aboutsummaryrefslogtreecommitdiff
path: root/www/apache22/files
Commit message (Collapse)AuthorAgeFilesLines
* - update to 2.2.29Olli Hauer2014-09-033-518/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - use PTHREAD_LIBS/CFLAGS instead -pthread Changes with Apache 2.2.29 http://www.apache.org/dist/httpd/CHANGES_2.2.29 *) Corrected docs/manual pages for new MergeTrailers directive and other out of date documentation. [William Rowe] Changes with Apache 2.2.28 *) SECURITY: CVE-2014-0118 (cve.mitre.org) [1] mod_deflate: The DEFLATE input filter (inflates request bodies) now limits the length and compression ratio of inflated request bodies to avoid denial of service via highly compressed bodies. See directives DeflateInflateLimitRequestBody, DeflateInflateRatioLimit, and DeflateInflateRatioBurst. [Yann Ylavic, Eric Covener] *) SECURITY: CVE-2014-0231 (cve.mitre.org) [1] mod_cgid: Fix a denial of service against CGI scripts that do not consume stdin that could lead to lingering HTTPD child processes filling up the scoreboard and eventually hanging the server. By default, the client I/O timeout (Timeout directive) now applies to communication with scripts. The CGIDScriptTimeout directive can be used to set a different timeout for communication with scripts. [Rainer Jung, Eric Covener, Yann Ylavic] *) SECURITY: CVE-2014-0226 (cve.mitre.org) [1] Fix a race condition in scoreboard handling, which could lead to a heap buffer overflow. [Joe Orton, Eric Covener, Jeff Trawick] *) SECURITY: CVE-2013-5704 (cve.mitre.org) [2] core: HTTP trailers could be used to replace HTTP headers late during request processing, potentially undoing or otherwise confusing modules that examined or modified request headers earlier. Adds "MergeTrailers" directive to restore legacy behavior. [Edward Lu, Yann Ylavic, Joe Orton, Eric Covener] *) core: Detect incomplete request and response bodies, log an error and forward it to the underlying filters. PR 55475. [Yann Ylavic] *) mod_deflate: Handle Zlib header and validation bytes received in multiple chunks. PR 46146. [Yann Ylavic] *) mod_proxy: Don't reuse a SSL backend connection whose requested SNI differs. PR 55782. [Yann Ylavic] *) mod_deflate: Fix inflation of files larger than 4GB. PR 56062. [Lukas Bezdicka <social v3.sk>] *) mod_dav: Fix improper encoding in PROPFIND responses. PR 56480. [Ben Reser] *) mod_ssl: Extend the scope of SSLSessionCacheTimeout to sessions resumed by TLS session resumption (RFC 5077). [Rainer Jung] *) mod_proxy_ajp: Forward local IP address as a custom request attribute like we already do for the remote port. [Rainer Jung] *) mod_deflate: Don't fail when flushing inflated data to the user-agent and that coincides with the end of stream ("Zlib error flushing inflate buffer"). PR 56196. [Christoph Fausak <christoph fausak glueckkanja.com>] *) mod_cache, mod_disk_cache: With CacheLock enabled, responses with a Vary header might not get the benefit of the thundering herd protection due to an incorrect internal cache key. PR 50317. [Ruediger Pluem, Jan Kaluza, Yann Ylavic] *) mod_rewrite: Support session cookies with the CO= flag when later parameters are used. The doc for this implied the feature had been backported for quite some time. PR56014 [Eric Covener] *) mod_cache: Don't remove stale cache entries that cannot be conditionally revalidated. This prevents the thundering herd protection from serving stale responses during a revalidation. PR 50317. [Eric Covener, Jan Kaluza, Ruediger Pluem] *) core: Increase TCP_DEFER_ACCEPT socket option to from 1 to 30 seconds. PR 41270. [Dean Gaudet <dean arctic org>] [1] CVE issues already fixed since FreeBSD-ports r362845 [2] new CVE-2013-5704 issue fixed in 2.2.29 MFH: 2014Q3 Security: f927e06c-1109-11e4-b090-20cf30e32f6d Security: CVE-2013-5704 Notes: svn path=/head/; revision=367227
* - backport upstream security fixesOlli Hauer2014-07-243-0/+518
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - fix build with SSL from ports [1] SECURITY: CVE-2014-0118 (cve.mitre.org) mod_deflate: The DEFLATE input filter (inflates request bodies) now limits the length and compression ratio of inflated request bodies to avoid denial of sevice via highly compressed bodies. See directives DeflateInflateLimitRequestBody, DeflateInflateRatioLimit, and DeflateInflateRatioBurst. http://svn.apache.org/viewvc?view=revision&revision=1611426 SECURITY: CVE-2014-0226 (cve.mitre.org) Fix a race condition in scoreboard handling, which could lead to a heap buffer overflow. Thanks to Marek Kroemeke working with HP's Zero Day Initiative for reporting this. * include/scoreboard.h: Add ap_copy_scoreboard_worker. * server/scoreboard.c (ap_copy_scoreboard_worker): New function. * modules/generators/mod_status.c (status_handler): Use it. http://svn.apache.org/viewvc?view=revision&revision=1610515 SECURITY: CVE-2014-0231 (cve.mitre.org) mod_cgid: Fix a denial of service against CGI scripts that do not consume stdin that could lead to lingering HTTPD child processes filling up the scoreboard and eventually hanging the server. http://svn.apache.org/viewvc?view=revision&revision=1611185 [1] noted and testd by mat@ MFH: 2014Q3 Security: f927e06c-1109-11e4-b090-20cf30e32f6d CVE-2014-0118 CVE-2014-0231 CVE-2014-0226 Notes: svn path=/head/; revision=362845
* - reflect new preferred apache versionOlli Hauer2014-07-131-3/+3
| | | | Notes: svn path=/head/; revision=361691
* - strip filesOlli Hauer2014-07-082-16/+17
| | | | | | | | | | | | | | | - sort pkg-plist - always install DOCS (remove Makefile hack) - reflect modules.d in EXAMPLESDIR, next target will be a new keyword for pkg-plist to handle module installation. - bump PORTREVISION - add warning about default version change (2014-07-11) (pkg-message, files/HEADS_UP) Notes: svn path=/head/; revision=361294
* - revert r350271Olli Hauer2014-04-051-0/+12
| | | | Notes: svn path=/head/; revision=350274
* - remove comment from patchOlli Hauer2014-04-051-12/+0
| | | | Notes: svn path=/head/; revision=350271
* - update to version 2.2.27Olli Hauer2014-03-271-1/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - fix apache-mpm-peruser graceful reload [1] Changes with Apache 2.2.27 *) SECURITY: CVE-2014-0098 (cve.mitre.org) Clean up cookie logging with fewer redundant string parsing passes. Log only cookies with a value assignment. Prevents segfaults when logging truncated cookies. [William Rowe, Ruediger Pluem, Jim Jagielski] *) SECURITY: CVE-2013-6438 (cve.mitre.org) mod_dav: Keep track of length of cdata properly when removing leading spaces. Eliminates a potential denial of service from specifically crafted DAV WRITE requests [Amin Tora <Amin.Tora neustar.biz>] *) core: draft-ietf-httpbis-p1-messaging-23 corrections regarding TE/CL conflicts. [Yann Ylavic <ylavic.dev gmail com>, Jim Jagielski] *) mod_proxy_http: Core dumped under high load. PR 50335. [Jan Kaluza <jkaluza redhat.com>] *) proxy_util: NULL terminate the right buffer in 'send_http_connect'. [Christophe Jaillet] *) mod_proxy: Remove (never documented) <Proxy ~ wildcard-url> syntax which is equivalent to <ProxyMatch wildcard-url>. [Christophe Jaillet] *) mod_ldap: Fix a potential memory leak or corruption. PR 54936. [Zhenbo Xu <zhenbo1987 gmail com>] *) mod_ssl: Do not perform SNI / Host header comparison in case of a forward proxy request. [Ruediger Pluem] *) mod_rewrite: Add mod_rewrite.h to the headers installed on Windows. PR46679 [Bob Ionescu] PR: ports/182947 [1] Submitted by: Andrew Azarov <andrew@azar-a.net> [1] Notes: svn path=/head/; revision=349319
* - update to 2.2.26Olli Hauer2013-11-243-50/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - add new directory for modules (APACHEETCDIR/modules.d) New modules can be registered here with a simple file that contains the LoadModule directives. Additonal Maintaines can write instructions to the conf file and keep pkg-message short. As bonus the config file can be installed like every other config file with a .sample extention so modules are not disabled during pkg upgrades. Module config files should begin with three digits followed by '_' e.g. 100_php5.conf. The load order can be controlled via the three digits. Please wait some time before adopting the new directory so users have time to update and adjust axisting configs Changes with Apache 2.2.26 *) mod_dav: dav_resource->uri treated as unencoded. This was an unnecessary ABI changed introduced in 2.2.25 PR 55397. [Ben Reser] *) mod_dav: Do not validate locks against parent collection of COPY source URI. PR 55304. [Ben Reser] *) mod_ssl: Check SNI hostname against Host header case-insensitively. PR 49491. [Mayank Agrawal <magrawal.08 gmail.com>] *) mod_ssl: enable support for ECC keys and ECDH ciphers. Tested against OpenSSL 1.0.0b3. [Vipul Gupta vipul.gupta sun.com, Sander Temme, Stefan Fritsch] *) mod_ssl: Change default for SSLCompression to off, as compression causes security issues in most setups. (The so called "CRIME" attack). [Stefan Fritsch] *) mod_ssl: Fix compilation error when OpenSSL does not contain support for SSLv2. Problem was introduced in 2.2.25. PR 55194. [Rainer Jung, Kaspar Brand] *) mod_dav: Fix double encoding of URIs in XML and Location header (caused by unintential ABI change in 2.2.25). PR 55397. [Ben Reser] Notes: svn path=/head/; revision=334783
* - backport upstream commit r1528718 into mod_dav [1].Olli Hauer2013-11-051-0/+50
| | | | | | | | | | | | | | | | | | This is needed because of a bug [2] due to an incorrect implementation of RFC 4918. The symptoms are a failure to copy a svn tree via DAV: - fix package installation with old pkg tools (create empty folders in pkg-plist even staging is enabled) [1] http://svn.apache.org/viewvc?view=revision&revision=1528718 [2] https://issues.apache.org/bugzilla/show_bug.cgi?id=55306 PR: ports/183685 Submitted by: Pietro Cerutti <gahr@FreeBSD.org> Notes: svn path=/head/; revision=332914
* - support stagingOlli Hauer2013-10-272-41/+43
| | | | | | | - partitial adopt new ${opt}_ notation Notes: svn path=/head/; revision=331788
* - update to apache-2.2.25Olli Hauer2013-07-101-27/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - update vuxml with additional CVE-2013-1896 entry Changes with Apache 2.2.25 http://www.apache.org/dist/httpd/CHANGES_2.2.25 *) SECURITY: CVE-2013-1896 (cve.mitre.org) mod_dav: Sending a MERGE request against a URI handled by mod_dav_svn with the source href (sent as part of the request body as XML) pointing to a URI that is not configured for DAV will trigger a segfault. [Ben Reser <ben reser.org>] *) SECURITY: CVE-2013-1862 (cve.mitre.org) mod_rewrite: Ensure that client data written to the RewriteLog is escaped to prevent terminal escape sequences from entering the log file. [Eric Covener, Jeff Trawick, Joe Orton] *) core: Limit ap_pregsub() to 64MB and add ap_pregsub_ex() for longer strings. The default limit for ap_pregsub() can be adjusted at compile time by defining AP_PREGSUB_MAXLEN. [Stefan Fritsch, Jeff Trawick] *) core: Support the SINGLE_LISTEN_UNSERIALIZED_ACCEPT optimization on Linux kernel versions 3.x and above. PR 55121. [Bradley Heilbrun <apache heilbrun.org>] *) mod_setenvif: Log error on substitution overflow. [Stefan Fritsch] *) mod_ssl/proxy: enable the SNI extension for backend TLS connections [Kaspar Brand] *) mod_proxy: Use the the same hostname for SNI as for the HTTP request when forwarding to SSL backends. PR 53134. [Michael Weiser <michael weiser.dinsnail.net>, Ruediger Pluem] *) mod_ssl: Quiet FIPS mode weak keys disabled and FIPS not selected emits in the error log to debug level. [William Rowe] *) mod_ssl: Catch missing, mismatched or encrypted client cert/key pairs with SSLProxyMachineCertificateFile/Path directives. PR 52212, PR 54698. [Keith Burdis <keith burdis.org>, Joe Orton, Kaspar Brand] *) mod_proxy_balancer: Added balancer parameter failontimeout to allow server admin to configure an IO timeout as an error in the balancer. [Daniel Ruggeri] *) mod_authnz_ldap: Allow using exec: calls to obtain LDAP bind password. [Daniel Ruggeri] *) htdigest: Fix buffer overflow when reading digest password file with very long lines. PR 54893. [Rainer Jung] *) mod_dav: Ensure URI is correctly uriencoded on return. PR 54611 [Timothy Wood <tjw omnigroup.com>] *) mod_dav: Make sure that when we prepare an If URL for Etag comparison, we compare unencoded paths. PR 53910 [Timothy Wood <tjw omnigroup.com>] *) mod_dav: Sending an If or If-Match header with an invalid ETag doesn't result in a 412 Precondition Failed for a COPY operation. PR54610 [Timothy Wood <tjw omnigroup.com>] *) mod_dav: When a PROPPATCH attempts to remove a non-existent dead property on a resource for which there is no dead property in the same namespace httpd segfaults. PR 52559 [Diego Santa Cruz <diego.santaCruz spinetix.com>] *) mod_dav: Do not fail PROPPATCH when prop namespace is not known. PR 52559 [Diego Santa Cruz <diego.santaCruz spinetix.com>] *) mod_dav: Do not segfault on PROPFIND with a zero length DBM. PR 52559 [Diego Santa Cruz <diego.santaCruz spinetix.com>] PR: ports/180248 Submitted by: Jason Helfman jgh@ Notes: svn path=/head/; revision=322728
* - add fix for CVE-2013-1862Olli Hauer2013-07-062-3/+87
| | | | | | | - adjust vuxml Notes: svn path=/head/; revision=322368
* - disable new ab SSL extensions until a better way is found.Olli Hauer2013-03-051-0/+12
| | | | | | | | | | | | | only builds with OpenSSL from ports are affected which is not default, so no version bump. Noted on the apache@ list by Jukka A. Ukkonen <jau@iki.fi> and per PR by Arnis Rozentals <admin@liepajaport.lv> PR: 176659 Notes: svn path=/head/; revision=313481
* - update to version 2.2.24Olli Hauer2013-03-024-2326/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - move mpm itk patches to itk-mpm/files dir - add sshd to REQUIRE line in the rc script to prevent boot issues in case a SSL cert is password protected [1] Changes with Apache 2.2.24 SECURITY: CVE-2012-3499 (cve.mitre.org) Various XSS flaws due to unescaped hostnames and URIs HTML output in mod_info, mod_status, mod_imagemap, mod_ldap, and mod_proxy_ftp. [Jim Jagielski, Stefan Fritsch, Niels Heinen <heinenn google com>] SECURITY: CVE-2012-4558 (cve.mitre.org) XSS in mod_proxy_balancer manager interface. [Jim Jagielski, Niels Heinen <heinenn google com>] mod_rewrite: Stop merging RewriteBase down to subdirectories unless new option 'RewriteOptions MergeBase' is configured. Merging RewriteBase was unconditionally turned on in 2.2.23. PR 53963. [Eric Covener] mod_ssl: Send the error message for speaking http to an https port using HTTP/1.0 instead of HTTP/0.9, and omit the link that may be wrong when using SNI. PR 50823. [Stefan Fritsch] mod_ssl: log revoked certificates at level INFO instead of DEBUG. PR 52162. [Stefan Fritsch] mod_proxy_ajp: Support unknown HTTP methods. PR 54416. [Rainer Jung] mod_dir: Add support for the value 'disabled' in FallbackResource. [Vincent Deffontaines] mod_ldap: Fix regression in handling "server unavailable" errors on Windows. PR 54140. [Eric Covener] mod_ssl: fix a regression with the string rendering of the "UID" RDN introduced in 2.2.15. PR 54510. [Kaspar Brand] ab: add TLS1.1/TLS1.2 options to -f switch, and adapt output to more accurately report the negotiated protocol. PR 53916. [Nicolás Pernas Maradei <nico emutex com>, Kaspar Brand] mod_cache: Explicitly allow cache implementations to cache a 206 Partial Response if they so choose to do so. Previously an attempt to cache a 206 was arbitrarily allowed if the response contained an Expires or Cache-Control header, and arbitrarily denied if both headers were missing Currently the disk and memory cache providers do not cache 206 Partial Responses. [Graham Leggett] core: Remove unintentional APR 1.3 dependency introduced with Apache 2.2.22. [Eric Covener] core: Use a TLS 1.0 close_notify alert for internal dummy connection if the chosen listener is configured for https. [Joe Orton] mod_ssl: Add new directive SSLCompression to disable TLS-level compression. PR 53219. [1] requested by Andrew Filonov (freebsd-apache/2012-September/002962.html) with head apache@ Notes: svn path=/head/; revision=313287
* Various spelling correctionsChris Rees2013-02-091-1/+1
| | | | | | | | | | | | | PR: ports/175331 Submitted by: Christoph Mallon Approved by: No objections within three weeks from any maintainer While here, style and duplicate phrase fixes in bsdcflow pkg-descr Submitted by: mi Notes: svn path=/head/; revision=311969
* UseAndrey A. Chernov2013-01-021-0/+11
| | | | | | | | | | | | | | LockFile "/var/run/accept.lock" instead of previous LockFile "/var/log/accept.lock" If system is crashed and rebooted, Apache refuses to start in case /var/log/accept.lock.<pid> is found. That <pid> is almost always the same due to minimum pid variance right after boot. So use /var/run instead, which is cleaned on each boot. Notes: svn path=/head/; revision=309798
* Fix a typo.Hiroki Sato2012-11-181-1/+1
| | | | | | | | | Spotted by: ume Pointy hat to: hrs Feature safe: yes Notes: svn path=/head/; revision=307544
* Fix rc.d script to support systems before and after ${name}_fib is introducedHiroki Sato2012-11-181-5/+8
| | | | | | | | | into rc.subr. Bump PORTREVISION. Feature safe: yes Notes: svn path=/head/; revision=307542
* - update apache22 to version 2.22.23Olli Hauer2012-11-023-26/+5
| | | | | | | | | | | | | - trim vuxml/Makefile header with hat apache@ Feature safe: yes Security: CVE-2012-2687 Notes: svn path=/head/; revision=306878
* - fix build on IPv4 only systemsOlli Hauer2012-09-051-2/+4
| | | | | | | Thanks to John Marshall to identify the issue! Notes: svn path=/head/; revision=303687
* - Simplify options with the removal of the last APR only related parameter [1]Olli Hauer2012-09-041-5/+8
| | | | | | | | | | | | | | | | | | - disallow IPv6 sockets to handle IPv4 requests per default. [2] - move extra-patch-server__config.c -> patch-server__config.c https://issues.apache.org/bugzilla/show_bug.cgi?id=53823 - bump PORTREVISION [1] Credits to Hajimu UMEMOTO (ume@) for finding the last APR related parameter [2] http://httpd.apache.org/docs/2.2/bind.html with hat apache@ Notes: svn path=/head/; revision=303674
* devel/apr1 [1]Olli Hauer2012-09-023-0/+122
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - update APR to 1.4.6 - update APR-util to 1.4.1 - remove PKGNAMESUFFIX'es www/apache-(event|itk|peruser|worker)-mpm - adopt new Makefile header, adjust PKGNAMESUFFIX in apache22 masterport PKGNAME match now LATEST_LINK www/apache22 [2]-[6] - rewrite for options NG - PORTNAME s|apache|apache22| - remove APR APR-util specific otions, will be checked now with help of apr/u-1-config Mk/bsd.apache.mk - rewrite for options NG - remove no longer needet make targets (show-categories, make-options-list) [1] PR: 165143 [2]-[6] PR: 130479 PR: 153406 PR: 158565 PR: 168769 PR: 167965 with hat apache@ Notes: svn path=/head/; revision=303550
* Document Apache 2.2.x insecure handling of LD_LIBRARY_PATH.Wesley Shields2012-08-021-3/+12
| | | | | | | | | | | | Add patch[1] to address problem to apache port. [1]: http://svn.apache.org/viewvc/httpd/httpd/trunk/support/envvars-std.in?view=log&pathrev=1296428 Approved by: apache@ (pgollucci@) Obtained from: Apache SVN Notes: svn path=/head/; revision=301849
* Bump pcre library dependency due to 8.30 updateMartin Matuska2012-02-141-0/+12
| | | | | | | Add (vendor) patch for deprecated pcre_info() Notes: svn path=/head/; revision=291337
* - use $SYSCTLPhilip M. Gollucci2012-02-091-3/+3
| | | | | | | | | | | | - use full path setfib PR: ports/153264 Submitted by: Jeremy Chadwick <freebsd@jdc.parodius.com> With Hat: apache@ Sponsored by: Apache Software Foundation (ASF) Notes: svn path=/head/; revision=290765
* - Convert to USERS/GROUPS [1]Philip M. Gollucci2012-02-081-72/+72
| | | | | | | | | | | | | | - Resync proxy connect patch [2] - Bump PORTREVISION since the proxy patch is unconditionally applied which means we can remove that OPTION too PR: ports/164698 [1], ports/164711 [2] Submitted by: jgh@ [1], freebsd@nagilum.org [2] With Hat: apache@ Sponsored by: RideCharge Inc. / TaxiMagic Notes: svn path=/head/; revision=290685
* - Update to 2.2.22Jason Helfman2012-02-012-42/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Addresses: * SECURITY: CVE-2011-3607 (cve.mitre.org) Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, leading to a heap-based buffer overflow. * SECURITY: CVE-2012-0021 (cve.mitre.org) The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server 2.2.17 through 2.2.21, when a threaded MPM is used, does not properly handle a %{}C format string, which allows remote attackers to cause a denial of service (daemon crash) via a cookie that lacks both a name and a value. * SECURITY: CVE-2012-0031 (cve.mitre.org) scoreboard.c in the Apache HTTP Server 2.2.21 and earlier might allow local users to cause a denial of service (daemon crash during shutdown) or possibly have unspecified other impact by modifying a certain type field within a scoreboard shared memory segment, leading to an invalid call to the free function. * SECURITY: CVE-2011-4317 (cve.mitre.org) The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an @ (at sign) character and a : (colon) character in invalid positions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3368. * SECURITY: CVE-2012-0053 (cve.mitre.org) protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors involving a (1) long or (2) malformed header in conjunction with crafted web script. * SECURITY: CVE-2011-3368 (cve.mitre.org) The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character. PR: ports/164675 Reviewed by: pgollucci Approved by: pgollucci, crees, rene (mentors, implicit) With Hat: apache@ Notes: svn path=/head/; revision=290249
* - Restore inadvertently removed log renames from previous commitPhilip M. Gollucci2012-01-231-7/+23
| | | | | | | | Noticed by: sunpoet@ Pointy Hat: pgollucci@ Notes: svn path=/head/; revision=289702
* - Pull r1227293 from httpd svnPhilip M. Gollucci2012-01-181-20/+40
| | | | | | | | | | | | Note, you have to actually uncomment the include for this to take affect - No PORTREVISION bump since nothing changes by default PR: ports/156987 Reported by: Adrian Dimcev <adimcev@carbonwind.net> With Hat: apache@ Notes: svn path=/head/; revision=289395
* In the rc.d scripts, change assignments to rcvar to use theDoug Barton2012-01-142-10/+8
| | | | | | | | | | | | | | literal name_enable wherever possible, and ${name}_enable when it's not, to prepare for the demise of set_rcvar(). In cases where I had to hand-edit unusual instances also modify formatting slightly to be more uniform (and in some cases, correct). This includes adding some $FreeBSD$ tags, and most importantly moving rcvar= to right after name= so it's clear that one is derived from the other. Notes: svn path=/head/; revision=289156
* - unbreak mpm-itk-20110321-01 patchOlli Hauer2011-05-141-2/+2
| | | | | | | | PR: ports/157041 Submitted by: zlopi.ru <zlopi.ru _at gmail.com> Notes: svn path=/head/; revision=274127
* - update Apache 2 ITK MPM patch to version 20110321-01 [1]Olli Hauer2011-03-312-58/+291
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - add additional patch for mpm-itk [2] - add mod_substitute to apache22 [3] - add some documentation into the mpm-itk* patches - bump portrevision Changes: [1] apache2.2-mpm-itk 2.2.17-01, released 2011-03-21: * Fixed CVE-2011-1176: If NiceValue was set, the default with no AssignUserID was to run as root:root instead of the default Apache user and group, due to the configuration merger having an incorrect default configuration. * Rebase against Apache 2.2.17. * Fix an issue where users can sometimes get spurious 403s on persistent connections, if the .htaccess files are not world readable. * In the config merger, don't reallocate the username, since it's already in the correct pool. (This is not a memory leak, only a small inefficiency.) [2] http://httpd.apache.org/docs/2.2/mod/mod_substitute.html Source: http://mpm-itk.sesse.net/ [1] http://www.pvv.ntnu.no/~knuta/mpm-itk/ [2] http://lists.freebsd.org/pipermail/freebsd-apache/2011-March/002184.html [3] With Hat: apache@ PR: ports/156024 [1][2] Submitted by: Lukasz Wasikowski <lukasz _at_ wasikowski.net> [1][2] Nick Gieczewski <sorongo _at_ gmail.com> [3] Notes: svn path=/head/; revision=272057
* - The previous update to the rc.d script didn't quite maintain the old behaviorPhilip M. Gollucci2010-10-211-0/+1
| | | | | | | | | | | | correctly. This fixes the pid file name PR: ports/151623 Submitted by: Vivek Khera <vivek@khera.org> With Hat: apache@ Point hat to: myself (pgollucci) Notes: svn path=/head/; revision=263412
* - s,/usr/local,%%PREFIX%%,'Philip M. Gollucci2010-10-141-1/+1
| | | | | | | Reported by: stas Notes: svn path=/head/; revision=263008
* - Allow overriding of the following on a profile basis.Philip M. Gollucci2010-10-141-3/+7
| | | | | | | | | | | | | | | | pidfile command envvars Without profiles, the old defaults remain unchanged. With profiles the old defaults remain unchanged. Sponsored by: RideCharge Inc. / TaxiMagic Tested by: RideCharge Inc. / TaxiMagic (> 1 yr in production) With Hat: apache@ Notes: svn path=/head/; revision=263006
* - Upgrade to 2.2.16.Jun Kuriyama2010-07-261-25/+5
| | | | | | | | Security: CVE-2010-1452 (mod_{cache,dev} remote DoS), CVE-2010-2068 (mod_{proxy_{ajp,http},reqtimeout} related on some platforms) Notes: svn path=/head/; revision=258257
* - Fix misnamed patch that was unconditionally applied.Philip M. Gollucci2010-05-211-0/+0
| | | | | | | | | PR: ports/146789 Submitted by: Sunpoet Po-Chuan Hsieh <sunpoet@sunpoet.net> With Hat: apache@ Notes: svn path=/head/; revision=254739
* - remove apr/apr-util vestigesPhilip M. Gollucci2010-05-189-268/+0
| | | | | | | | | | | - fullbuild not needed anymore - buildconf not needed anymore - scripts_env not needed anymore With Hat: apache@ Notes: svn path=/head/; revision=254536
* By default suexec doesn't enforces different resource limitations configured inPhilip M. Gollucci2010-05-141-0/+49
| | | | | | | | | | | | | | | | | | | | login.conf(5). This is probably because resource limitations are handled differently on various different platforms. This modifies suexec behaviour to set resource limits for CGI's from /etc/login.conf before execing the customers CGI script. Doesn't affect default package, so no PORTREVISION bumps. I will follow up at dev@httpd.apache.org to see about adding this with #ifdefs. PR: ports/136091 Submitted by: Alexey V.Degtyarev <alexey@renatasystems.org> With Hat: apache@ Notes: svn path=/head/; revision=254295
* - Remove use of $] which is deprecated in perl and gone in perl 5.12Philip M. Gollucci2010-05-131-4/+12
| | | | | | | | | | This is already being discussed at dev@httpd and will be committed upstream Reported by: brad clawsie <clawsie@fastmail.fm> (on apache@ list) With Hat: apache@ Notes: svn path=/head/; revision=254238
* - Continuation of ports/133704Philip M. Gollucci2010-05-071-3/+9
| | | | | | | | | | | | | | | | apxs -A comments out the LoadModule line This adds custom FreeBSD mod to 'DELETE' the line so that it works with our pkg-plists in packages. - Remove -s form the cmp httpd.conf in pkg-plist to be blatant about why it didn't get removed - Tested with lang/php5 - Bump PORTREVISION PR: ports/133704 With Hat: apache@ Notes: svn path=/head/; revision=253918
* - Fix -A and -a options for apxs to correctly ignore whitespace.Philip M. Gollucci2010-05-071-1/+22
| | | | | | | | | | | | | | This will fix about 100 pkg-plist left overs for httpd.conf - Bump PORTREVISION - This will be in 2.2.16. PR: ports/133704 Obtained from: http://svn.apache.org/viewvc?rev=942210&view=rev Reported by: olli hauer <ohauer@gmx.de> (and very good pr!) With Hat: apache@ Notes: svn path=/head/; revision=253916
* - Fix the owner to be root:wheel on files* when running sudo make ...Philip M. Gollucci2010-05-072-4/+14
| | | | | | | | | | This doesn't affect the package b/c pointyhat/tb run as root PR: ports/134456 With Hat: apache@ Notes: svn path=/head/; revision=253875
* - Regenerate patch files with make makepatch for they havePhilip M. Gollucci2010-05-0723-87/+110
| | | | | | | | | | | | piled up and additional patches conflict. This also will help when we try to syncronize www/apache20&www/apache22 - Unconditionally apply the mod_proxy_connect patch, you just may or may not actually compile the file to save some logic in Makefile With Hat: apache@ Notes: svn path=/head/; revision=253856
* - This file isn't even used, it doesn't matter anyway devel/apr(1.4.2) andPhilip M. Gollucci2010-05-061-1625/+0
| | | | | | | | | | the apr bundled with www/apache22 include this file as the licensing issue was resolved ages ago With Hat: apache@ Notes: svn path=/head/; revision=253853
* 2/5: Update to httpd 2.2.15, default to using devel/apr instead of bundled aprPhilip M. Gollucci2010-05-052-35/+34
| | | | | | | | | | PR: ports/146130 Approved by: portmgr (pav) Tested by: -exp run (pav) With Hat: apache@ Notes: svn path=/head/; revision=253782
* Begin the process of deprecating sysutils/rc_subr byDoug Barton2010-03-272-2/+2
| | | | | | | s#. %%RC_SUBR%%#. /etc/rc.subr# Notes: svn path=/head/; revision=251553
* - Add support for db48 (with WITH_BDB=t and WITH_BDB_VER=48) byJun Kuriyama2009-12-121-11/+13
| | | | | | | | | | | | updating patch to dbm.m4. Old patch for dbm.m4 is for db47. But recent apache dist already includes code block for db47, so update a patch by replacing it to db48. - No $PORTREVISION bump (no effect to packages with default options). Submitted by: ume Notes: svn path=/head/; revision=245594
* - Allow install by a user other then rootPhilip M. Gollucci2009-12-121-0/+10
| | | | | | | | | | | [Duplicate fix for devel/apr here in www/apache22 too] PR: ports/13876 [based on] Submitted by: Mel Flynn <mel at rachie.is-a-geek.net> miwi@ Notes: svn path=/head/; revision=245578
* - envvars needs to be sourced before _all_ commands if it existsPhilip M. Gollucci2009-12-111-0/+2
| | | | | | | | PR: ports/138466 (based on) Submitted by: Dmitry Pryanishnikov <lynx.ripe@gmail.com> Notes: svn path=/head/; revision=245573
generated by cgit v1.2.3 (git 2.25.1) at 2025-02-06 15:01:12 +0000