDirCharset directive, allowing the administrator to identify a default, or specific servers or paths which list their contents in other-than ISO-8859-1 charset (e.g. utf-8). [Ruediger Pluem] *) log.c: Ensure Win32 resurrects its lost robust logger processes. [William Rowe] *) mpm_winnt: Eliminate wait_for_many_objects. Allows the clean shutdown of the server when the MaxClients is higher then 257, in a more responsive manner [Mladen Turk, William Rowe] *) Add explicit charset to the output of various modules to work around possible cross-site scripting flaws affecting web browsers that do not derive the response character set as required by RFC2616. One of these reported by SecurityReason [Joe Orton] *) http_protocol: Escape request method in 405 error reporting. This has no security impact since the browser cannot be tricked into sending arbitrary method strings. [Jeff Trawick] *) http_protocol: Escape request method in 413 error reporting. Determined to be not generally exploitable, but a flaw in any case. PR 44014 [Victor Stinner <victor.stinner inl.fr>]
2008-01-21Start update of apr0 pacakge to 0.9.17 and apache2 package to 2.0.63.taca1-3/+3
2008-01-18Per the process outlined in revbump(1), perform a recursive revbumptnn2-4/+4
on packages that are affected by the switch from the openssl 0.9.7 branch to the 0.9.8 branch. ok jlam@
2008-01-12db4 update related revision bumpadam2-3/+4
2007-09-07Remove obsolete patch files.tron2-131/+0
2007-09-07Update "apr" package to version 0.9.16.2.0.61 and "apache2" packagetron4-14/+12
to version 2.0.61. This update is a bug and security fix release. The following security problem hasn't been fixed in "pkgsrc" before: - CVE-2007-3847: mod_proxy: Prevent reading past the end of a buffer when parsing date-related headers.
2007-09-07Convert packages that test and use USE_INET6 to use the options frameworkjlam1-2/+2
and to support the "inet6" option instead. Remaining usage of USE_INET6 was solely for the benefit of the scripts that generate the README.html files. Replace: BUILD_DEFS+= USE_INET6 with BUILD_DEFS+= IPV6_READY and teach the README-generation tools to look for that instead. This nukes USE_INET6 from pkgsrc proper. We leave a tiny bit of code to continue to support USE_INET6 for pkgsrc-wip until it has been nuked from there as well.
2007-08-28PR/36855 - Michael -- don't create duplicate Listen directivesjnemeth1-4/+2
2007-07-04Make it easier to build and install packages "unprivileged", wherejlam2-4/+6
the owner of all installed files is a non-root user. This change affects most packages that require special users or groups by making them use the specified unprivileged user and group instead. (1) Add two new variables PKG_GROUPS_VARS and PKG_USERS_VARS to unprivileged.mk. These two variables are lists of other bmake variables that define package-specific users and groups. Packages that have user-settable variables for users and groups, e.g. apache and APACHE_{USER,GROUP}, courier-mta and COURIER_{USER,GROUP}, etc., should list these variables in PKG_USERS_VARS and PKG_GROUPS_VARS so that unprivileged.mk can know to set them to ${UNPRIVILEGED_USER} and ${UNPRIVILEGED_GROUP}. (2) Modify packages to use PKG_GROUPS_VARS and PKG_USERS_VARS.
2007-06-28Fixes for security issues and PKGREVISION bump;lkundrak4-3/+136
CVE-2006-5752 XSS in mod_status with ExtendedStatus on CVE-2007-1863 remote crash when mod_cache enabled
2007-06-10Force upper bound for Apache2, as pkg_add would choose Apache 2.2joerg1-2/+2
otherwise, which breaks buildlink.
2007-06-10Reorder include of devel/apr0/b3.mk to be before the refiningjoerg1-2/+2
dependency is added, as the wildcard pattern in apr0 is necessary to pick the right version of APR.
2007-06-08PKGREVISION bump for db4 shlib name change.wiz2-4/+4
2007-02-22Whitespace cleanup, courtesy of pkglint.wiz2-8/+8
Patch provided by Sergey Svishchev in private mail.
2007-01-24devel/apr:epg2-4/+4
Update to 1.2.8 (formerly in devel/apr1), no longer build from the httpd distfile. devel/rapidsvn: devel/subversion-base: parallel/ganglia-monitor-core: security/hydra: www/apache2: Use devel/apr0. www/apache22: Use devel/apr and devel/apr-util.
2007-01-23Fix perl interpreter path for libexec/cgi-bin/printenv. Bump PKGREVISION forghen1-2/+4
apache, apache2 and apache22.
2006-12-09There's no need for CONFLICT between apache2 and apache22,xtraeme1-2/+2
cube said so.
generated by cgit v1.2.3 (git 2.39.1) at 2025-02-15 19:23:25 +0000