summaryrefslogtreecommitdiff
path: root/www
AgeCommit message (Collapse)AuthorFilesLines
2013-02-28Update ruby-sinatra to 1.3.5.obache2-7/+7
= 1.3.5 / 2013-02-25 * Fix for RubyGems 2.0 (Uchio KONDO) * Improve documentation (Konstantin Haase)
2013-02-28Sort.wiz1-2/+2
2013-02-27fix HOMEPAGE url.obache1-2/+2
2013-02-26Fix typo in PKGNAME.ryoon2-4/+4
2013-02-26Add php-sugercrmryoon1-1/+2
2013-02-26Import php54-sugercrm-6.5.10 as www/php-sugarcrm.ryoon6-0/+7669
SugerCRM is open source CRM (Customer Relationship Management) system.
2013-02-26Update to 1.4.0cryoon3-8/+22
Changelog: * Include missing plugins.
2013-02-26Update ruby-faraday to 0.8.6.obache3-8/+8
no summarized changes.
2013-02-25Update to 4.5.7ryoon3-11/+7
Changelog: Version 4.5.7 Feb 20th 2013 Fix for 3rd party apps dropping the database Fix SubAdmins management Fix PHP warnings Fix compatibility with some CIFS shares More robust apps management Remove not needed AWS tests Improved mime type parsing Several sharing fixes Offer the option to change the password only supported by the backend More robust auto language detection Revoke DB rights on install only if the db is newly created Fix rendering of database connection error page LDAP: update quota more often Multiple XSS vulnerabilities (oC-SA-2013-003) Multiple CSRF vulnerabilities (oC-SA-2013-004) PHP settings disclosure (oC-SA-2013-005) Multiple code executions (oC-SA-2013-006) Privilege escalation in the calendar application (oC-SA-2013-007)
2013-02-25Update to 2.4.4ryoon6-22/+103
Changelog: Fix the following security bugs. SECURITY: CVE-2012-3499 (cve.mitre.org) Various XSS flaws due to unescaped hostnames and URIs HTML output in mod_info, mod_status, mod_imagemap, mod_ldap, and mod_proxy_ftp. SECURITY: CVE-2012-4558 (cve.mitre.org) XSS in mod_proxy_balancer manager interface.
2013-02-25Update to 1.3111wen2-7/+8
Add p5-YAML as DEPENDS Upstream changes: 1.3111 [ BUG FIXES ] * GH #877: fix Dancer Error when so that 'exception' object is not passed to serializers, because XML/JSON serializers don't understand objects (rikbrown). * GH #858: Check for definedness, not truth, when testing if we read into the buffer when parsing a request body (florolf). * GH #845: Fix uninitialized warning when loading modules (Fabrice Gabolde). * GH #851, GH #853: Atomic YAML session writing (Roman Galeev). * GH #852: Saner UTF logging (Roman Galeev). * GH #849, GH #850: Serve autopages with text/html content type. (Philippe Bruhat - BooK) * GH #848: Handle If-Modified-Since header in the request for static files. (Philippe Bruhat - BooK) * GH #848: Send a Last-Modified header for static files. (Philippe Bruhat - BooK) * GH #856: Don't export non-existing subroutine (mokko). * GH #874: Reduce dependence on %ENV for internal code (Kent Fredric). * GH #875: Don't expect specific order in cookies (Yanick Champoux). * Remove 'exception' object from message being passed to serializers. (Rik Brown) * Added .travis.yml to MANIFEST.SKIP so t/manifest.t passes (Kaitlyn Parkhurst). * GH #887, GH #890: keyword 'global_warnings' added to replace 'import_warnings' (Kaitlyn Parkhurst). * GH #892: add 'private_key' to the list of potentially sensitive keys (Tom Heady). [ DOCUMENTATION ] * GH #847: Fix typo (John Wittkoski). * GH #865: Correct 'before' hook documentation (David Precious, Maurice). * GH #860, GH #844, GH #760: Misleading plack middleware documentation. (Paul Fenwick) * GH #862: Fix heading level for strict_config entry in Dancer::Config. (Stefan Hornburg - Racke) * GH #863: Correct example apache config (John Wittkoski). * GH #867: correct doc for ModuleLoader::load_with_params (mokko). * Document route_cache option (David Precious). * Docs for route_cache_size_limit & route_cache_path_limit (David Precious). * Remove meaningless 'encoding' to TT config (David Precious). * Remove docs for mounting multiple apps (Naveed Massjouni). * Update doc URLs (David Precious). * Fix inconsistency in Perlbal deployment example (Slaven Rezi., Racke). * GH #894: Replace spurious character in Dancer::Session's POD (Racke). * GH #880: Add deprecation mention for 'after' (pdl and Yanick Champoux).
2013-02-24Remove ruby-sass-rails31 which was for Ruby on Rails 3.1.taca4-198/+0
2013-02-24Remove ruby-sass-rails31.taca1-2/+1
2013-02-24Remove ruby-rack13 which was only required by www/ruby-actionpack31.taca4-188/+0
2013-02-24Remove ruby-rack13.taca1-2/+1
2013-02-24Update to 17.0.3ryoon2-258/+258
Sync with firefox-17.0.3.
2013-02-24ruby-activeresource31 package which is part of Ruby on Rails 3.1.taca4-52/+0
2013-02-24Remove ruby-activeresource31.taca1-2/+1
2013-02-24Remove ruby-actionpack31 package which is part of Ruby on Rails 3.1.taca4-228/+0
2013-02-24Remove ruby-actionpack31.taca1-2/+1
2013-02-24Update to 17.0.3ryoon1-2/+1
Changelog: FIXED Security fixes can be found here FIXED Improvements to the Click-to-Play vulnerable plugin blocklisting feature Fixed in Firefox ESR 17.0.3 MFSA 2013-28 Use-after-free, out of bounds read, and buffer overflow issues found using Address Sanitizer MFSA 2013-27 Phishing on HTTPS connection through malicious proxy MFSA 2013-26 Use-after-free in nsImageLoadingContent MFSA 2013-25 Privacy leak in JavaScript Workers MFSA 2013-24 Web content bypass of COW and SOW security wrappers MFSA 2013-21 Miscellaneous memory safety hazards (rv:19.0 / rv:17.0.3)
2013-02-24Remove ruby-rails31 package which is part of Ruby on Rails 3.1.taca4-42/+0
2013-02-24Remove ruby-rails31.taca1-2/+1
2013-02-24Remove ruby-coffee-rails31 package for Ruby on Rails 3.1.taca4-45/+0
2013-02-24Remove ruby-coffee-rails31.taca1-2/+1
2013-02-24Update ruby-httpclient to 2.3.3.obache2-6/+6
= Changes in 2.3.3 = February 24, 2013 - version 2.3.3 * Changes * #144 Add User-Agent field by default. You can remove the header by setting nil to HTTPClient#agent_name.
2013-02-24Updated DESCR with more recent figures.imil2-16/+36
2013-02-23Update to 2.16ryoon3-70/+136
Sync with seamonkey-2.16.
2013-02-23Update to 2.16ryoon10-155/+148
* enigmail is broken Changelog: SeaMonkey-specific changes Reply to List is now supported. SSL-related warning prompts (leaving or entering a secure site, viewing mixed content) have been replaced by less intrusive, non-modal notification bars. See the changes page for minor changes. Mozilla platform changes Image quality has been improved through a new HTML scaling algorithm. Canvas elements can export their content as an image blob using canvas.toBlob() now. CSS @page is now supported. CSS viewport-percentage length units have been implemented (vh, vw, vmin and vmax). CSS text-transform now supports full-width. Fixed several stability issues. Fixed in SeaMonkey 2.16 MFSA 2013-28 Use-after-free, out of bounds read, and buffer overflow issues found using Address Sanitizer MFSA 2013-27 Phishing on HTTPS connection through malicious proxy MFSA 2013-26 Use-after-free in nsImageLoadingContent MFSA 2013-25 Privacy leak in JavaScript Workers MFSA 2013-24 Web content bypass of COW and SOW security wrappers MFSA 2013-23 Wrapped WebIDL objects can be wrapped again MFSA 2013-22 Out-of-bounds read in image rendering MFSA 2013-21 Miscellaneous memory safety hazards (rv:19.0 / rv:17.0.3)
2013-02-23Changes 1.4.5:adam2-6/+6
Security-fix release. Here's a brief summary of each issue and its resolution: Issue: Host header poisoning: an attacker could cause Django to generate and display URLs that link to arbitrary domains. This could be used as part of a phishing attack. These releases fix this problem by introducing a new setting, ALLOWED_HOSTS, which specifies a whitelist of domains your site is known to respond to. Important: by default Django 1.3.6 and 1.4.4 set ALLOWED_HOSTS to allow all hosts. This means that to actually fix the security vulnerability you should define this setting yourself immediately after upgrading. Issue: Formset denial-of-service: an attacker can abuse Django's tracking of the number of forms in a formset to cause a denial-of-service attack. This has been fixed by adding a default maximum number of forms of 1,000. You can still manually specify a bigger max_num, if you wish, but 1,000 should be enough for anyone. Issue: XML attacks: Django's serialization framework was vulnerable to attacks via XML entity expansion and external references; this is now fixed. However, if you're parsing arbitrary XML in other parts of your application, we recommend you look into the defusedxml Python packages which remedy this anywhere you parse XML, not just via Django's serialization framework. Issue: Data leakage via admin history log: Django's admin interface could expose supposedly-hidden information via its history log. This has been fixed.
2013-02-23SunOS needs -fpermissive too.jperkin1-1/+3
2013-02-22Remove bogus '#if !OS(SOLARIS)' test, causes isnan() failures.jperkin2-1/+17
Fixes build on SunOS.
2013-02-22Update to 19.0ryoon3-259/+514
Sync with firefox-19.0.
2013-02-22add & enable nginx-develimil1-1/+2
2013-02-22Initial import of nginx-devel, version 1.3.13, into the NetBSD Packagesimil8-0/+184
Collection. nginx (pronounced "engine X") is a lightweight web (HTTP) server/reverse proxy and mail (IMAP/POP3) proxy written by Igor Sysoev. nginx has been running for more than three years on many heavily loaded Russian sites including Rambler (RamblerMedia.com). In March 2007 about 20% of all Russian virtual hosts were served or proxied by nginx. According to Google Online Security Blog nginx serves or proxies about 4% of all Internet virtual hosts, although Netcraft shows much less percent. The sources are licensed under a BSD-like license.
2013-02-22Replace PKGNAME to serf0 for better handling of better binary package.taca2-4/+5
2013-02-22Update serf0 to 0.7.2.taca3-9/+8
Serf 0.7.2 [2011-03-12, branch 0.7.x r1451] Actually disable Nagle when creating a connection (r1441). Return error when app asks for HTTPS over proxy connection (r1433). Serf 0.7.1 [2011-01-25, branch 0.7.x r1431] Fix memory leak when using SSL (r1408, r1416). Fix build for blank apr-util directory (r1421). Serf 0.7.0 [2010-08-25, r1407] Fix double free abort when destroying request buckets. Fix test server in unit test framework to avoid random test failures. Allow older Serf programs which don't use the new authn framework to still handle authn without forcing them to switch to the new framework. (r1401) Remove the SERF_DECLARE macros, preferring a .DEF file for Windows Barrier buckets now pass read_iovec to their wrapped bucket. Fix HTTP header parsing to allow for empty header values. Serf 0.6.1 [2010-05-14, r1370] Generally: this release fixes problems with the 0.4.0 packaging. Small compilation fix in outgoing.c for Windows builds. Serf 0.6.0 [2010-05-14, r1363] Not released. Serf 0.5.0 Not released. Serf 0.4.0 [2010-05-13, r1353] [NOTE: this release misstated itself as 0.5.0; use a later release instead] Provide authn framework, supporting Basic, Digest, Kerberos (SSPI, GSS), along with proxy authn using Basic or Digest Added experimental listener framework, along with test_server.c Improvements and fixes to SSL support, including connection setup changes Experimental support for unrequested, arriving ("async") responses Experimental BWTP support using the async arrival feature Headers are combined on read (not write), to ease certian classes of parsing Experimental feature on aggregate buckets for a callback-on-empty Fix the bucket allocator for when APR is using its pool debugging features Proxy support in the serf_get testing utility Fix to include the port number in the Host header serf_get propagates errors from the response, instead of aborting (Issue 52) Added serf_lib_version() for runtime version tests Serf 0.3.1 [2010-02-14, r1320] Fix loss of error on request->setup() callback. (Issue 47) Support APR 2.x. (Issue 48) Fixed slowdown in aggregate bucket with millions of child buckets. Avoid hang in apr_pollset_poll() by unclosed connections after fork().
2013-02-22Update serf to 1.1.1.taca4-16/+16
Full changes are a little bit many to write here, but it change its API from prior to 1.0. Please refer http://code.google.com/p/serf/source/browse/tags/1.1.1/CHANGES for full changes.
2013-02-22Preparing www/nginx-devel import by splitting up Makefile intoimil2-101/+108
Makefile + Makefile.common. nginx is highly backward compatible and 99% of stable series Makefile applies to devel. Bumping PKGREVISION
2013-02-22Add and enable serf0.taca1-1/+2
2013-02-22Add www/serf0 by copying from www/serf. It provides serf version < 1.0,taca5-0/+59
and it would be used by subversion16.
2013-02-22Update to 19.0ryoon2-7/+27
Sync with xulrunner-19.0.
2013-02-22Reset PKG_REVISION along with update of both php53 and php54.taca1-2/+1
2013-02-21Update geeklog to 1.8.2.1 (Geeklog 1.8.2sr1).taca2-6/+6
Geeklog History/Changes: Feb 19, 2013 (1.8.2sr1) ------------ This release addresses the following security issues: - High-Tech Bridge Security Research Lab reported an XSS in the calendar_type parameter in the Calendar plugin (HTB23143). - Trustwave Spiderlabs reported XSS in the install script, the Configuration, as well as in the Admin interfaces for the Polls plugin and the Topic editor (TWSL2013-001). Not security-related: - Fixed Twitter OAuth login by switching to version 1.1 of the Twitter API (feature request #0001506).
2013-02-21Update drupal7 to 7.20.taca2-6/+6
Drupal 7.20, 2013-02-20 ----------------------- - Fixed security issues (denial of service). See SA-CORE-2013-002.
2013-02-20Add apxs to buildlink3, so that packages that use apxs will build properlyfhajny3-3/+24
under restricted pbulk.
2013-02-19options.mk clean upadam1-45/+7
2013-02-19Add upstream patch 12497. Fixes diskd complaints about no filename in shmmarkd3-2/+40
buffer. Bump PKGREVISION
2013-02-19Update contao30 to 3.0.5.taca2-6/+6
Version 3.0.5 (2013-02-19) -------------------------- ### Fixed Removed the pixel unit from the video width and height attributes (see #5383). ### Fixed Correctly load the language files (see #5384).
2013-02-18Changes with nginx 1.2.7imil3-10/+11
*) Change: now if the "include" directive with mask is used on Unix systems, included files are sorted in alphabetical order. *) Change: the "add_header" directive adds headers to 201 responses. *) Feature: the "geo" directive now supports IPv6 addresses in CIDR notation. *) Feature: the "flush" and "gzip" parameters of the "access_log" directive. *) Feature: variables support in the "auth_basic" directive. *) Feature: the $pipe, $request_length, $time_iso8601, and $time_local variables can now be used not only in the "log_format" directive. Thanks to Kiril Kalchev. *) Feature: IPv6 support in the ngx_http_geoip_module. Thanks to Gregor Kali¨nik. *) Bugfix: nginx could not be built with the ngx_http_perl_module in some cases. *) Bugfix: a segmentation fault might occur in a worker process if the ngx_http_xslt_module was used. *) Bugfix: nginx could not be built on MacOSX in some cases. Thanks to Piotr Sikora. *) Bugfix: the "limit_rate" directive with high rates might result in truncated responses on 32-bit platforms. Thanks to Alexey Antropov. *) Bugfix: a segmentation fault might occur in a worker process if the "if" directive was used. Thanks to Piotr Sikora. *) Bugfix: a "100 Continue" response was issued with "413 Request Entity Too Large" responses. *) Bugfix: the "image_filter", "image_filter_jpeg_quality" and "image_filter_sharpen" directives might be inherited incorrectly. Thanks to Ian Babrou. *) Bugfix: "crypt_r() failed" errors might appear if the "auth_basic" directive was used on Linux. *) Bugfix: in backup servers handling. Thanks to Thomas Chen. *) Bugfix: proxied HEAD requests might return incorrect response if the "gzip" directive was used. *) Bugfix: a segmentation fault occurred on start or during reconfiguration if the "keepalive" directive was specified more than once in a single upstream block. *) Bugfix: in the "proxy_method" directive. *) Bugfix: a segmentation fault might occur in a worker process if resolver was used with the poll method. *) Bugfix: nginx might hog CPU during SSL handshake with a backend if the select, poll, or /dev/poll methods were used. *) Bugfix: the "[crit] SSL_write() failed (SSL:)" error. *) Bugfix: in the "fastcgi_keep_conn" directive. + updated MESSAGES in order to show a working logrotate.
generated by cgit v1.2.3 (git 2.39.1) at 2024-08-25 11:28:31 +0000