summaryrefslogtreecommitdiff
path: root/www/php4/Makefile
AgeCommit message (Collapse)AuthorFilesLines
2010-02-10Retire PHP 4.joerg1-68/+0
2010-01-17Recursive PKGREVISION bump for jpeg update to 8.wiz1-1/+2
2008-08-17Security Enhancements and Fixes in PHP 4.4.9:adrianp1-2/+1
* Updated PCRE to version 7.7. * Fixed overflow in memnstr(). * Fixed crash in imageloadfont when an invalid font is given. * Fixed open_basedir handling issue in the curl extension. * Fixed mbstring.func_overload set in .htaccess becomes global. For a full list of changes in PHP 4.4.9, see the ChangeLog. (http://www.php.net/ChangeLog-4.php#4.4.9) This also adds ${PREFIX}/lib/php to the default include_path in php.ini which makes integration with PEAR a little simpler.
2008-01-18Per the process outlined in revbump(1), perform a recursive revbumptnn1-1/+2
on packages that are affected by the switch from the openssl 0.9.7 branch to the 0.9.8 branch. ok jlam@
2008-01-04Update to 4.4.8adrianp1-2/+1
Improved fix for MOPB-02-2007. Fixed an integer overflow inside chunk_split(). Identified by Gerhard Wagner. Fixed integer overlow in str[c]spn(). Fixed regression in glob when open_basedir is on introduced by 41655 fix. Fixed money_format() not to accept multiple %i or %n tokens. Addded "max_input_nesting_level" php.ini option to limit nesting level of input variables. Fix for MOPB-03-2007. Fixed INFILE LOCAL option handling with MySQL - now not allowed when open_basedir or safe_mode is active. Fixed session.save_path and error_log values to be checked against open_basedir and safe_mode (CVE-2007-3378). Fixed bug 43010 (Fixed regression in imagearc with two equivelent angles). Fixed bug 41765 (Recode crashes/does not work on amd64). Fixed bug 41630 (segfault when an invalid color index is present in the image data). Fixed bug 41628 (PHP settings leak between Virtual Hosts in Apache 1.3). Fixed bug 38798 (OpenSSL init corrected in php5 but not in php4).
2007-08-01Add patches to fix CVE-2007-3806 referring CVS repository.taca1-1/+2
Bump PKGREVISION.
2007-06-11The package supports installation to DESTDIR.heinz1-9/+16
2007-05-06Update to 4.4.7adrianp1-2/+1
* Fixed CVE-2007-1001, GD wbmp used with invalid image size (by Ivan Fratric) * Fixed asciiz byte truncation inside mail() (MOPB-33 by Stefan Esser) * Fixed a bug in mb_parse_str() that can be used to activate register_globals (MOPB-26 by Stefan Esser) * Fixed unallocated memory access/double free in in array_user_key_compare() (MOPB-24 by Stefan Esser) * Fixed a double free inside session_regenerate_id() (MOPB-22 by Stefan Esser) * Added missing open_basedir & safe_mode checks to zip:// and bzip:// wrappers. (MOPB-21 by Stefan Esser). * Limit nesting level of input variables with max_input_nesting_level as fix for (MOPB-03 by Stefan Esser) * Fixed CRLF injection inside ftp_putcmd(). (by loveshell[at]Bug.Center.Team) * Fixed a possible super-global overwrite inside import_request_variables(). (by Stefano Di Paola, Stefan Esser) * Fixed a remotely trigger-able buffer overflow inside bundled libxmlrpc library. (by Stanislav Malyshev) * XSS in phpinfo() (MOPB-8 by Stefan Esser)
2007-05-05Remove PEAR from the default PHP installadrianp1-15/+2
2007-03-03Update to 4.4.6adrianp1-2/+1
* Updated PCRE to version 7.0. * Fixed segfault in ext/session when register_globals=On. * Fixed (segfault in cURL extension). * Fixed (possible cURL memory error). * Fixed (imagettftext() multithreading issue). * Fixed (ext/interbase compile failure). * Fixed (PHP fastcgi with PHP_FCGI_CHILDREN don't kill children when parent is killed). 4.4.5 # Upgraded PEAR to 1.5.0. # Updated PCRE to version 6.7. # Moved extensions to PECL: ext/ovrimos # Added a meta tag to phpinfo() output to prevent search engines from indexing the page. # Backported a fix in the configure tests to detect the "rounding fuzz". # Backported fix for ext/imap compilation failure with recent c-client versions. # Fixed missing open_basedir check inside chdir() function. # Fixed (Compile fails when using GCC 4.1.1/binutils 2.17). # Fixed (pg_insert/pg_update do not allow now() to be used for timestamp fields). # Fixed (using autoconf 2.6x and --with-layout=GNU breaks PEAR install path). # Fixed (Using $this not in object context can cause segfaults). # Fixed (ext/dba doesn't check for db-4.5 and db-4.4 when db4 support is enabled). # Fixed (ftp_put() does not change transfer mode to ASCII). # Fixed (ftp_nlist() returns false on empty dirs). # Fixed (Allow building of curl extension against libcurl 7.16.0). # Fixed (curl_exec() with return transfer returns TRUE on empty files). # Fixed (Fixed a possible open_basedir bypass in tempnam()). # Fixed (ldap_connect causes segfault with newer versions of OpenLDAP). # Fixed (parse_url() fails if passing '@' in passwd). # Fixed (Calling undefined method prints insufficient error message). # Fixed (segfault when calling setlocale() in userspace session handler). # Fixed (constructor is not called for classes used in userspace stream wrappers). # Fixed (wddx_serialize_value() generates no wellformed xml). # Fixed (aggregate_methods_by_list fails to take certain methods). # Fixed (natcasesort() causes array_pop() to misbehave). # Fixed (CURLOPT_HEADERFUNCTION, couldn't set the function in the class). # Fixed (recursive array_walk causes segfault).
2007-01-07Mechanically replaced man/* with ${PKGMANDIR}/* in the definition ofrillig1-2/+2
INSTALLATION_DIRS, as well as all occurrences of ${PREFIX}/man with ${PREFIX}/${PKGMANDIR}. Fixes PR 35265, although I did not use the patch provided therein.
2006-11-04Fix for CVE-2006-5465 from PHP CVSadrianp1-2/+2
http://www.hardened-php.net/advisory_132006.138.html
2006-10-22Fix for CVE-2006-4625adrianp1-2/+2
Bump nb
2006-10-20remove --enable-memory-limit - 8MB is too low, and this justjdolecek1-1/+2
duplicates process resource limits, which already provide necessary "safety net" protection against rogue scripts bump PKGREVISION for this adressess PR pkg/32007 by "pancake" also remove --enable-track-vars, since that configure argument is long gone from PHP
2006-08-10Update to 4.4.3adrianp1-2/+1
All PHP 4.x users are encouraged to upgrade to this release as soon as possible. The security issues resolved include the following: * Disallow certain characters in session names. * Fixed a buffer overflow inside the wordwrap() function. * Prevent jumps to parent directory via the 2nd parameter of the tempnam() function. * Improved safe_mode check for the error_log() function. * Fixed cross-site scripting inside the phpinfo() function. The release also includes about 20 bug fixes and an upgraded PCRE library (version 6.6). For a full list of changes in PHP 4.4.3, see the ChangeLog: http://www.php.net/ChangeLog-4.php#4.4.3 This also contains a fix for CVE-2006-4020 (SA21403)
2006-07-18Replace an absolute path for shadrianp1-1/+2
Ride the previous nb bump
2006-07-18Fix for CVE-2006-1990adrianp1-2/+13
Fix for CVE-2006-3011 Include our own pear.sh from the tarball but slightly hacked to get around memory isses on installation.
2006-07-07LIBTOOL_OVERRIDE generally doesn't need to be specified anymore... justjlam1-2/+1
set OVERRIDE_DIRDEPTH to find any libtool scripts deeper in the WRKSRC tree unless they're named something other than "libtool". SHLIBTOOL_OVERRIDE generally doesn't need to be specified either -- just define it to the empty list and shlibtool-override will look for libtool scripts.
2006-06-06Note in the MESSAGE file the path to the PHP CGI binary to answer an FAQ.jlam1-1/+2
2006-06-05This package needs lex to build. Add it to USE_TOOLS.minskim1-2/+2
2006-05-11Libtoolize link commands on Darwin. Previously, pakcages providingminskim1-2/+2
php-* modules failed on Darwin because gcc was used to link them. Thanks to John Klos for testing. Bump PKGREVISION.
2006-04-14PHP4/5 security changes... They're not critical issues; secunia classescube1-1/+2
them between "not critical" and "less critical". Fix CVE-2006-0996, CVE-2006-1494, CVE-2006-1608, CVE-2006-1490. See: http://secunia.com/advisories/19383/ http://secunia.com/advisories/19599/ Patches were extracted from CVS. I had to translate the one for CVE-2006-1608 on php4 because it has not made its way to the php4.4 branch (I don't know why; I can confirm it fixes the issue). While here, add PATCHDIR to the list of variables php5's Makefile.php defines. That way, ap-php gets patched too...
2006-03-03Update to version 4.4.2. Ok'd by jdolecek@.cube1-2/+1
This is a bug fix release, which addresses some security problems too. The major points that this release corrects are: * Prevent header injection by limiting each header to a single line. * Possible XSS inside error reporting functionality. * Missing safe_mode/open_basedir checks into cURL extension. * Apache 2 regression with sub-request handling on non-Linux systems. * key() and current() regression related to references. This release also fixes about 30 other defects.
2006-02-05Recursive revision bump / recommended bump for gettext ABI change.joerg1-2/+2
2005-12-29Remove USE_PKGINSTALL from pkgsrc now that mk/install/pkginstall.mkjlam1-2/+1
automatically detects whether we want the pkginstall machinery to be used by the package Makefile.
2005-12-05Fixed pkglint warnings. The warnings are mostly quoting issues, forrillig1-3/+3
example MAKE_ENV+=FOO=${BAR} is changed to MAKE_ENV+=FOO=${BAR:Q}. Some other changes are outlined in http://mail-index.netbsd.org/tech-pkg/2005/12/02/0034.html
2005-11-21Allow choosing of CGI or FastCGI as SAPI for the PHP interpreter.joerg1-1/+11
This is done via an option group, default is CGI. Note that the FastCGI interpreter can still be used for normal CGI, but there might be security issues involved in doing so.
2005-11-08php 4.4.1 has a bug which cause squirrelmail's sort function to misbehave:bouyer1-2/+2
(endless loop): http://bugs.php.net/bug.php?id=35067 Pull in a patch from the php CVS repository to fix this, as suggested a squirrelmail mailing list: http://cvs.php.net/diff.php/php-src/ext/standard/basic_functions.c?r1=1.543.2.51.2.3&r2=1.543.2.51.2.4&ty=u OK'd by Jaromir Dolecek, tested on apache-1 and apache-2 servers. Bump pkgrevision.
2005-11-02Remove obsolete file "include/php/main/config.nw.h" from package list,tron1-1/+2
bump revision.
2005-11-01Update php to 4.4.1. Besides incorporating XML_RPC-1.4.0 and fopen wrappersjdolecek1-12/+1
security fix, this fixes serious security problems regarding overwriting of the GLOBALS array. All users of PHP 4.3 and 4.4 sare encouradged to update to this version. The --with-regex=system bug with re_magic has been fixed too, so re-enabling use of --with-regex=system for all operating systems again
2005-10-08Unfortunately PHP has several openssl hooks, which are only enabledjdolecek1-2/+2
when the base PHP is compiled with openssl extension (e.g. ssl://, tls:// stream support, and couple others). These don't work when SSL support is loaded via extension. For this reason, make openssl extension unconditionally built-in into the main PHP package, and g/c security/php-openssl.
2005-10-05Add patch from Debian bug report 323585 to fix CAN-2005-3054.tron1-1/+2
2005-09-10put back XML_RPC upgrade - the fixed one is 1._4_.0, not 1.3.1jdolecek1-1/+11
2005-09-10PHP 4.4.0 already comes with XML_RPC 1.3.1, so it's not necessary to updatejdolecek1-11/+1
it separately
2005-09-04Move some options that only apply to the PHP CGI package from Makefile.phpjlam1-1/+4
(shared with ap-php) into the php package Makefile.
2005-08-18Use "${GZCAT}" instead of "{GZIP_CMD} -cd".tron1-3/+3
2005-08-17Use per distribution file site list for "XML_RPC-1.4.0.tgz".tron1-7/+7
2005-08-17Define "USE_TOOLS" to make "post-extract" target work on arbitrarytron1-1/+3
configurations. Problem pointed out by Adrian Portelli in private e-mail.
2005-08-17Update "php4" package to version 4.4.0. The update fixes a large numbertron1-1/+11
of bugs discovered since the 4.3.11 release which could e.g. lead to memory corruption. Furthermore integrate version 1.4.0 of PEAR XML_RPC which contains a fix for the "PEAR XML_RPC Remote PHP Code Injection Vulnerability" security problem reported by the Hardened-PHP Project.
2005-06-12g/c the UPGRADE_PKG code - it's no longer used, and the empty 'for'jdolecek1-10/+1
list causes problems with some (e.g. Irix) shells
2005-05-22Remove USE_GNU_TOOLS and replace with the correct USE_TOOLS definitions:jlam1-2/+2
USE_GNU_TOOLS -> USE_TOOLS awk -> gawk m4 -> gm4 make -> gmake sed -> gsed yacc -> bison
2005-04-11Remove USE_BUILDLINK3 and NO_BUILDLINK; these are no longer used.tv1-2/+1
2005-04-11Update php4 to 4.3.11.jdolecek1-2/+2
This is a maintenance release that in addition to over 70 non-critical bug fixes addresses several security issues inside the exif and fbsql extensions as well as the unserialize(), swf_definepoly() and getimagesize() functions. All Users of PHP are strongly encouraged to upgrade to this release. Bugfix release * Crash in bzopen() if supplied path to non-existent file. * DOM crashing when attribute appended to Document. * unserialize() float problem on non-English locales. * Crash in msg_send() when non-string is stored without being serialized. * Possible infinite loop in imap_mail_compose(). * Fixed crash in chunk_split(), when chunklen > strlen. * session_set_save_handler crashes PHP when supplied non-existent object ref. * Memory leak in zend_language_scanner.c. * Compile failures of zend_strtod.c. * Fixed crash in overloaded objects & overload() function. * cURL functions bypass open_basedir. PHP4 also doesn't bundle PEAR Net_Socket and Net_SMTP anymore now.
2004-12-17php4 4.3.10 already ships with Net_SMTP-1.2.6, so don't bother tryingjdolecek1-2/+2
to update
2004-12-12abort do-install if pear upgrade failsjdolecek1-2/+2
2004-11-27Upgrade bundled Net_Socket to 1.0.2 and Net_SMTP to 1.2.6 on installation.jdolecek1-1/+10
These include some important bug fixes, and some other pear packages require the newer versions. Bump PKGREVISION, and BUILDLINK_RECOMMENDED.
2004-04-24bl3ifyxtraeme1-2/+2
2004-02-14LIBTOOL_OVERRIDE and SHLIBTOOL_OVERRIDE are now lists of shell globsjlam1-2/+3
relative to ${WRKSRC}. Remove redundant LIBTOOL_OVERRIDE settings that are automatically handled by the default setting in bsd.pkg.mk.
2004-01-24replace deprecated USE_GMAKE with USE_GNU_TOOLS+=make.grant1-2/+2
2003-11-08Update PHP to 4.3.4jdolecek1-3/+1
From release announcemenet: After a lengthy QA process, PHP 4.3.4 is finally out! This is a medium size maintenance release, with a fair number of bug fixes. All users are encouraged to upgrade to 4.3.4. Bugfix release PHP 4.3.4 contains, among others, following important fixes, additions and improvements: * Fixed disk_total_space() and disk_free_space() under FreeBSD. * Fixed FastCGI support on Win32. * Fixed FastCGI being unable to bind to a specific IP. * Fixed several bugs in mail() implementation on win32. * Fixed crashes in a number of functions. * Fixed compile failure on MacOSX 10.3 Panther. * Over 60 various bug fixes! For full list of changes in PHP 4.3.4, see ChangeLog: http://www.php.net/ChangeLog-4.php#4.3.4
generated by cgit v1.2.3 (git 2.39.1) at 2025-04-13 23:13:39 +0000