summaryrefslogtreecommitdiff
path: root/www/php4
AgeCommit message (Collapse)AuthorFilesLines
2007-06-11The package supports installation to DESTDIR.heinz1-9/+16
2007-05-06Update to 4.4.7adrianp4-47/+7
* Fixed CVE-2007-1001, GD wbmp used with invalid image size (by Ivan Fratric) * Fixed asciiz byte truncation inside mail() (MOPB-33 by Stefan Esser) * Fixed a bug in mb_parse_str() that can be used to activate register_globals (MOPB-26 by Stefan Esser) * Fixed unallocated memory access/double free in in array_user_key_compare() (MOPB-24 by Stefan Esser) * Fixed a double free inside session_regenerate_id() (MOPB-22 by Stefan Esser) * Added missing open_basedir & safe_mode checks to zip:// and bzip:// wrappers. (MOPB-21 by Stefan Esser). * Limit nesting level of input variables with max_input_nesting_level as fix for (MOPB-03 by Stefan Esser) * Fixed CRLF injection inside ftp_putcmd(). (by loveshell[at]Bug.Center.Team) * Fixed a possible super-global overwrite inside import_request_variables(). (by Stefano Di Paola, Stefan Esser) * Fixed a remotely trigger-able buffer overflow inside bundled libxmlrpc library. (by Stanislav Malyshev) * XSS in phpinfo() (MOPB-8 by Stefan Esser)
2007-05-06Add security fix for CVE-2007-1001 to "php4-gd" and "php5-gd" packages.tron2-1/+40
Bump package revision.
2007-05-05Remove PEAR from the default PHP installadrianp7-271/+12
2007-03-11patch to allow the Oracle extension to be built against Oracle 10.1grant2-1/+24
libraries. no PKGREVISION bump as the module is not built by default. needed for upcoming new php-oracle package.
2007-03-03Update to 4.4.6adrianp6-62/+61
* Updated PCRE to version 7.0. * Fixed segfault in ext/session when register_globals=On. * Fixed (segfault in cURL extension). * Fixed (possible cURL memory error). * Fixed (imagettftext() multithreading issue). * Fixed (ext/interbase compile failure). * Fixed (PHP fastcgi with PHP_FCGI_CHILDREN don't kill children when parent is killed). 4.4.5 # Upgraded PEAR to 1.5.0. # Updated PCRE to version 6.7. # Moved extensions to PECL: ext/ovrimos # Added a meta tag to phpinfo() output to prevent search engines from indexing the page. # Backported a fix in the configure tests to detect the "rounding fuzz". # Backported fix for ext/imap compilation failure with recent c-client versions. # Fixed missing open_basedir check inside chdir() function. # Fixed (Compile fails when using GCC 4.1.1/binutils 2.17). # Fixed (pg_insert/pg_update do not allow now() to be used for timestamp fields). # Fixed (using autoconf 2.6x and --with-layout=GNU breaks PEAR install path). # Fixed (Using $this not in object context can cause segfaults). # Fixed (ext/dba doesn't check for db-4.5 and db-4.4 when db4 support is enabled). # Fixed (ftp_put() does not change transfer mode to ASCII). # Fixed (ftp_nlist() returns false on empty dirs). # Fixed (Allow building of curl extension against libcurl 7.16.0). # Fixed (curl_exec() with return transfer returns TRUE on empty files). # Fixed (Fixed a possible open_basedir bypass in tempnam()). # Fixed (ldap_connect causes segfault with newer versions of OpenLDAP). # Fixed (parse_url() fails if passing '@' in passwd). # Fixed (Calling undefined method prints insufficient error message). # Fixed (segfault when calling setlocale() in userspace session handler). # Fixed (constructor is not called for classes used in userspace stream wrappers). # Fixed (wddx_serialize_value() generates no wellformed xml). # Fixed (aggregate_methods_by_list fails to take certain methods). # Fixed (natcasesort() causes array_pop() to misbehave). # Fixed (CURLOPT_HEADERFUNCTION, couldn't set the function in the class). # Fixed (recursive array_walk causes segfault).
2007-01-07Mechanically replaced man/* with ${PKGMANDIR}/* in the definition ofrillig1-2/+2
INSTALLATION_DIRS, as well as all occurrences of ${PREFIX}/man with ${PREFIX}/${PKGMANDIR}. Fixes PR 35265, although I did not use the patch provided therein.
2006-11-04Fix for CVE-2006-5465 from PHP CVSadrianp3-3/+36
http://www.hardened-php.net/advisory_132006.138.html
2006-11-03Fix build for php4-curl with curl-7.16.0, using same patch as for php5.wiz2-1/+21
2006-10-22Fix for CVE-2006-4625adrianp3-3/+20
Bump nb
2006-10-20remove --enable-memory-limit - 8MB is too low, and this justjdolecek2-4/+3
duplicates process resource limits, which already provide necessary "safety net" protection against rogue scripts bump PKGREVISION for this adressess PR pkg/32007 by "pancake" also remove --enable-track-vars, since that configure argument is long gone from PHP
2006-08-20PHP 4.4.4 Release Announcementadrianp3-90/+6
This release address a series of locally exploitable security problems discovered since PHP 4.4.3. All PHP users are encouraged to upgrade to this release as soon as possible. This release provides the following security fixes: * Added missing safe_mode/open_basedir checks inside the error_log(), file_exists(), imap_open() and imap_reopen() functions. * Fixed overflows inside str_repeat() and wordwrap() functions on 64bit systems. * Fixed possible open_basedir/safe_mode bypass in cURL extension. * Fixed overflow in GD extension on invalid GIF images. * Fixed a buffer overflow inside sscanf() function. * Fixed memory_limit restriction on 64 bit system.
2006-08-16Add RCSid for better tracking.salo1-0/+2
2006-08-10Update to 4.4.3adrianp11-173/+97
All PHP 4.x users are encouraged to upgrade to this release as soon as possible. The security issues resolved include the following: * Disallow certain characters in session names. * Fixed a buffer overflow inside the wordwrap() function. * Prevent jumps to parent directory via the 2nd parameter of the tempnam() function. * Improved safe_mode check for the error_log() function. * Fixed cross-site scripting inside the phpinfo() function. The release also includes about 20 bug fixes and an upgraded PCRE library (version 6.6). For a full list of changes in PHP 4.4.3, see the ChangeLog: http://www.php.net/ChangeLog-4.php#4.4.3 This also contains a fix for CVE-2006-4020 (SA21403)
2006-07-18Replace an absolute path for shadrianp2-2/+3
Ride the previous nb bump
2006-07-18Fix for CVE-2006-1990adrianp5-3/+83
Fix for CVE-2006-3011 Include our own pear.sh from the tarball but slightly hacked to get around memory isses on installation.
2006-07-08Change the format of BUILDLINK_ORDER to contain depth information as well,jlam1-2/+2
and add a new helper target and script, "show-buildlink3", that outputs a listing of the buildlink3.mk files included as well as the depth at which they are included. For example, "make show-buildlink3" in fonts/Xft2 displays: zlib fontconfig iconv zlib freetype2 expat freetype2 Xrender renderproto
2006-07-08Track information in a new variable BUILDLINK_ORDER that informs usjlam1-1/+2
of the order in which buildlink3.mk files are (recursively) included by a package Makefile.
2006-07-07LIBTOOL_OVERRIDE generally doesn't need to be specified anymore... justjlam1-2/+1
set OVERRIDE_DIRDEPTH to find any libtool scripts deeper in the WRKSRC tree unless they're named something other than "libtool". SHLIBTOOL_OVERRIDE generally doesn't need to be specified either -- just define it to the empty list and shlibtool-override will look for libtool scripts.
2006-06-06Note in the MESSAGE file the path to the PHP CGI binary to answer an FAQ.jlam2-8/+13
2006-06-05This package needs lex to build. Add it to USE_TOOLS.minskim1-2/+2
2006-05-11Libtoolize link commands on Darwin. Previously, pakcages providingminskim3-3/+19
php-* modules failed on Darwin because gcc was used to link them. Thanks to John Klos for testing. Bump PKGREVISION.
2006-04-22add patch to actually compile the contents of PHP WDDX module; beforejdolecek2-1/+13
it produced empty *.so and the module couldn't be actually used
2006-04-14The actual patches for PHP4/5.cube3-0/+111
2006-04-14PHP4/5 security changes... They're not critical issues; secunia classescube2-2/+6
them between "not critical" and "less critical". Fix CVE-2006-0996, CVE-2006-1494, CVE-2006-1608, CVE-2006-1490. See: http://secunia.com/advisories/19383/ http://secunia.com/advisories/19599/ Patches were extracted from CVS. I had to translate the one for CVE-2006-1608 on php4 because it has not made its way to the php4.4 branch (I don't know why; I can confirm it fixes the issue). While here, add PATCHDIR to the list of variables php5's Makefile.php defines. That way, ap-php gets patched too...
2006-04-12Aligned the last line of the buildlink3.mk files with the first line, sorillig1-2/+2
that they look nicer.
2006-04-06Over 1200 files touched but no revisions bumped :)reed1-3/+3
RECOMMENDED is removed. It becomes ABI_DEPENDS. BUILDLINK_RECOMMENDED.foo becomes BUILDLINK_ABI_DEPENDS.foo. BUILDLINK_DEPENDS.foo becomes BUILDLINK_API_DEPENDS.foo. BUILDLINK_DEPENDS does not change. IGNORE_RECOMMENDED (which defaulted to "no") becomes USE_ABI_DEPENDS which defaults to "yes". Added to obsolete.mk checking for IGNORE_RECOMMENDED. I did not manually go through and fix any aesthetic tab/spacing issues. I have tested the above patch on DragonFly building and packaging subversion and pkglint and their many dependencies. I have also tested USE_ABI_DEPENDS=no on my NetBSD workstation (where I have used IGNORE_RECOMMENDED for a long time). I have been an active user of IGNORE_RECOMMENDED since it was available. As suggested, I removed the documentation sentences suggesting bumping for "security" issues. As discussed on tech-pkg. I will commit to revbump, pkglint, pkg_install, createbuildlink separately. Note that if you use wip, it will fail! I will commit to pkgsrc-wip later (within day).
2006-03-06Increase memory limit when installing PEAR packages. This allows thecube2-5/+9
installation to go through on NetBSD/sparc64 (well, at least mine). Failure reported by Joel Carnat.
2006-03-03Update to version 4.4.2. Ok'd by jdolecek@.cube9-246/+313
This is a bug fix release, which addresses some security problems too. The major points that this release corrects are: * Prevent header injection by limiting each header to a single line. * Possible XSS inside error reporting functionality. * Missing safe_mode/open_basedir checks into cURL extension. * Apache 2 regression with sub-request handling on non-Linux systems. * key() and current() regression related to references. This release also fixes about 30 other defects.
2006-02-05Recursive revision bump / recommended bump for gettext ABI change.joerg2-4/+4
2005-12-29Remove USE_PKGINSTALL from pkgsrc now that mk/install/pkginstall.mkjlam1-2/+1
automatically detects whether we want the pkginstall machinery to be used by the package Makefile.
2005-12-05Ran "pkglint --autofix", which corrected some of the quoting issues inrillig1-2/+2
CONFIGURE_ARGS.
2005-12-05Fixed pkglint warnings. The warnings are mostly quoting issues, forrillig3-7/+7
example MAKE_ENV+=FOO=${BAR} is changed to MAKE_ENV+=FOO=${BAR:Q}. Some other changes are outlined in http://mail-index.netbsd.org/tech-pkg/2005/12/02/0034.html
2005-11-21Allow choosing of CGI or FastCGI as SAPI for the PHP interpreter.joerg1-1/+11
This is done via an option group, default is CGI. Note that the FastCGI interpreter can still be used for normal CGI, but there might be security issues involved in doing so.
2005-11-11PKGBASE is defined too late to be used in PKG_OPTIONS_VAR.rillig1-2/+4
2005-11-08php 4.4.1 has a bug which cause squirrelmail's sort function to misbehave:bouyer3-3/+19
(endless loop): http://bugs.php.net/bug.php?id=35067 Pull in a patch from the php CVS repository to fix this, as suggested a squirrelmail mailing list: http://cvs.php.net/diff.php/php-src/ext/standard/basic_functions.c?r1=1.543.2.51.2.3&r2=1.543.2.51.2.4&ty=u OK'd by Jaromir Dolecek, tested on apache-1 and apache-2 servers. Bump pkgrevision.
2005-11-05Replaced ${PKGNAME:C...} with the equivalent ${PKGBASE}.rillig1-2/+2
2005-11-04Use --with-openssl=${BUILDLINK_PREFIX.openssl} to specify real pathtv1-2/+2
so that configure won't try to run the (possibly not installed) pkg-config.
2005-11-02Remove obsolete file "include/php/main/config.nw.h" from package list,tron2-3/+3
bump revision.
2005-11-02Remove "XML_RPC-1.4.0.tgz". It is part of PHP 4.4.1 and therefore notron1-5/+1
longer downloaded manually.
2005-11-01Update php to 4.4.1. Besides incorporating XML_RPC-1.4.0 and fopen wrappersjdolecek5-40/+8
security fix, this fixes serious security problems regarding overwriting of the GLOBALS array. All users of PHP 4.3 and 4.4 sare encouradged to update to this version. The --with-regex=system bug with re_magic has been fixed too, so re-enabling use of --with-regex=system for all operating systems again
2005-10-23php regex is also necessary on Linux; pointed out by Ondrej Tumajdolecek1-2/+2
in private e-mail
2005-10-19Bring back the "ssl" option so that the builder may have the *option* totv1-5/+10
turn it off. It's still on by default (in PKG_SUGGESTED_OPTIONS), so no PKGREVISION bump required.
2005-10-16Fix bug in mbstring extension function mb_encode_mimeheader(), whichjdolecek2-1/+15
misinterpreted some Japanese characters as ASCII. PR: 31223 by Takahiro Kambe
2005-10-16use PHP-provided regex on Solaris, PHP doesn't build with system regexjdolecek1-1/+9
there PR: 31047 by Gilles Dauphin
2005-10-08make it possible to switch the IPv6 support on/off via a package option,jdolecek1-2/+11
similarily how this is done in lang/php5/Makefile.php; default depends in USE_INET6 setting, i.e. enabled iff OS supports it
2005-10-08openssl is included unconditionallyjdolecek1-8/+4
2005-10-08fix pluraljdolecek1-2/+2
2005-10-08Unfortunately PHP has several openssl hooks, which are only enabledjdolecek3-4/+8
when the base PHP is compiled with openssl extension (e.g. ssl://, tls:// stream support, and couple others). These don't work when SSL support is loaded via extension. For this reason, make openssl extension unconditionally built-in into the main PHP package, and g/c security/php-openssl.
2005-10-07Add a fix to LDAP extension build to properly detect LDAP capabilities,jdolecek2-1/+14
such as TLS support. Patch provided by Stoned Elipot in private e-mail.
generated by cgit v1.2.3 (git 2.39.1) at 2024-08-16 10:34:08 +0000