summaryrefslogtreecommitdiff
path: root/www
AgeCommit message (Collapse)AuthorFilesLines
2016-06-01Adjust for Flask 0.11, which removed the (herein unused) flask.Module.kleink3-2/+19
Bump PKGREVISION.
2016-06-01Update py-flask to 0.11.kleink5-154/+51
Version 0.11 ------------ Released on May 29th 2016, codename Absinthe. - Added support to serializing top-level arrays to :func:`flask.jsonify`. This introduces a security risk in ancient browsers. See :ref:`json-security` for details. - Added before_render_template signal. - Added `**kwargs` to :meth:`flask.Test.test_client` to support passing additional keyword arguments to the constructor of :attr:`flask.Flask.test_client_class`. - Added ``SESSION_REFRESH_EACH_REQUEST`` config key that controls the set-cookie behavior. If set to ``True`` a permanent session will be refreshed each request and get their lifetime extended, if set to ``False`` it will only be modified if the session actually modifies. Non permanent sessions are not affected by this and will always expire if the browser window closes. - Made Flask support custom JSON mimetypes for incoming data. - Added support for returning tuples in the form ``(response, headers)`` from a view function. - Added :meth:`flask.Config.from_json`. - Added :attr:`flask.Flask.config_class`. - Added :meth:`flask.config.Config.get_namespace`. - Templates are no longer automatically reloaded outside of debug mode. This can be configured with the new ``TEMPLATES_AUTO_RELOAD`` config key. - Added a workaround for a limitation in Python 3.3's namespace loader. - Added support for explicit root paths when using Python 3.3's namespace packages. - Added :command:`flask` and the ``flask.cli`` module to start the local debug server through the click CLI system. This is recommended over the old ``flask.run()`` method as it works faster and more reliable due to a different design and also replaces ``Flask-Script``. - Error handlers that match specific classes are now checked first, thereby allowing catching exceptions that are subclasses of HTTP exceptions (in ``werkzeug.exceptions``). This makes it possible for an extension author to create exceptions that will by default result in the HTTP error of their choosing, but may be caught with a custom error handler if desired. - Added :meth:`flask.Config.from_mapping`. - Flask will now log by default even if debug is disabled. The log format is now hardcoded but the default log handling can be disabled through the ``LOGGER_HANDLER_POLICY`` configuration key. - Removed deprecated module functionality. - Added the ``EXPLAIN_TEMPLATE_LOADING`` config flag which when enabled will instruct Flask to explain how it locates templates. This should help users debug when the wrong templates are loaded. - Enforce blueprint handling in the order they were registered for template loading. - Ported test suite to py.test. - Deprecated ``request.json`` in favour of ``request.get_json()``. - Add "pretty" and "compressed" separators definitions in jsonify() method. Reduces JSON response size when JSONIFY_PRETTYPRINT_REGULAR=False by removing unnecessary white space included by default after separators. - JSON responses are now terminated with a newline character, because it is a convention that UNIX text files end with a newline and some clients don't deal well when this newline is missing. See https://github.com/pallets/flask/pull/1262 -- this came up originally as a part of https://github.com/kennethreitz/httpbin/issues/168 - The automatically provided ``OPTIONS`` method is now correctly disabled if the user registered an overriding rule with the lowercase-version ``options`` (issue ``#1288``). - ``flask.json.jsonify`` now supports the ``datetime.date`` type (pull request ``#1326``). - Don't leak exception info of already catched exceptions to context teardown handlers (pull request ``#1393``). - Allow custom Jinja environment subclasses (pull request ``#1422``). - ``flask.g`` now has ``pop()`` and ``setdefault`` methods. - Turn on autoescape for ``flask.templating.render_template_string`` by default (pull request ``#1515``). - ``flask.ext`` is now deprecated (pull request ``#1484``). - ``send_from_directory`` now raises BadRequest if the filename is invalid on the server OS (pull request ``#1763``). - Added the ``JSONIFY_MIMETYPE`` configuration variable (pull request ``#1728``). - Exceptions during teardown handling will no longer leave bad application contexts lingering around.
2016-06-01Update py-werkzeug (and py-werkzeug-docs) to 0.11.10.kleink2-7/+7
Version 0.11.10 --------------- Released on May 24th 2016. - Fixed a bug that occurs when running on Python 2.6 and using a broken locale. See pull request #912. - Fixed a crash when running the debugger on Google App Engine. See issue #925. - Fixed an issue with multipart parsing that could cause memory exhaustion. Version 0.11.9 -------------- Released on April 24th 2016. - Corrected an issue that caused the debugger not to use the machine GUID on POSIX systems. - Corrected an Unicode error on Python 3 for the debugger's PIN usage. - Corrected the timestamp verification in the pin debug code. Without this fix the pin was remebered until too long. Version 0.11.8 -------------- Released on April 15th 2016. - fixed a problem with the machine GUID detection code on OS X on Python 3.
2016-06-01Fix MASTER_SITES.wiz2-4/+4
2016-06-01Update to 0.200000wen2-9/+10
Update DEPENDS Upstream changes: 0.200000 2016-05-31 15:05:46+02:00 Europe/Amsterdam [ BUG FIXES ] * GH #1174: Update plugin tests to stop deprecation warnings (Peter Mottram) * GH #1173: Reword error when serialization / deserialization fails to be more generic (Russell @veryrusty Jenkins) [ ENHANCEMENTS ] * Introduce an improved variation of the Dancer2::Plugin::SendAs into core. You can now override the serializer (or lack thereof) at any point in time for a response by calling `send_as`. You can also send the options of `send_file` (like the Content-Type) and the charset for the app is also respected. (Russell @veryrusty Jenkins) 0.166001_04 2016-05-27 14:54:53+02:00 Europe/Amsterdam (TRIAL RELEASE) [ BUG FIXES ] * GH #1171: Ensure request query parameter parsing is independent of Plack version (Russell Jenkins) 0.166001_03 2016-05-27 13:23:52+02:00 Europe/Amsterdam (TRIAL RELEASE) [ BUG FIXES ] * GH #1165, #1167: Copy is_behind_proxy attribute into new request on forward. (Russell Jenkins) [ ENHANCEMENTS ] * GH #1120: Move from MooX::Types::MooseLike to Type::Tiny for performance. (Peter Mottram) * GH #1145, #1164: Replace Class::Load with Module::Runtime (Sawyer X) * GH #1159, #1163: Make template keyword global. (Sawyer X, Russell Jenkins) [ DOCUMENTATION ] * GH #1158: List both static and shared modules in Apache's deploy instructions. (Varadinsky) 0.166001_02 2016-04-29 16:42:54+02:00 Europe/Amsterdam (TRIAL RELEASE) [ BUG FIXES ] * GH #1160: Engines receive correct log callback on build (Peter Mottram) * GH #1148: Ensure request body parameter parsing is independent of Plack version (Russell Jenkins) 0.166001_01 2016-04-19 21:50:35+02:00 Europe/Amsterdam (TRIAL RELEASE) [ BUG FIXES ] * GH #1102: Handle multiple '..' in file path utilities. (Oleg A. Mamontov, Peter Mottram) * GH #1114: Fix missing prereqs as reported by CPANTS. (Mohammad S Anwar) * GH #1128: Shh warning if optional megasplat is not present. (David Precious) * GH #1139: Fix incorrect Content-Length header added by AutoPage handler (Michael Kr枚ll, Russell Jenkins) * GH #1144: Change tt tags to span in skel (Jason Lewis) * GH #1046: "no_server_tokens" configuration option doesn't work. (Sawyer X) # GH #1155, #1157: Fix megasplat value splitting when there are empty trailing path segments. (Tatsuhiko Miyagawa, Russell Jenkins) NOTE: Paths matching a megasplat that end with a '/' will now include an empty string as the last value. For the route pattern '/foo/**', the path '/foo/bar', the megasplat gives ['bar'], whereas '/foo/bar/' now gives ['bar','']. Joining the array of megasplat values will now always be the string matched against for the megasplit. [ DOCUMENTATION ] * GH #1119: Improve the deployment documentation. (Andrew Beverley) * GH #1123: Document import of utf8 pragma. (Victor Adam) * GH #1132: Fix spelling mistakes in POD (Gregor Herrmann) * GH #1134: Fix spelling errors detected by codespell (James McCoy) * GH #1153: Fix POD rendering error. (Sawyer X) [ ENHANCEMENTS ] * GH #1129: engine.logger.* hooks are called around logging a message. (Russell @veryrusty Jenkins) * GH #1146: Cleaner display of error context (Vernon Lyon) * GH #1085: Add consistent keywords for accessing headers; 'request_header' for request, 'response_header', 'response_headers' and 'push_response_header' for response. (Russell @veryrusty Jenkins) * GH #1010: New Dancer2::Plugin architecture, includes support for plugins using other plugins. (Yanick Champoux, Russell Jenkins, Sawyer X, Damien Krotkine, Stefan @racke Hornburg, Peter Mottram) Note: Considerable effort has gone into working with the authors of existing plugins to ensure their plugins are compatible with both the 'old' and the new reworked plugin architecture. Please upgrade your plugins to a recent release. (Special thanks to Peter @SysPete Mottram)
2016-05-31Avoid CVE-2016-4450 (NULL dereference while saving client body tojoerg5-4/+40
temporary file). Bump revision.
2016-05-31Allow gmake 4.2 again (now that the problem is fixed in 4.2nb1)wiz2-6/+2
2016-05-31add tool dependency pattern of gmake less than 4.2 due to mozilla bug 1275547tnn2-2/+6
2016-05-30Update www/webkit-gtk to 2.12.3leot5-43/+28
Changes: ================== WebKitGTK+ 2.12.3 ================== What's new in WebKitGTK+ 2.12.3? - Improved the detection of supported MIME types supported by the media player. - Fix web process crash when playing adaptive streaming media. - Change the volume while thumb slider is dragged, not only when released. - Fix leaked thread in network process. - Fix several crashes and rendering issues. - Translation updates: Hungarian. - Security fixes: CVE-2016-1857, CVE-2016-1856. ================== WebKitGTK+ 2.12.2 ================== What's new in WebKitGTK+ 2.12.2? - Fix rendering of scrollbars with GTK themes using stepper buttons. - Fix compatibility issue with 2.12.1 regarding local storage access from file URLs. - Make menu list buttons use the text color from the theme. - Do not show resize grip in non-resizable text fields. - Fix accessibility events causing Orca to echo key presses instead of speaking the inserted characters in password fields. - Fix an off by one error in hyphenation. - Fix several crashes and rendering issues. - Fix the build with libjpeg v9. - Translation updates: Bulgarian, Finnish, Greek, Italian, Turkish. ================== WebKitGTK+ 2.12.1 ================== What's new in WebKitGTK+ 2.12.1? - Fix spotify player. - Improve themed control elements rendering to better match GTK+ widgets. - Make remote web inspector work again. - Fix several crashes and rendering issues. - Fix several memory leaks. - Fix the build in Linux / PowerPC. - Fix detection of S390X and PPC64 architectures. - Fix the build in glibc-based BSD systems - Translation updates: Brazilian Portuguese. ================== WebKitGTK+ 2.12.0 ================== What's new in WebKitGTK+ 2.12.0? - Enable GSS-Negotiate support when available in libsoup. - Fix overlay scrollbar indicator position. - Fix smooth scrolling behavior that was not fixed in all cases in 2.11.92. - Fix the build with newer versions of GCC and clang. ================== WebKitGTK+ 2.11.92 ================== What's new in WebKitGTK+ 2.11.92? - Revert the patch to limit the number of tiles according to the visible area introduced in 2.11.90, because it caused rendering issues in several popular websites. - Fix scrollbars rendering again with GTK+ >= 3.19.11. - Fix rendering of slider input elements. - Fix rendering artifacts when using a web view background color. - Make webkit_web_context_clear_cache() work again. - Fix smooth scrolling behavior that was changed by mistake. - Don't force ENABLE_INTROSPECTION=OFF on Mac. - Install WebProcess and NetworkProcess on OSX when not building the Mac port. ================== WebKitGTK+ 2.11.91 ================== What's new in WebKitGTK+ 2.11.91? - Do not show stale contents after session restore. - Fix flickering and rendering artifacts when entering accelerated compositing mode before the web view is realized. - Fix several rendering issues and crashes. - Fix build with FTL enabled in FreeBSD. - Translation updates: Polish. ================== WebKitGTK+ 2.11.90 ================== What's new in WebKitGTK+ 2.11.90? - Switch to use overlay scrollbars like all other GTK+ widgets and ensure the behavior is consistent with GTK+ too. - Limit the number of tiles according to the visible area. This was causing a huge memory consumption with some websites. - Fix toggle buttons rendering with GTK+ 3.19. - Fix HTTP authentication dialog rendering when accelerated compositing mode is enabled. - Use G_TYPE_ERROR instead of G_TYPE_POINTER for GError parameters of signals. - Fix several memory leaks. ================= WebKitGTK+ 2.11.5 ================= What's new in WebKitGTK+ 2.11.5? - Switch FTL to use B3 backend instead of LLVM. - Add support for windowless NPAPI plugins with no UI in non X11 platforms. - Fix a deadlock in the Web Process when JavaScript garbage collector was running for a web worker thread that made google maps to hang. - Fix a Web Process crash when quickly attempting many DnD operations. - Fix scrollbars rendering with older versions of GTK+. - Fix a crash when creating a WebKitWebView without providing a WebKitWebContext. ================= WebKitGTK+ 2.11.4 ================= What's new in WebKitGTK+ 2.11.4? - Prefer to link to LLVM shared libraries when building with FTL enabled. - Fix runtime errors when serializing/deserializing session state. - Fix critical warnings when loading a URL after a session restore. - Fix the build with GTK+ < 3.14. - Fix the build with video support disabled. ================= WebKitGTK+ 2.11.3 ================= What's new in WebKitGTK+ 2.11.3? - NetworkProcess is now used unconditionally. The shared secondary process model is now the same as using the multiple process model and setting a process limit of 1. - Disable DNS prefetch when a proxy is configured. - Reduce the maximum simultaneous network connections to match other browsers. - Extend notifications API to notify WebKit when a notification is clicked by the user. - Add new API to save and restore a WebView session. - Add Web Extensions API to be notified about console messages. - Add WebKitURIRequest API to get the HTTP method. - Add API to handle beforeunload events. - Make WebKitWebView always propagate motion-notify-event signal. - Add a way to force accelerating compositing mode at runtime using an environment variable. - Fix input elements and scrollbars rendering with GTK+ 3.19. - Fix a crash in the UI process when the WebView is destroyed while the screensaver DBus proxy is being created. - Fix a WebProcess crash when loading large contents with custom URI schemes API. - Fix UI process crashes related to not having a main resource response when the load is committed for pages restored from the history cache. - Translation updates: French, German, Turkish ================= WebKitGTK+ 2.11.2 ================= What's new in WebKitGTK+ 2.11.2? - Enable FTL by default in JavaScriptCore for x86_64. - Improved media backend performance by better handling glib main loop sources. - Fix rendering of lines when using solid colors. - Fix web process crashes due to BadDrawable X errors in accelerated compositing mode. - Translation updates: Italian. ================= WebKitGTK+ 2.11.1 ================= What's new in WebKitGTK+ 2.11.1? - Improved general performance by better handling glib main loop sources. - Add autocleanups support to GObjects exposed in public API. - Fixed dashed and dotted border painting. - Upload the accelerated canvas as a texture by copying via GPU directly. - Popup menus no longer use a nested main loop.
2016-05-30dist: include curl_multi_socket_all.3prlw11-1/+2
2016-05-30Update curl to 7.49.1.jklos2-7/+7
Bugfixes: Windows: prevent DLL hijacking, CVE-2016-4802 dist: include manpage-scan.pl, nroff-scan.pl and CHECKSRC.md schannel: fix compile break with MSVC XP toolset curlbuild.h.dist: check __LP64__ as well to fix MIPS build dist: include curl_multi_socket_all.3 http2: use HTTP/2 in the HTTP/1.1-alike response openssl: ERR_remove_thread_state() is deprecated in latest 1.1.0 CURLOPT_CONNECT_TO.3: user must not free the list prematurely libcurl.m4: Avoid obsolete warning winbuild/Makefile.vc: Fix check on SSL, MBEDTLS, WINSSL exclusivity curl_multibyte: fix compiler error openssl: cleanup must free compression methods (memory leak) mbedtls: fix includes so snprintf() works checksrc.pl: Added variants of strcat() & strncat() to banned function list contributors.sh: better grep pattern and show GitHub username ssh: fix build for libssh2 before 1.2.6 curl_share_setopt.3: Add min ver needed for ssl session lock
2016-05-29Updated curl to 7.49.0.wiz4-28/+10
Fixed in 7.49.0 - May 18 2016 Changes: schannel: Add ALPN support SSH: support CURLINFO_FILETIME SSH: new CURLOPT_QUOTE command "statvfs" wolfssl: Add ALPN support http2: added --http2-prior-knowledge http2: added CURL_HTTP_VERSION_2_PRIOR_KNOWLEDGE libcurl: added CURLOPT_CONNECT_TO curl: added --connect-to libcurl: added CURLOPT_TCP_FASTOPEN curl: added --tcp-fastopen curl: remove support for --ftpport, -http-request and --socks Bugfixes: CVE-2016-3739: TLS certificate check bypass with mbedTLS/PolarSSL checksrc.bat: Updated the help to be consistent with generate.bat checksrc.bat: Added support for scanning the tests and examples openssl: fix ERR_remove_thread_state() for boringssl/libressl openssl: boringssl provides the same numbering as openssl multi: fix "Operation timed out after" timer url: don't use bad offset in tld_check_name to show error sshserver.pl: use quotes for given options Makefile.am: skip the scripts dir curl: warn for --capath use if not supported by libcurl http2: fix connection reuse GSS: make Curl_gss_log_error more verbose build-wolfssl: Allow a broader range of ciphers (Visual Studio) wolfssl: Use ECC supported curves extension openssl: Fix compilation warnings Curl_add_buffer_send: avoid possible NULL dereference SOCKS5_gssapi_negotiate: don't assume little-endian ints strerror: don't bit shift a signed integer url: Corrected get protocol family for FTP and LDAP curl/mprintf.h: remove support for _MPRINTF_REPLACE upload: missing rewind call could make libcurl hang IMAP: check pointer before dereferencing it build: Changed the Visual Studio projects warning level from 3 to 4 checksrc: now stricter, wider checks, code cleaned up checksrc: added docs/CHECKSRC.md curl_sasl: Fixed potential null pointer utilisation krb5: Fixed missing client response when mutual authentication enabled krb5: Only process challenge when present krb5: Only generate a SPN when its not known formdata: use appropriate fopen() macros curl.1: -w filename_effective was introduced in 7.26.0 http2: make use of the nghttp2 error callback http2: fix connection reuse when PING comes after last DATA curl.1: change example for -F HTTP2: Add a space character after the status code curl.1: use example.com more mbedtls.c: changed private prefix to mbed_ mbedtls: implement and provide *_data_pending() to avoid hang mbedtls: fix MBEDTLS_DEBUG builds ftp/imap/pop3/smtp: Allow the service name to be overridden CURLOPT_SOCKS5_GSSAPI_SERVICE: Merged with CURLOPT_PROXY_SERVICE_NAME build: include scripts/ in the dist http2: Add handling stream level error http2: Improve header parsing makefile.vc6: use d suffix on debug object configure: remove check for libresolve scripts/make: use $(EXEEXT) for executables checksrc: got rid of the whitelist files sendf: added ability to call recv() before send() as workaround NTLM: check for NULL pointer before dereferencing openssl: builds with OpenSSL 1.1.0-pre5 configure: ac_cv_ -> curl_cv_ for all cached vars winbuild: add mbedtls support curl: make --ftp-create-dirs retry on failure PolarSSL: implement public key pinning multi: accidentally used resolved host name instead of proxy CURLINFO_TLS_SESSION.3: clarify TLS library support before 7.48.0 CONNECT_ONLY: don't close connection on GSS 401/407 reponses opts: Fix some syntax errors in example code fragments mbedtls: Fix session resume test1139: verifies libcurl option man page presence CURLINFO_TLS_SSL_PTR.3: Clarify SSL pointer availability curl: make --disable work as long form of -q curl: use --telnet-option as documented curl.1: document --ftp-ssl-reqd, --krb4 and --ntlm-wb curl: -h output lacked --proxy-header and --ntlm-wb curl -J: make it work even without http:// scheme on URL lib: include curl_printf.h as one of the last headers tests: handle path properly on Msys/Cygwin curl.1: --mail-rcpt can be used multiple times CURLOPT_ACCEPT_ENCODING.3: clarified docs: fixed lots of broken man page references tls: make setting pinnedkey option fail if not supported test1140: run nroff-scan to verify man pages http: make sure a blank header overrides accept_decoding connections: do not reuse non-HTTP proxies on different ports connect: fix invalid "Network is unreachable" errors TLS: move the ALPN/NPN enable bits to the connection TLS: SSL_peek is not a const operation http2: Add space between colon and header value darwinssl: fix certificate verification disable on OS X 10.8 mprintf: Fix processing of width and prec args ftp wildcard: segfault due to init only in multi_perform
2016-05-29Simplify by using more of the github framework.wiz3-17/+10
2016-05-29Add and enable ruby-jekyll-archives.jmmv1-1/+2
2016-05-29Initial addition of ruby-jekyll-archives, version 2.1.0:jmmv4-0/+24
Automatically generate post archives by dates, tags, and categories.
2016-05-28Add www/http-parser 2.7.0.schnoebe7-1/+102
An parser for HTTP messages written in C, parsing both requests and responses. It is designed to be used in performance oriented HTTP applications. It does not make any syscalls nor allocations, it does not buffer data, it can be interrupted at anytime. Depending on your architecture, it only requires about 40 bytes of data per message stream (in a web server that is per connection).
2016-05-26Add kdewebkitmarkd1-1/+2
2016-05-26Add KDE Frameworks 5.21.0 packages:markd5-0/+67
kdewebkit - KDE Integration for QtWebKit
2016-05-25Update to 3.1wen2-7/+7
Upstream changelog is too long, please visit: https://docs.moodle.org/dev/Moodle_3.1_release_notes
2016-05-24Update typo3_62 to 6.2.25 (TYPO3 6.2.25), including security fix.taca3-8/+9
2016-05-24 8926699 [RELEASE] Release of TYPO3 6.2.25 (TYPO3 Release Team) 2016-05-24 f18b990 #76278 [BUGFIX] Allow non critical request arguments with @ (Helmut Hummel) 2016-05-24 8e766a8 [TASK] Set TYPO3 version to 6.2.25-dev (TYPO3 Release Team) 2016-05-24 29df864 [RELEASE] Release of TYPO3 6.2.24 (TYPO3 Release Team) 2016-05-24 c10db60 #76231,#76256 [SECURITY] Validate complete referring request (Helmut Hummel) 2016-05-17 070e747 [TASK] Set TYPO3 version to 6.2.24-dev (TYPO3 Release Team) 2016-05-17 80a1f39 [RELEASE] Release of TYPO3 6.2.23 (TYPO3 Release Team) 2016-05-17 1b58942 #75721 [BUGFIX] Use push parser instead of pull parser on fetching extension list (Oliver Hader) 2016-05-17 6a038ac Revert "[BUGFIX] Load XML files of Extension Manager properly" (Oliver Hader) 2016-05-06 8713065 #76066,#76064 [TASK] Make .htaccess Apache 2.4 suitable (Marc von Schalscha-Ehrenfeld) 2016-05-05 31bb6be #75934 [TASK] Disallow access to documentation folders (Markus Klein) 2016-05-01 9100aae #75947 [BUGFIX] Allow maxitem=1 in TCA treeSelect again (Alexander Bigga) 2016-04-26 034e97b [TASK] Set TYPO3 version to 6.2.23-dev (TYPO3 Release Team)
2016-05-23On NetBSD if squid-pf option enabled then also need --with-nat-devpfmarkd1-1/+4
2016-05-22Revert previous, permissions fixup is still needed in this case.wiz1-1/+6
2016-05-21Update to 1.26.3wen3-12/+8
Upstream changes: MediaWiki 1.26.3 This is a maintenance release of the MediaWiki 1.26 branch. Changes since 1.26.2 (bug T116266) Fixed undefined property notices in DairikiDiff under HHVM. (bug T123166) Fix fatal error when importing pages to titles which cannot be created, such as invalid titles or titles the user is not allowed to edit. (bug T122056) Old tokens are remaining valid within a new session (bug T127114) Login throttle can be tricked using non-canonicalized usernames (bug T123653) Cross-domain policy regexp is too narrow (bug T123071) Incorrectly identifying http link in a's href attributes, due to m modifier in regex (bug T129506) MediaWiki:Gadget-popups.js isn't renderable (bug T125283) Users occasionally logged in as different users after SessionManager deployment (bug T103239) Patrol allows click catching and patrolling of any page (bug T122807) [tracking] Check php crypto primatives (bug T98313) Graphs can leak tokens, leading to CSRF (bug T130947) Diff generation should use PoolCounter (bug T133507) Careless use of $wgExternalLinkTarget is insecure (bug T132874) API action=move is not rate limited (bug T110143) strip markers can be used to get around html attribute escaping in (bug many?) parser tags (bug T116030) Increase pbkdf2 parameter strengths (bug T127420) Pbkdf2Password does not check if hash_pbkdf2(bug ) succeeded (bug T126685) Globally throttle password attempts
2016-05-21Update to 0.33wen2-8/+11
Add missing DEPENDS Upstream changes: 0.33 2016-01-28T12:19:05Z - bugfix: Make `%T` to formatted in seconds (Thank you astj) 0.32 2014-06-09T02:00:15Z - change perl version requirements to 5.8.1 0.30 2014-01-28T07:59:07Z - add docs abount POSIX::strftime::Compiler - non trial release 0.24 2014-01-27T03:12:16Z - [TRIAL] switch to using POSIX::strftime::Compiler 0.23 2014-01-16T15:53:09Z - fixed POSIX::setlocale fails on system without locales (Android) #6 (Thank you dex4er) 0.22 2014-01-08T00:25:14Z - skip tz test on Windows. 0.21 2014-01-07T13:43:29Z - requires perl v5.8.4 (Thank you dex4er) - skip tz test on Cygwin. 0.20 2014-01-07T00:38:29Z - Fixed test. Cygwin does not die tzset. But timezone does not been changed 0.15 2014-01-06T13:47:11Z - Fixed test. POSIX::tzset not implemented on Windows (Thank you dex4er) 0.14 2014-01-06T05:41:14Z - Check tzoffset for every line. It's need for daylight saving time. - Use POSIX::strftime::GNU if available (Thank you dex4er)
2016-05-21Update to 0.97wen2-9/+8
Upstream changes: 0.95 2012-08-05 RT 60940 https://rt.cpan.org/Ticket/Display.html?id=60940 0.96 2012-09-28 RT 70525 https://rt.cpan.org/Ticket/Display.html?id=70525 0.97 2012-10-22 RT 80326 https://rt.cpan.org/Ticket/Display.html?id=80326 Thanks to Bill Moseley (HANK) for the spot
2016-05-21Update to 0.058wen2-7/+7
Upstream changes: 0.058 2016-05-03 11:29:57-04:00 America/New_York - No changes from 0.057 0.057 2016-04-18 10:17:00-04:00 America/New_York (TRIAL RELEASE) [ADDED] - Added support for the SSL_CERT_FILE environment variable. - Added 'peer' attribute to force a connection to a particular server. - Added 'connected' method to allow introspection of persistent connections. - An array reference of redirection result hash references is included in the final response hash reference (but only if redirects occur). [CHANGED] - Because folded headers are obsoleted in the revised RFCs, if CRLF is found in header values followed by one or more spaces, they are all replaced by a single space. [FIXED] - Per the RFC, control headers are now sent first before other headers (which are sent in arbitrary order). - Only well-known headers have their case canonicalized; all other headers are sent in the case provided by the user. - The 'keep_alive' option now also sets the SO_KEEPALIVE option on the underlying socket to help with long-lived, idle connections. - Request header field values are now validated against the RFC rules (i.e. empty or else space-or-tab separated tokens of printable characters).
2016-05-21Update to 0.12wen2-8/+8
Add LICENSE Upstream changes: 0.12 Thu, 28 Apr 2016 06:30:00 +0100 - Moved POD tests to xt/ directory so they are not run for normal user installs. 0.11 Wed, 27 Apr 2016 16:01:00 +0100 - Added a mapping for *.js files to a Content-Type of application/javascript 0.10 Wed, 27 Apr 2016 14:45:00 +0100 - Reworked how the value for the Content-Type header is selected. Simple regexp matching on the path suffix is used for *.html?, *.css and *.txt files. Any other files are checked using File::LibMagic as before. Closes: https://rt.cpan.org/Ticket/Display.html?id=113980 and https://rt.cpan.org/Ticket/Display.html?id=91321
2016-05-21post-install chmod no longer necessaryrichard2-10/+2
2016-05-20Updated www/py-google-api-python-client to 1.5.1mef2-7/+7
------------------------------------------------ Version 1.5.1 Bugfix release - Allow using versions of oauth2client < 2.0.0. (#197) - Check both current and new API discovery URL. (#202) - Retry http requests on connection errors and timeouts. (#218) - Retry http requests on rate limit responses. (#201) - Import guards for ssl (for Google App Engine). (#220) - Use named loggers instead of the root logger. (#206) - New search console example. (#212)
2016-05-20Depend on an nss providing nss-config, and remove workaround patch.wiz4-51/+5
Bump PKGREVISION.
2016-05-19fix PLIST when the official-mozilla-branding option is enabledsnj1-2/+3
2016-05-17Use REAL_ROOT_USER/REAL_ROOT_GROUP instead of ROOT_USER/ROOT_GROUPfhajny2-15/+15
for all pkgsrc dir/file ownership rules. Fixes unprivileged user/group names from leaking into binary packages, manifest as non-fatal chown/chgrp failure messages at pkg_add time. Bump respective packages' PKGREVISION.
2016-05-15Fix oss option buildryoon2-12/+22
Based on PR pkg/51125.
2016-05-15Update to 6.62wen2-7/+7
Upstream changes: 6.62 2016-05-14 - Removed deprecated is_debug, is_error, is_info and is_warn methods from Mojo::Log. - Improved support for Ubuntu on Windows. 6.61 2016-04-30 - Improved Mojo::Server::Daemon to no longer log when a connection has been closed prematurely. - Fixed bug in Mojo::Content where the drain event would not always be emitted for dynamically generated content with a Content-Length header. 6.60 2016-04-25 - Fixed bug in Mojo::IOLoop where stopping gracefully would sometimes result in connections getting closed too early. (anparker, sri)
2016-05-14Add support for building with LibreSSL/BoringSSLsevan2-1/+20
Patch obtained from upstream via OpenBSD ports/net/curl/patches/patch-lib_vtls_openssl_c
2016-05-13Added dependency on py-django-formtools and py-django-treebeardadam1-1/+3
2016-05-13Added www/py-django-formtools version 1.0adam1-1/+2
2016-05-13Django's formtools is a set of high-level abstractions for Django forms.adam4-0/+210
Currently for form previews and multi-step forms. This code used to live in Django proper - in django.contrib.formtools - but was separated into a standalone package in Django 1.8 to keep the framework's core clean.
2016-05-13Version 0.4.3:adam3-12/+18
* Add missing migration for ``on_delete``
2016-05-13Changes 1.2.0:adam3-51/+71
* Drop Django 1.5 support * Drop Python 3.3 support (now 3.4+) * Testrunner cleanup * Fix many regressions and bugs in Django 1.8/1.9 * Admin UI enhancements * Fix issues with non-default STATICFILES_STORAGE * Hide related widget wrapper links * Fix cancel link in delete confirmation * Make BaseImage.subject_location field non-nullable * Adds icon sizes * Fixes owner search icon on detail view * Disable submit button if only one folder to copy file * Design improvements * Empty folder design * Removes disabled action button border * Adds unsorted uploads empty view * Fix issues with subject location being off on images smaller than 210px * Ignores unsorted uploads from search and count
2016-05-13Changes 1.1.1:adam3-25/+20
* Adds cancel link to delete confirmation page * Adds documentation link to dropdown * Fix hidden ckeditor toolbar under the django cms main toolbar * Floats related widget wrapper links next to select field * Fix cropped input text * Adds djangocms-admin-style class to body * Floats calendar and date pickers next to input field * Floats calendar and date fields in modal * Removes disabled action button border * Adds highlighted area to error messages
2016-05-13Changes 2.9.3:adam3-9/+34
* Adds work-around for Django Parler internal caching
2016-05-13=== 3.2.5 (2016-04-27) ===adam3-14/+35
- Fix packaging problem with the wheel distribution === 3.2.4 (2016-04-26) === - Fix cache settings - Fix user lookup for view restrictions/page permissions when using raw id field - Fixed regression when page couldn't be copied if CMS_PERMISSION was False - Fixes an issue relating to uninstalling a namespaced application - Adds "Can change page" permission - Fixes a number of page-tree issues the could lead data corruption under certain conditions - Addresses security vulnerabilities in the `render_model` template tag that could lead to escalation of privileges or other security issues. - Addresses a security vulnerability in the cms' usage of the messages framework - Fixes security vulnerabilities in custom FormFields that could lead to escalation of privileges or other security issues.
2016-05-12Changes 1.7.2:adam2-7/+7
This is a bug-fix release of 1.7 series, fixing following issues found in 1.7.1. The release also updates the bundled LibreSSL to 2.2.7 that includes a fix for CVE-2016-2107.
2016-05-12Packages that link against libcurl built with http2 option set fail towiz1-1/+4
link against nghttp2 library, evidently due to missing entries in the buildlink3.mk. From Aleksey Arens in PR 51131.
2016-05-10Update to 3.20160509. From the changelog:schmonz2-7/+7
[ Amitai Schlair ] * img: ignore the case of the extension when detecting image format, fixing the regression that *.JPG etc. would not be displayed since 3.20160506 [ Simon McVittie ] * img: parse img_allowed_formats case-insensitively, as was done in 3.20141016.3 * inline: restore backwards compat for show=-1 syntax, which worked before 3.20160121 * Remove a spurious changelog entry from 3.20160506 (the relevant change was already in 3.20150614) * Add CVE-2016-4561 reference to 3.20160506 changelog * Set high urgency to get the CVE-2016-4561 fix and CVE-2016-3714 mitigation into testing -- Simon McVittie <smcv@debian.org> Mon, 09 May 2016 21:57:09 +0100
2016-05-09Changes 7.5:adam4-18/+20
- Compatibility with Perl 5.22 - Support detection of Edge browser with detail of version. - Update robots database - Add eot/woff/woff2 to mime.pm as fonts - Add .svgz to image list - Exclude groups.google from search engines - Add %time5 tag to support log format with iso time with timezone. - Add option DynamicDNSLookup to make DNS lookup during output instead of during log analysis processing. - Increase default value for MaxRowsInHTMLOutput
2016-05-08Update squid3 to 3.5.19, 3.5.18 contains security fix.taca3-26/+7
Changes to squid-3.5.19 (09 May 2016): - Regression Bug 4515: interception proxy hangs Changes to squid-3.5.18 (06 May 2016): - Bug 4510: stale comment about 32KB limit on shared memory cache entries - Bug 4509: EUI compile error on NetBSD - Bug 4501: HTTP/1.1: normalize Host header - Bug 4498: URL-unescape the login-info after extraction from URI - Bug 4455: SegFault from ESIInclude::Start - Prevent Squid forcing -b 2048 into the arguments for sslcrtd_program - Fix TLS/SSL server handshake alert handling
2016-05-08s/kactivities/libkactivities4/markd1-3/+3
2016-05-07Changes 1.9.6:adam3-52/+16
Bugfixes: --------- Added support for relative path redirects to the test client and to SimpleTestCase.assertRedirects() because Django 1.9 no longer converts redirects to absolute URIs. Fixed TimeField microseconds round-tripping on MySQL and SQLite. Prevented makemigrations from generating infinite migrations for a model field that references a functools.partial. Fixed a regression where SessionBase.pop() returned None rather than raising a KeyError for nonexistent values. Fixed a regression causing the cached template loader to crash when using template names starting with a dash. Restored conversion of an empty string to null when saving values of GenericIPAddressField on SQLite and MySQL. Fixed a makemessages regression where temporary .py extensions were leaked in source file paths