summaryrefslogtreecommitdiff
path: root/www/php4/Makefile
AgeCommit message (Collapse)AuthorFilesLines
2007-03-03Update to 4.4.6adrianp1-2/+1
* Updated PCRE to version 7.0. * Fixed segfault in ext/session when register_globals=On. * Fixed (segfault in cURL extension). * Fixed (possible cURL memory error). * Fixed (imagettftext() multithreading issue). * Fixed (ext/interbase compile failure). * Fixed (PHP fastcgi with PHP_FCGI_CHILDREN don't kill children when parent is killed). 4.4.5 # Upgraded PEAR to 1.5.0. # Updated PCRE to version 6.7. # Moved extensions to PECL: ext/ovrimos # Added a meta tag to phpinfo() output to prevent search engines from indexing the page. # Backported a fix in the configure tests to detect the "rounding fuzz". # Backported fix for ext/imap compilation failure with recent c-client versions. # Fixed missing open_basedir check inside chdir() function. # Fixed (Compile fails when using GCC 4.1.1/binutils 2.17). # Fixed (pg_insert/pg_update do not allow now() to be used for timestamp fields). # Fixed (using autoconf 2.6x and --with-layout=GNU breaks PEAR install path). # Fixed (Using $this not in object context can cause segfaults). # Fixed (ext/dba doesn't check for db-4.5 and db-4.4 when db4 support is enabled). # Fixed (ftp_put() does not change transfer mode to ASCII). # Fixed (ftp_nlist() returns false on empty dirs). # Fixed (Allow building of curl extension against libcurl 7.16.0). # Fixed (curl_exec() with return transfer returns TRUE on empty files). # Fixed (Fixed a possible open_basedir bypass in tempnam()). # Fixed (ldap_connect causes segfault with newer versions of OpenLDAP). # Fixed (parse_url() fails if passing '@' in passwd). # Fixed (Calling undefined method prints insufficient error message). # Fixed (segfault when calling setlocale() in userspace session handler). # Fixed (constructor is not called for classes used in userspace stream wrappers). # Fixed (wddx_serialize_value() generates no wellformed xml). # Fixed (aggregate_methods_by_list fails to take certain methods). # Fixed (natcasesort() causes array_pop() to misbehave). # Fixed (CURLOPT_HEADERFUNCTION, couldn't set the function in the class). # Fixed (recursive array_walk causes segfault).
2007-01-07Mechanically replaced man/* with ${PKGMANDIR}/* in the definition ofrillig1-2/+2
INSTALLATION_DIRS, as well as all occurrences of ${PREFIX}/man with ${PREFIX}/${PKGMANDIR}. Fixes PR 35265, although I did not use the patch provided therein.
2006-11-04Fix for CVE-2006-5465 from PHP CVSadrianp1-2/+2
http://www.hardened-php.net/advisory_132006.138.html
2006-10-22Fix for CVE-2006-4625adrianp1-2/+2
Bump nb
2006-10-20remove --enable-memory-limit - 8MB is too low, and this justjdolecek1-1/+2
duplicates process resource limits, which already provide necessary "safety net" protection against rogue scripts bump PKGREVISION for this adressess PR pkg/32007 by "pancake" also remove --enable-track-vars, since that configure argument is long gone from PHP
2006-08-10Update to 4.4.3adrianp1-2/+1
All PHP 4.x users are encouraged to upgrade to this release as soon as possible. The security issues resolved include the following: * Disallow certain characters in session names. * Fixed a buffer overflow inside the wordwrap() function. * Prevent jumps to parent directory via the 2nd parameter of the tempnam() function. * Improved safe_mode check for the error_log() function. * Fixed cross-site scripting inside the phpinfo() function. The release also includes about 20 bug fixes and an upgraded PCRE library (version 6.6). For a full list of changes in PHP 4.4.3, see the ChangeLog: http://www.php.net/ChangeLog-4.php#4.4.3 This also contains a fix for CVE-2006-4020 (SA21403)
2006-07-18Replace an absolute path for shadrianp1-1/+2
Ride the previous nb bump
2006-07-18Fix for CVE-2006-1990adrianp1-2/+13
Fix for CVE-2006-3011 Include our own pear.sh from the tarball but slightly hacked to get around memory isses on installation.
2006-07-07LIBTOOL_OVERRIDE generally doesn't need to be specified anymore... justjlam1-2/+1
set OVERRIDE_DIRDEPTH to find any libtool scripts deeper in the WRKSRC tree unless they're named something other than "libtool". SHLIBTOOL_OVERRIDE generally doesn't need to be specified either -- just define it to the empty list and shlibtool-override will look for libtool scripts.
2006-06-06Note in the MESSAGE file the path to the PHP CGI binary to answer an FAQ.jlam1-1/+2
2006-06-05This package needs lex to build. Add it to USE_TOOLS.minskim1-2/+2
2006-05-11Libtoolize link commands on Darwin. Previously, pakcages providingminskim1-2/+2
php-* modules failed on Darwin because gcc was used to link them. Thanks to John Klos for testing. Bump PKGREVISION.
2006-04-14PHP4/5 security changes... They're not critical issues; secunia classescube1-1/+2
them between "not critical" and "less critical". Fix CVE-2006-0996, CVE-2006-1494, CVE-2006-1608, CVE-2006-1490. See: http://secunia.com/advisories/19383/ http://secunia.com/advisories/19599/ Patches were extracted from CVS. I had to translate the one for CVE-2006-1608 on php4 because it has not made its way to the php4.4 branch (I don't know why; I can confirm it fixes the issue). While here, add PATCHDIR to the list of variables php5's Makefile.php defines. That way, ap-php gets patched too...
2006-03-03Update to version 4.4.2. Ok'd by jdolecek@.cube1-2/+1
This is a bug fix release, which addresses some security problems too. The major points that this release corrects are: * Prevent header injection by limiting each header to a single line. * Possible XSS inside error reporting functionality. * Missing safe_mode/open_basedir checks into cURL extension. * Apache 2 regression with sub-request handling on non-Linux systems. * key() and current() regression related to references. This release also fixes about 30 other defects.
2006-02-05Recursive revision bump / recommended bump for gettext ABI change.joerg1-2/+2
2005-12-29Remove USE_PKGINSTALL from pkgsrc now that mk/install/pkginstall.mkjlam1-2/+1
automatically detects whether we want the pkginstall machinery to be used by the package Makefile.
2005-12-05Fixed pkglint warnings. The warnings are mostly quoting issues, forrillig1-3/+3
example MAKE_ENV+=FOO=${BAR} is changed to MAKE_ENV+=FOO=${BAR:Q}. Some other changes are outlined in http://mail-index.netbsd.org/tech-pkg/2005/12/02/0034.html
2005-11-21Allow choosing of CGI or FastCGI as SAPI for the PHP interpreter.joerg1-1/+11
This is done via an option group, default is CGI. Note that the FastCGI interpreter can still be used for normal CGI, but there might be security issues involved in doing so.
2005-11-08php 4.4.1 has a bug which cause squirrelmail's sort function to misbehave:bouyer1-2/+2
(endless loop): http://bugs.php.net/bug.php?id=35067 Pull in a patch from the php CVS repository to fix this, as suggested a squirrelmail mailing list: http://cvs.php.net/diff.php/php-src/ext/standard/basic_functions.c?r1=1.543.2.51.2.3&r2=1.543.2.51.2.4&ty=u OK'd by Jaromir Dolecek, tested on apache-1 and apache-2 servers. Bump pkgrevision.
2005-11-02Remove obsolete file "include/php/main/config.nw.h" from package list,tron1-1/+2
bump revision.
2005-11-01Update php to 4.4.1. Besides incorporating XML_RPC-1.4.0 and fopen wrappersjdolecek1-12/+1
security fix, this fixes serious security problems regarding overwriting of the GLOBALS array. All users of PHP 4.3 and 4.4 sare encouradged to update to this version. The --with-regex=system bug with re_magic has been fixed too, so re-enabling use of --with-regex=system for all operating systems again
2005-10-08Unfortunately PHP has several openssl hooks, which are only enabledjdolecek1-2/+2
when the base PHP is compiled with openssl extension (e.g. ssl://, tls:// stream support, and couple others). These don't work when SSL support is loaded via extension. For this reason, make openssl extension unconditionally built-in into the main PHP package, and g/c security/php-openssl.
2005-10-05Add patch from Debian bug report 323585 to fix CAN-2005-3054.tron1-1/+2
2005-09-10put back XML_RPC upgrade - the fixed one is 1._4_.0, not 1.3.1jdolecek1-1/+11
2005-09-10PHP 4.4.0 already comes with XML_RPC 1.3.1, so it's not necessary to updatejdolecek1-11/+1
it separately
2005-09-04Move some options that only apply to the PHP CGI package from Makefile.phpjlam1-1/+4
(shared with ap-php) into the php package Makefile.
2005-08-18Use "${GZCAT}" instead of "{GZIP_CMD} -cd".tron1-3/+3
2005-08-17Use per distribution file site list for "XML_RPC-1.4.0.tgz".tron1-7/+7
2005-08-17Define "USE_TOOLS" to make "post-extract" target work on arbitrarytron1-1/+3
configurations. Problem pointed out by Adrian Portelli in private e-mail.
2005-08-17Update "php4" package to version 4.4.0. The update fixes a large numbertron1-1/+11
of bugs discovered since the 4.3.11 release which could e.g. lead to memory corruption. Furthermore integrate version 1.4.0 of PEAR XML_RPC which contains a fix for the "PEAR XML_RPC Remote PHP Code Injection Vulnerability" security problem reported by the Hardened-PHP Project.
2005-06-12g/c the UPGRADE_PKG code - it's no longer used, and the empty 'for'jdolecek1-10/+1
list causes problems with some (e.g. Irix) shells
2005-05-22Remove USE_GNU_TOOLS and replace with the correct USE_TOOLS definitions:jlam1-2/+2
USE_GNU_TOOLS -> USE_TOOLS awk -> gawk m4 -> gm4 make -> gmake sed -> gsed yacc -> bison
2005-04-11Remove USE_BUILDLINK3 and NO_BUILDLINK; these are no longer used.tv1-2/+1
2005-04-11Update php4 to 4.3.11.jdolecek1-2/+2
This is a maintenance release that in addition to over 70 non-critical bug fixes addresses several security issues inside the exif and fbsql extensions as well as the unserialize(), swf_definepoly() and getimagesize() functions. All Users of PHP are strongly encouraged to upgrade to this release. Bugfix release * Crash in bzopen() if supplied path to non-existent file. * DOM crashing when attribute appended to Document. * unserialize() float problem on non-English locales. * Crash in msg_send() when non-string is stored without being serialized. * Possible infinite loop in imap_mail_compose(). * Fixed crash in chunk_split(), when chunklen > strlen. * session_set_save_handler crashes PHP when supplied non-existent object ref. * Memory leak in zend_language_scanner.c. * Compile failures of zend_strtod.c. * Fixed crash in overloaded objects & overload() function. * cURL functions bypass open_basedir. PHP4 also doesn't bundle PEAR Net_Socket and Net_SMTP anymore now.
2004-12-17php4 4.3.10 already ships with Net_SMTP-1.2.6, so don't bother tryingjdolecek1-2/+2
to update
2004-12-12abort do-install if pear upgrade failsjdolecek1-2/+2
2004-11-27Upgrade bundled Net_Socket to 1.0.2 and Net_SMTP to 1.2.6 on installation.jdolecek1-1/+10
These include some important bug fixes, and some other pear packages require the newer versions. Bump PKGREVISION, and BUILDLINK_RECOMMENDED.
2004-04-24bl3ifyxtraeme1-2/+2
2004-02-14LIBTOOL_OVERRIDE and SHLIBTOOL_OVERRIDE are now lists of shell globsjlam1-2/+3
relative to ${WRKSRC}. Remove redundant LIBTOOL_OVERRIDE settings that are automatically handled by the default setting in bsd.pkg.mk.
2004-01-24replace deprecated USE_GMAKE with USE_GNU_TOOLS+=make.grant1-2/+2
2003-11-08Update PHP to 4.3.4jdolecek1-3/+1
From release announcemenet: After a lengthy QA process, PHP 4.3.4 is finally out! This is a medium size maintenance release, with a fair number of bug fixes. All users are encouraged to upgrade to 4.3.4. Bugfix release PHP 4.3.4 contains, among others, following important fixes, additions and improvements: * Fixed disk_total_space() and disk_free_space() under FreeBSD. * Fixed FastCGI support on Win32. * Fixed FastCGI being unable to bind to a specific IP. * Fixed several bugs in mail() implementation on win32. * Fixed crashes in a number of functions. * Fixed compile failure on MacOSX 10.3 Panther. * Over 60 various bug fixes! For full list of changes in PHP 4.3.4, see ChangeLog: http://www.php.net/ChangeLog-4.php#4.3.4
2003-08-31Update PHP to final 4.3.3jdolecek1-4/+9
Some highlights of changes since 4.2.3: * PCRE updated to 4.3, GD to 2.0.15 * improved Apache2 support * much improved stream & URL wrapper support, output compression support * added CLI (Command Line Interface) SAPI * debug_backtrace() backported from ZendEngine2 * faster build system * huge number of other bug fixes and improvements Packaging changes: * 'pcre', 'xml', and 'session' modules folded back into main package - 'pcre' and 'xml' is required by PEAR, and 'session' is just too essential to be separate * 'gd' module now uses bundled PHP GD library, which is better integrated * PHP modules use shared distinfo when possible to ease future PHP updates * ${PREFIX}/bin/php is now CLI version, ${PREFIX}/libexec/cgi-big/php remains CGI version
2003-06-29use LINK_ALL_LIBGCC_HACKgrant1-4/+3
remove some unneeded parens
2003-02-21Fix for wordwrap() buffer overflow, perlukem1-2/+2
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1396 (Patch obtained from RedHat's php-4.2.2-8.0.7.src.rpm.) Bump PKGREVISION.
2003-02-03Bump PKGREVISION of www/php4 to 1. This fixes a problem reported onjlam1-1/+2
tech-pkg@ where the incorrect libtoolize was being invoked. We now pass in the path to libtoolize via the environment, much like how the other GNU auto* tools are found in pkgsrc.
2003-01-28Instead of including bsd.pkg.install.mk directly in a package Makefile,jlam1-2/+2
have it be automatically included by bsd.pkg.mk if USE_PKGINSTALL is set to "YES". This enforces the requirement that bsd.pkg.install.mk be included at the end of a package Makefile. Idea suggested by Julio M. Merino Vidal <jmmv at menta.net>.
2003-01-08Make php4 and ap-php4 actually use our libtool again.jlam1-1/+2
2002-10-14Updated php to 4.2.3martti1-6/+2
* lots of bug fixes * experimental apache2 support * added IPv6 support to gethostbyaddr() ATTENTION!! register_globals defaults to 'off' now
2002-10-02Make modules use automake.mk. Bump PKGREVISION for phpize change.wiz1-2/+2
2002-09-04Apply patches from Lubomir Sedlacik <salo@Xtrmntr.org> in PR 18115 toagc1-4/+3
generalise the linker flags used to export symbols by setting them on a per-OS basis. > many packages force -Wl,-export-dynamic which is not portable outside GNU ld > and cause problems e.g. on Solaris. some of these packages use if > conditionals either only for NetBSD or except SunOS, but the state is not > coherent and it may complicate later when support for new OS is added to > pkgsrc (e.g. ongoing work on HP-UX support). > > jlam proposed the following framework in discussion on tech-pkg: > > http://mail-index.netbsd.org/tech-pkg/2002/06/21/0009.html > > now, ${EXPORT_SYMBOLS_LDFLAGS} is used instead of directly defining > -Wl,-export-dynamic which is set in appropriate defs.*.mk to reasonable > values. packages should be converted to this framework by: > > 1) replacing LDFLAGS+= -Wl,-export-dynamic and LIBS+= -export-dynamic with: > > LDFLAGS+= ${EXPORT_SYMBOLS_LDFLAGS} > > 2) for use in patchfiles, add this variable to MAKE_ENV if needed: > > MAKE_ENV+= EXPORT_SYMBOLS_LDFLAGS=${EXPORT_SYMBOLS_LDFLAGS} > > 3) replace occurances of -Wl,-export-dynamic and -export-dynamic in patch > files with: > > $(EXPORT_SYMBOLS_LDFLAGS)
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-04 04:12:26 +0000