devel/bugzilla5{0,2}: Fix pkg-plistf0e3d196f1Bugzilla security issuesentered 2018-02-16
Bug-tracking system developed by Mozilla Project
mozilla:bugzilla from the portpkg audit reports nothing for this version.devel/bugzilla5{0,2}: Fix pkg-plistf0e3d196f1devel/bugzilla50: add fix for FreeBSD PR 250699. This has been submitted to upstream. PR: 28389763de02be63
devel/bugzilla50: update to 5.0.4.1, fix mastersite. PR: 2838973dcaef2e31
graphics/ImageMagicks*: bump dependent ports9a9c1ba205
devel/bugzilla50: Depend on security/p5-Digest-SHA While here, clarify which Bugzilla (ours) the PRs are part of. Pull Request: https://github.com/freebsd/freebsd-ports/pull/33646099eef46
databases/p5-DBD-mysql: Fix for MariaDB users Add a new variable DBD_MYSQL, use that in *_DEPENDS and add mysql to USES where required. DBD_MYSQL will automatically set the correct DBD dependency. In cd16748194e2 databases/p5-DBD-mysql was updated to 5.x, in 5.x the support for MariaDB was removed and only MySQL >= 8.0 is supported. In the 4.x releases MariaDB is still supported, according to upstream 4.x will still be supported for a while [1], so use that for now when we detect that MYSQL_FLAVOUR is set to mariadb. databases/p5-DBD-mysql4 was added in d95f49cb3b54. DBD:MariaDB would be another alternative, but migrating to it might need more analysis than just staying with the 4.x releases of p5-DBD-mysql. This thread on the amavis-users mailing list has a very good summary [2] from the author of DBD:MariaDB. This includes ideas and suggestions from vvd and mat. Thanks! [1] https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=277889#c17 [2] https://lists.amavis.org/pipermail/amavis-users/2024-March/006823.html PR: 275100, 277889 Reviewed by: vvd, mat Fixes: cd16748194e2 Differential Revision: https://reviews.freebsd.org/D4466292a030dffd
Mk/Uses/magick.mk: Bump all consumers Bump all consumers of ImageMagick ports after flavorizing them. Approved by: tcberner (mentor, implicit)a6bb2f8c5e
*/*: Remove pointers to EOLed pgsql versions - Remove dotted pgsql versions Approved by: portmgra40c0e7d83
Mk/Uses/apache.mk: Refactor after removal of older versions apache22 and apache25 had been removed a long time ago however the apache.mk file has never been refactored and is out of sync from the file Mk/bsd.default-versions.mk. These changes refactors the removals of the older versions. In addition: - Move some keywords like USE_APACHE, USE_APACHE_BUILD, USE_APACHE_RUN from SANITY_DEPRECATED to SANITY_UNSUPPORTED - Remove apache versions from ports Makefiles as currently there is only one available version in the tree. However the version checks are still valid and should work flawlessly whenever a new version is added. For example USES=apache:2.2+ are simply replaced with USES=apache. As currently there are no other versions available for test this could not be checked on it's own ground. - Update FOO_USE=APACHE=yes to FOO_USES=apache - Remove trailing whitespaces Approved by: portmgr Differential Revision: https://reviews.freebsd.org/D3811340843b1ccb
Remove WWW entries moved into port Makefiles Commit b7f05445c00f has added WWW entries to port Makefiles based on WWW: lines in pkg-descr files. This commit removes the WWW: lines of moved-over URLs from these pkg-descr files. Approved by: portmgr (tcberner)fb16dfecae
Add WWW entries to port Makefiles It has been common practice to have one or more URLs at the end of the ports' pkg-descr files, one per line and prefixed with "WWW:". These URLs should point at a project website or other relevant resources. Access to these URLs required processing of the pkg-descr files, and they have often become stale over time. If more than one such URL was present in a pkg-descr file, only the first one was tarnsfered into the port INDEX, but for many ports only the last line did contain the port specific URL to further information. There have been several proposals to make a project URL available as a macro in the ports' Makefiles, over time. This commit implements such a proposal and moves one of the WWW: entries of each pkg-descr file into the respective port's Makefile. A heuristic attempts to identify the most relevant URL in case there is more than one WWW: entry in some pkg-descr file. URLs that are not moved into the Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr files in order to preserve them. There are 1256 ports that had no WWW: entries in pkg-descr files. These ports will not be touched in this commit. The portlint port has been adjusted to expect a WWW entry in each port Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as deprecated. Approved by: portmgr (tcberner)b7f05445c0
framework: Add new USES 'magick' for graphics/ImageMagick*
A new USES has been added to depend on ImageMagick.
USES=magick
adds a LIB_DEPENDS on graphics/ImageMagick${IMAGEMAGICK_DEFAULT}.
If a specific version is required, use for example
USES=magick:6 resp. USES=magick:7
If only a build, run or test is required, use for example
USES=magick:build resp. USES=magick:6,build,test
If a dependency on the nox11 flavor is required, use for example
USES=magick:nox11 resp. USES=magick:7,nox11,run,test
See magick.mk for more details on the available flags.
The tree has been completely converted to make use of this.
Approved by: bapt
Differential Revision: https://reviews.freebsd.org/D3275445526ecbeeOne more small cleanup, forgotten yesterday. Reported by: lwhsucf118ccf87
Remove # $FreeBSD$ from Makefiles.305f148f48
Move devel/p5-IO-stringy to devel/p5-IO-Stringy and update to 2.113 - Fix LICENSE_FILE - Update pkg-descr - Update WWW - Bump PORTREVISION of dependent ports for dependency change Changes: https://metacpan.org/changes/distribution/IO-Stringyaae33b1c39
Move remaining USE_MYSQL, WANT_MYSQL_VER to USES=mysql581cac9416
Convert to UCL & cleanup pkg-message (categories d)78d1aff1fc
Update ImageMagick to 6.9.10.14 [1] * Add PKGNAMESUFFIX and rename the directory. This was done to show that IM6 is not the "main" version. But still fully supported by upstream. * Convert a number of options to optionhelpers. * Add option for ISO/IEC 23008-12:2017 HEIF suport * Add comment to pkg-descr explaining IM6's "legacy" tag. * Add comment to the patch-config_policy.xml file why it still needed. Please note that IM7 is not a drop in replacement due to library API and command arguments changes. And as a result ports need to decide for themself which version to use. Chase these changes in all the ports that using IM6. PR: 225102 (based on, only the version update) [1] Submitted by: Pascal Christen <pascal.christen@hostpoint.ch>289883b11b
devel/bugzilla[44,50]: remove optional and expired SSL dependencyde3aebf522
devel/bugzilla50: Backport patch to fix buggy attachment download filenames PR: 228644 Approved by: maintainer (timeout)503576ab27
- Update WWW Approved by: portmgr blanket4e121597c9
- update to 5.0.4 - remove p5-File-Slurp dependency (see Bugzilla/Install/Requirements.pm) MFH: 2018Q1 Security: CVE-2018-5123 Security: vid: 22283b8c-13c5-11e8-a861-20cf30e32f6d5d7bd6e7ea
devel/bugzilla[44|50]: Update license Approved by: portmgr (blanket)fb1d0cd085
- Fix trailing whitespace in pkg-messages Approved by: portmgr blankete87a8bd319
- update to 5.0.3 Thanks to Mokhi for review latest 5.0.x PR's and patches! Security: CVE-2016-2803 Security: 036d6c38-1c5b-11e6-b9e0-20cf30e32f6dddeeed1a89
- fix build with PostgreSQL (s/91/9.1/) as default db (PD error: cannot install: unknown PostgreSQL version: 91+) MFH: 2016Q2ec609c6298
Remove USE_SQLITE from bsd.databases.mk, replaced by USES=sqlite. While there replace USE_SQLITE=x by USES=sqlite:x. PR: 208971 Submitted by: mat Exp-run by: antoine With hat: portmgr Sponsored by: Absolight Differential Revision: https://reviews.freebsd.org/D595121bc5c0345
- Remove unnecessary PERL_LEVEL check - Add NO_ARCH - Convert to new options helper - Use bsd.port.mk instead of bsd.port.pre.mk + bsd.port.post.mk With hat: perl Approved by: portmgr (blanket)a027cceb18
Remove ${PORTSDIR}/ from dependencies, categories d, e, f, and g.
With hat: portmgr
Sponsored by: Absolight4e1b79a0a6- add new OPTIONS_GROUP_EXTENSIONS (MoreBugUrl and Voting) - add patch so MoreBugUrl has support for Phabricator URL's [1] - PORTREVISION bump not requied, new OPTIONS are OFF by default [1] Upstream PR: https://bugzilla.mozilla.org/show_bug.cgi?id=1128119 Special Thanks goes to Mahdi Mokhtari for the patches and improving the FreeBSD Bugzilla integration! PR: 207216 Submitted by: Mahdi Mokhtari149ee339e5
- Backport upstream bug #1235395 PR: 206103 Submitted by: Mahdi Mokhtari <mokhi64 _at_ gmail.com> Obtained from: https://bugzilla.mozilla.org/show_bug.cgi?id=1235395 MFH: 2016Q1de4fb4e302
- Set submitter_id before calling _check_data() [1] - bump PORTREVISION [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1235270 PR: 205657 Submitted by: mokhi64(_at_)gmail.com Reviewed by: koobs@a82c92cd7d
- update to 5.0.2
This release fixes two security issues.
See the Security Advisory for details. [1]
This release also contains the following bug fixes:
o mod_perl now works correctly with mod_access_compat turned off on
Apache 2.4. To regenerate the .htaccess files, you must first delete
all existing ones in subdirectories:
find . -mindepth 2 -name .htaccess -exec rm -f {} \;
You must then run checksetup.pl again to recreate them with the correct syntax.
(Bug 1223790)
o Emails sent by Bugzilla are now correctly encoded as UTF-8. (Bug 714724)
o Strawberry Perl is now fully supported on Windows. (Bug 1089448 and bug 987742)
o The XML-RPC API now works with IIS on Windows. (Bug 708252)
o Some queries should now be faster on PostgreSQL. (Bug 1184431)
[1] https://www.bugzilla.org/security/4.2.15/
MFH: 2015Q4
Security: CVE-2015-8508
CVE-2015-8509
vid="54075861-a95a-11e5-8b40-20cf30e32f6d"f735c69458- update bugzilla ports to 5.0.1 / 4.4.10 o Users whose login name is not an email address could not log in on installations which use LDAP to authenticate users. o If a mandatory custom field was hidden, it was not possible to create a new bug or to edit existing ones. o A user editing his login name to point to a non-existent email address could cause Bugzilla to stop working, causing a denial of service. o Emails generated during a transaction made PostgreSQL stop working. o Bugs containing a comment with a reference to a bug ID larger than 2^31 could not be displayed anymore using PostgreSQL. o Emails sent by Bugzilla are now correctly encoded as UTF-8. o The date picker in the "Time Summary" page was broken. o If Test::Taint or any other Perl module required to use the JSON-RPC API was not installed or was too old, the UI to tag comments was displayed anyway, you could tag comments, but tags were not persistent (they were lost on page reload). Now the UI to tag comments is not displayed at all until the missing Perl modules are installed and up-to-date. o Custom fields of type INTEGER now accept negative integers. MFH: 2015Q3 Security: CVE-2015-4499 Security: ea893f06-5a92-11e5-98c0-20cf30e32f6d7bf5d6d9cb
- add bugzilla 5.0 Release Notes: https://www.bugzilla.org/releases/5.0/release-notes.htmlb053ac3256
- svn copy bugzilla44 to bugzilla50 Update to 5.x will be done with the next commit because of pre-commit hook! svn: E165001: Commit blocked by pre-commit hook (exit code 1) with output: Do not replace a file. This can lose history. Path: "/head/devel/bugzilla50/Makefile" == Additional errors may compound and may not be accurate ==61f8f81085