summaryrefslogtreecommitdiff
path: root/www/apache
AgeCommit message (Collapse)AuthorFilesLines
2006-07-30Update to 1.3.37:jdolecek2-11/+11
Changes with Apache 1.3.37 *) SECURITY: CVE-2006-3747 (cve.mitre.org) mod_rewrite: Fix an off-by-one security problem in the ldap scheme handling. For some RewriteRules this could lead to a pointer being written out of bounds. Reported by Mark Dowd of McAfee. [Mark Cox]
2006-07-19Update to 1.3.36:wiz3-26/+11
Changes with Apache 1.3.36 *) Reverted SVN rev #396294 due to unwanted regression. The new feature introduced in 1.3.35 (Allow usage of the "Include" configuration directive within previously "Include"d files) has been removed in the meantime. (http://svn.apache.org/viewcvs?rev=396294&view=rev) Changes with Apache 1.3.35 *) SECURITY: CVE-2005-3352 (cve.mitre.org) mod_imap: Escape untrusted referer header before outputting in HTML to avoid potential cross-site scripting. Change also made to ap_escape_html so we escape quotes. Reported by JPCERT. [Mark Cox] *) core: Allow usage of the "Include" configuration directive within previously "Include"d files. [Colm MacCarthaigh] *) HTML-escape the Expect error message. Not classed as security as an attacker has no way to influence the Expect header a victim will send to a target site. Reported by Thiago Zaninotti [Mark Cox] *) mod_cgi: Remove block on OPTIONS method so that scripts can respond to OPTIONS directly rather than via server default. [Roy Fielding] PR 15242
2006-07-08Change the format of BUILDLINK_ORDER to contain depth information as well,jlam1-2/+2
and add a new helper target and script, "show-buildlink3", that outputs a listing of the buildlink3.mk files included as well as the depth at which they are included. For example, "make show-buildlink3" in fonts/Xft2 displays: zlib fontconfig iconv zlib freetype2 expat freetype2 Xrender renderproto
2006-07-08Track information in a new variable BUILDLINK_ORDER that informs usjlam1-1/+2
of the order in which buildlink3.mk files are (recursively) included by a package Makefile.
2006-07-02Fixed some easy pkglint warnings.rillig3-25/+28
2006-06-04We don't support apache6, it went away ages ago.joerg1-2/+2
2006-04-23Modify packages that set PKG_USERS and PKG_GROUPS to follow the newjlam1-2/+2
syntax as specified in pkgsrc/mk/install/bsd.pkginstall.mk:1.47.
2006-04-06Over 1200 files touched but no revisions bumped :)reed1-3/+3
RECOMMENDED is removed. It becomes ABI_DEPENDS. BUILDLINK_RECOMMENDED.foo becomes BUILDLINK_ABI_DEPENDS.foo. BUILDLINK_DEPENDS.foo becomes BUILDLINK_API_DEPENDS.foo. BUILDLINK_DEPENDS does not change. IGNORE_RECOMMENDED (which defaulted to "no") becomes USE_ABI_DEPENDS which defaults to "yes". Added to obsolete.mk checking for IGNORE_RECOMMENDED. I did not manually go through and fix any aesthetic tab/spacing issues. I have tested the above patch on DragonFly building and packaging subversion and pkglint and their many dependencies. I have also tested USE_ABI_DEPENDS=no on my NetBSD workstation (where I have used IGNORE_RECOMMENDED for a long time). I have been an active user of IGNORE_RECOMMENDED since it was available. As suggested, I removed the documentation sentences suggesting bumping for "security" issues. As discussed on tech-pkg. I will commit to revbump, pkglint, pkg_install, createbuildlink separately. Note that if you use wip, it will fail! I will commit to pkgsrc-wip later (within day).
2006-03-04Point MAINTAINER to pkgsrc-users@NetBSD.org in the case where nojlam1-2/+2
developer is officially maintaining the package. The rationale for changing this from "tech-pkg" to "pkgsrc-users" is that it implies that any user can try to maintain the package (by submitting patches to the mailing list). Since the folks most likely to care about the package are the folks that want to use it or are already using it, this would leverage the energy of users who aren't developers.
2006-02-21Fix config file handling; fix CHECK_PLIST build. Bump PKGREVISION.wiz3-7/+30
2006-02-05Recursive revision bump / recommended bump for gettext ABI change.joerg2-4/+4
2006-01-24Bump BUILDLINK_RECOMMENDED of textproc/expat to 2.0.0 becausewiz2-3/+4
of the shlib major bump. PKGREVISION++ for the dependencies.
2006-01-09In patch-al, DragonFly has to be spelled in lower case.joerg2-4/+4
2006-01-09Fix httpd linkage on DragonFly: -Wl,-E is needed, otherwise ap-phpjoerg4-6/+36
can't use ap_block_alarms. Bump revision. Problem noticed by Justin Sherrill on DragonFly's bugs list.
2006-01-05Use SUBST framework instead of manual sedding.joerg1-7/+10
2006-01-05Fix the default config and ServerRoot paths in apache and apache2 manpages,ghen1-2/+15
as suggested by PR pkg/32300, bump PKGREVISION. Ok by tron, wiz.
2005-12-29Remove USE_PKGINSTALL from pkgsrc now that mk/install/pkginstall.mkjlam1-2/+1
automatically detects whether we want the pkginstall machinery to be used by the package Makefile.
2005-12-15Add fix for security vulnerability reported in CVE-2005-3352 taken fromtron3-2/+17
Apache SVN repository. Bump package revision because of that.
2005-12-05Ran "pkglint --autofix", which corrected some of the quoting issues inrillig2-6/+6
CONFIGURE_ARGS.
2005-12-05Fixed pkglint warnings. The warnings are mostly quoting issues, forrillig1-6/+6
example MAKE_ENV+=FOO=${BAR} is changed to MAKE_ENV+=FOO=${BAR:Q}. Some other changes are outlined in http://mail-index.netbsd.org/tech-pkg/2005/12/02/0034.html
2005-10-19Add missing entry for a new file. Pointed out by Lubomir Sedlacik.bouyer1-1/+2
Close enouth to the package update to not bump pkgrevision.
2005-10-19Update to 1.3.34. This is a security fix release, fix pkg/31868 bybouyer2-12/+11
Zafer Aydogan. Changes from 1.3.33: *) hsregex: fix potential core dumping on 64 bit machines, such as AMD64. PR 31858. [Glenn Strauss < gs-apache-dev gluelogic.com>] *) SECURITY: core: If a request contains both Transfer-Encoding and Content-Length headers, remove the Content-Length, mitigating some HTTP Request Splitting/Spoofing attacks. This has no impact on mod_proxy_http, yet affects any module which supports chunked encoding yet fails to prefer T-E: chunked over the Content-Length purported value. [Paul Querna, Joe Orton] *) Added TraceEnable [on|off|extended] per-server directive to alter the behavior of the TRACE method. This addresses a flaw in proxy conformance to RFC 2616 - previously the proxy server would accept a TRACE request body although the RFC prohibited it. The default remains 'TraceEnable on'. [William Rowe] *) mod_digest: Fix another nonce string calculation issue. [Eric Covener]
2005-10-05Remove some more *LEGACY* settings that are over a month old andwiz1-3/+1
thus were before 2005Q3.
2005-09-16Update ap-ssl to version 2.8.24.salo2-8/+8
- Fix a security issue (CAN-2005-2700) where "SSLVerifyClient require" was not enforced in per-location context if "SSLVerifyClient optional" was configured in the global virtual host configuration. Sync apache with the latest ap-ssl.
2005-08-23The real user name in PKG_USERS does not need to be escaped with doublerillig1-2/+2
backslashes anymore. A single backslash is enough. Changed the definition in all affected packages. For those that are not caught, an additional check is placed into bsd.pkginstall.mk.
2005-08-22Add DragonFly support.reed3-6/+37
(An httpd service was only briefly tested.)
2005-08-20Use REQD_DIRS instead of MAKE_DIRS for directories under ${PREFIX} sojlam1-4/+4
that these directories will be conditionally removed (based on reference counts), regardless of the value of PKG_CONFIG. Bump the PKGREVISION for packages that were modified as a result.
2005-08-19Merge CONF_FILES/SUPPORT_FILES and CONF_FILES_PERMS/SUPPORT_FILES_PERMSjlam1-3/+3
as the INSTALL and DEINSTALL scripts no longer distinguish between the two types of files. Drop SUPPORT_FILES{,_PERMS} and modify the packages in pkgsrc accordingly.
2005-07-16Get rid of USE_PERL5. The new way to express needing the Perl executablejlam1-2/+2
around at either build-time or at run-time is: USE_TOOLS+= perl # build-time USE_TOOLS+= perl:run # run-time Also remove some places where perl5/buildlink3.mk was being included by a package Makefile, but all that the package wanted was the Perl executable.
2005-05-31Remove some obsolete variables from BUILD_DEFS.wiz1-3/+1
2005-05-31Packages have no business modifying PKG_DEFAULT_OPTIONS -- it's adillo1-8/+4
user settable variable. Set PKG_SUGGESTED_OPTIONS instead. Also, make use of PKG_OPTIONS_LEGACY_VARS. Reviewed by wiz.
2005-05-17apxs needs perl.jlam1-1/+2
2005-05-06Revert:wiz1-3/+3
Remove an instance of ${TYPE} from pkgsrc. The use of the private variable _INSTALL_CMD is only temporary until we switch over to the new tools framework. The committed version has an additional | (pipe) character in it, breaking the sed and causing an empty apxs file. Replacing the pipes with commas does not help either, because then the backquoted command gets embedded into apxs instead of the correct pathname. Bump PKGREVISION because this broke at least ap-php and ap-ssl.
2005-05-03Remove an instance of ${TYPE} from pkgsrc. The use of the privatejlam1-2/+2
variable _INSTALL_CMD is only temporary until we switch over to the new tools framework.
2005-05-02RCD_SCRIPTS_EXAMPLEDIR is no longer customizable.reed1-1/+2
And always is defined as share/examples/rc.d which was the default before. This rc.d scripts are not automatically added to PLISTs now also. So add to each corresponding PLIST as required. This was discussed on tech-pkg in late January and late April. Todo: remove the RCD_SCRIPTS_EXAMPLEDIR uses in MESSAGES and elsewhere and remove the RCD_SCRIPTS_EXAMPLEDIR itself.
2005-04-18Remove custom "restart" code from startup script so that Apache reallywiz2-5/+3
gets restarted when "/etc/rc.d/apache restart" is used. This fixes PR pkg/24179 for the "apache" package. Based on a similar change for the apache2 package. Bump PKGREVISION.
2005-04-11Remove USE_BUILDLINK3 and NO_BUILDLINK; these are no longer used.tv1-2/+1
2005-03-24Don't check for USE_BUILDLINK3 anymore in these files. These are includedjlam1-4/+3
by other package Makefiles, and with the deprecation of USE_BUILDLINK3 support in the infrastructure files, these had the potential to break existing packages.
2005-02-28Update apache to apache_1-3.33nb3:abs4-8/+40
Previously rc.d/apache was updated to run stop & start for restart. '/etc/rc.d/apache restart' then picked up startssl if apache was not running, but if apache was running it has a large chance of the start running before the stop completes, leaving no httpd running. Instead, add a restartssl option to apachectl, and use it.
2005-02-24Add RMD160 checksums.wiz1-1/+4
2004-12-28The default location of the pkgsrc-installed rc.d scripts is nowreed1-2/+2
under share/examples/rc.d. The variable name already was named RCD_SCRIPTS_EXAMPLEDIR. This is from ideas from Greg Woods and others. Also bumped PKGREVISION for all packages using RCD_SCRIPTS mechanism (as requested by wiz).
2004-12-19when Apache is built with dlcompat present, the installed httpd/os.hgrant1-1/+5
header file #includes <dlfcn.h>, so we need to include dlopen.buildlink3.mk so that dlfcn.h can be found by packages which use httpd/os.h. XXX this is not entirely correct, but works around the problem XXX sufficiently. the problem is that Darwin (7.7.x) has dlopen() and XXX friends but does not provide prototypes in dlfcn.h (or anywhere else).
2004-11-26Pass the DL_* flags to the compiler when building httpd so that dlopenjlam3-9/+14
will work correctly on NetBSD-2.x. This should fix PR pkg/29398.
2004-11-22Replace USE_GCC_SHLIB with USE_LANGUAGES=c c++ and a nice big comment whywiz1-2/+5
we add c++ to the variable.
2004-11-16Regen after "patch-ai" was changed. (hi salo!)tron1-2/+2
2004-11-15Revert rev 1.9, do not expand @INSTALL@, it's done in post-patch. (hi abs!)salo1-2/+2
2004-11-15Use ${VARBASE} instead of hardcoded /var.sketch2-9/+9
2004-10-29Update apache to 1.3.33abs16-96/+65
The main security vulnerabilities addressed in 1.3.33 are: * CAN-2004-0940 (cve.mitre.org) Fix potential buffer overflow with escaped characters in SSI tag string. * CAN-2004-0492 (cve.mitre.org) Reject responses from a remote server if sent an invalid (negative) Content-Length. New features * Win32: Improve error reporting after a failed attempt to spawn a piped log process or rewrite map process. * Added new compile-time flag: UCN_OFF_HONOR_PHYSICAL_PORT. It controls how UseCanonicalName Off determines the port value if the client doesn't provide one in the Host header. If defined during compilation, UseCanonicalName Off will use the physical port number to generate the canonical name. If not defined, it tries the current Port value followed by the default port for the current scheme. The following bugs were found in Apache 1.3.31 (or earlier) and have been fixed in Apache 1.3.33: * mod_rewrite: Fix query string handling for proxied URLs. PR 14518. * mod_rewrite: Fix 0 bytes write into random memory position. PR 31036. * mod_digest: Fix nonce string calculation since 1.3.31 which would force re-authentication for every connection if AuthDigestRealmSeed was not configured. PR 30920. * Fix trivial bug in mod_log_forensic that caused the child to seg fault when certain invalid requests were fired at it with forensic logging is enabled. PR 29313. * No longer breaks mod_dav, frontpage and others. Repair a patch in 1.3.31 which prevented discarding the request body for requests that will be keptalive but are not currently keptalive. PR 29237.
2004-10-25Update "apache" package to version 1.3.32. Changes since version 1.3.31:tron4-35/+12
- mod_rewrite: Fix query string handling for proxied URLs. PR 14518. [michael teitler <michael.teitler cetelem.fr>, Jan Kratochvil <rcpt-dev.AT.httpd.apache.org jankratochvil.net>] - mod_rewrite: Fix 0 bytes write into random memory position. PR 31036. [André Malo] - mod_digest: Fix nonce string calculation since 1.3.31 which would force re-authentication for every connection if AuthDigestRealmSeed was not configured. PR 30920. [Joe Orton] - Trigger an error when a LoadModule directive attempts to load a module which is built-in. This is a common error when switching from a DSO build to a static build. [Jeff Trawick, Geoffrey Young] - Fix trivial bug in mod_log_forensic that caused the child to seg fault when certain invalid requests were fired at it with forensic logging is enabled. PR 29313. [Will Slater <Will Slater orbisuk.com>] - Fix memory leak in the cache handling of mod_rewrite. PR 27862. [chunyan sheng <shengperson yahoo.com>, André Malo] - mod_rewrite no longer confuses the RewriteMap caches if different maps defined in different virtual hosts use the same map name. PR 26462. [André Malo] - mod_setenvif: Remove "support" for Remote_User variable which never worked at all. PR 25725. [André Malo] - mod_usertrack: Escape the cookie name before pasting into the regexp. [André Malo] - Win32: Improve error reporting after a failed attempt to spawn a piped log process or rewrite map process. [Jeff Trawick] - SECURITY: CAN-2004-0492 (cve.mitre.org) Reject responses from a remote server if sent an invalid (negative) Content-Length. [Mark Cox] - Fix a bunch of cases where the return code of the regex compiler was not checked properly. This affects mod_usertrack and core. PR 28218. [André Malo] - No longer breaks mod_dav, frontpage and others. Repair a patch in 1.3.31 which prevented discarding the request body for requests that will be keptalive but are not currently keptalive. PR 29237. [Jim Jagielski, Rasmus Lerdorf] - COMPATIBILITY: Added new compile-time flag: UCN_OFF_HONOR_PHYSICAL_PORT. It controls how UseCanonicalName Off determines the port value if the client doesn't provide one in the Host header. If defined during compilation, UseCanonicalName Off will use the physical port number to generate the canonical name. If not defined, it tries the current Port value followed by the default port for the current scheme. [Jim Jagielski]
2004-10-18Use "mod_ssl-2.8.20" sources for SSL hooks, bump package revision.tron2-6/+6
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-29 15:25:51 +0000