SphinxSearch in Sphinx Technologies Sphinx through 3.1.1 allows directory traversal (in conjunction with CVE-2019-14511) because the mysql client can be used for CALL SNIPPETS and load_file operations on a full pathname (e.g., a file in the /etc directory). NOTE: this is unrelated to CMUSphinx.
VuXML only (0) · listed, port not fixed yet
None. pkg audit reports nothing for this version.
Fixed (0)
No VuXML entries for this package.
Commits (83)
Baptiste Daroussin (bapt) · 2.2.11_6
MANPREFIX: eleminate its usage and move man to share/man
textproc/sphinxsearch: return to the pool
Upstream switched to a commercial license years ago, and so we cannot
include more recent versions in the ports. Despite indications on the
website that they would switch back to GPL, this hasn't happened in
more than 5 years, so I guess it is never going to happen. From an
opensource point of view, this software is essentially abandonware.
However, given there is an actively developed upstream project, and
that project does provide FreeBSD binaries, it doesn't feel right to
deprecate the software entirely.
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.
There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.
The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.
Approved by: portmgr (tcberner)
Fix CONFLICTS entries of multiple ports
There have been lots of missing CONFLICTS_INSTALL entries, either
because conflicting ports were added without updating existing ports,
due to name changes of generated packages, due to mis-understanding
the format and semantics of the conflicts entries, or just due to
typoes in package names.
This patch is the result of a comparison of all files contained in
the official packages with each other. This comparison was based on
packages built with default options and may therefore have missed
further conflicts with optionally installed files.
Where possible, version numbers in conflicts entries have been
generalized, some times taking advantage of the fact that a port
cannot conflict with itself (due to logic in bsd.port.mk that
supresses the pattern match result in that case).
A few ports that set the conflicts variables depending on complex
conditions (e.g. port options), have been left unmodified, despite
probably containing outdated package names.
These changes should only affect the installation of locally built
ports, not the package building with poudriere. They should give an
early indication of the install conflict in cases where currently
the pkg command aborts an installation when it detects that an
existing file would be overwritten,
Approved by: portmgr (implicit)
*/*: Remove redundant '-[0-9]*' from CONFLICTS
The conflict checks compare the patterns first against the package
names without version (as reported by "pkg query "%n"), then - if
there was no match - agsinst the full package names including the
version (as reported by "pkg query "%n-%v").
Many CONFLICTS definitions used patterns like "bash-[0-9]*" to filter
for the bash package in any version. But that pattern is functionally
identical with just "bash".
Approved by: portmgr (blanket)
Multiple ports: improve regex compliance
These changes largely fall into just two categories:
1. Need textproc/gsed for GNU extensions
2. Extraneous escapes that can go away
For #1, there's a further subdivision into those that require autoconf magic
and those that can get away with BINARY_ALIAS=sed=${LOCALBASE}/bin/gsed.
-CURRENT will soon gain GNU extensions, but these will take longer to get to
all supported releases; we must switch them to gsed to ensure we're actually
properly building them as intended.
For #2, I've fixed these as I can and we should upstream these fixes.
PORTREVISION is bumped for all of the above, because we will almost
certainly build these differently when the replacements actually start
working.
These were all detected by the below-referenced exp-run [1]. The patch
included forbids many ordinary characters from being escaped, since we'll
later imbue those with special meanings. This has had the nice side effect
of picking up various things that we didn't handle properly, e.g. \t and \r
for tab and carriage return.
PR: 229925 [1]
Approved by: koobs (mentor)
Approved by: portmgr (blanket: trivial build fixes)
MFH: no (invasive risk)
Differential Revision: https://reviews.freebsd.org/D25185
Bump PORTREVISION for ports depending on the canonical version of GCC as defined in Mk/bsd.default-versions.mk which has moved from GCC 8.3 to GCC 9.1 under most circumstances now after revision 507371.
This includes ports
- with USE_GCC=yes or USE_GCC=any,
- with USES=fortran,
- using Mk/bsd.octave.mk which in turn features USES=fortran, and
- with USES=compiler specifying openmp, nestedfct, c11, c++0x, c++11-lang,
c++11-lib, c++14-lang, c++17-lang, or gcc-c++11-lib
plus, everything INDEX-11 shows with a dependency on lang/gcc9 now.
PR: 238330
textproc/sphinxsearch: fix build on GCC architectures
New GCC is required:
The compiler feature "cxx_decltype" is not known to CXX compiler
Approved by: mentors (implicit approval)
Patches to make the code compatible with clang-6.0 / C++17 -- this will fix the build on FreeBSD 12.0
- delete the 'register' keyword everywhere
- Add whitespace between adjacent quoted strings
- Update the offsetof() macro to cast the result to int
Reported by: pkg-fallout
Pending a better fix, mark broken when the RE2 option is enabled. Recent versions of devel/re2 install headers that result in error messages like so:
/usr/local/include/re2/re2.h:915:5: error: no matching function for call to 'call_once'
std::call_once(once_, &LazyRE2::Init, this);
^~~~~~~~~~~~~~
No change to the default package, so no PORTREVISION bump.
PR: 219239
Submitted by: mail+freebsd@gerritbeine.de, w.schwarzenfeld@utanet.at
- install the 'wordbreaker' program - install the example minimum configuration file - use OPTION dependent targets for DOCS, EXAMPLES - always install man pages, irrespective of the DOCS option
Move MySQL support from bsd.databases.mk to Uses/mysql.mk.
Also, USE_MYSQL can't happen after bsd.port.pre.mk because it is a USES.
PR: 208971
Submitted by: mat
Exp-run by: antoine
With hat: portmgr
Sponsored by: Absolight
Differential Revision: https://reviews.freebsd.org/D5951
The snowball project has done its usual trick of re-rolling a distfile in place. No substantive differences to the previous version were seen.
PR: 195151
Submitted by: danger
* The Snowball project has rerolled libstemmer_c.tgz as they occasionally do. This time they've actually changed the code, so patching is now required in order to compile.[1]
* Add option to link against re2 regular expression library.[2]
* PGSQL_USE -> PGSQL_USES
Submitted by: Daniel Ylitalo <daniel@blodan.se>[1]
Submitted by: Alex Storn <devzone.my@gmail.com>[2]
Upstream has re-rolled the libstemmer_c.tgz distfile as they do at intervals and for no apparent reason. Side-by-side comparison with the previous version shows absolutely no changes.
Submitted by: Daniel Ylitalo <daniel@blodan.se>
- Fix installation when DOCS or EXAMPLES are unset by always installing docs and examples unconditionally to staging. The packaging step will not include them in the package generated from stagingif DOCS or EXAMPLES is unset.
- List EXAMPLES explicitly in pkg-plist
PR: 185194
Submitted by: Miroslav Lachman <000.fbsd@quip.cz>
* use option helpers (blatantly copying from the textproc/sphinxseach-devel port) [1] * New style LIB_DEPENDS for libodbc * Install DOCS and EXAMPLES to the stage directory unconditionally
Submitted by: danger [1]
- Update to 2.0.9 - Refresh distinfo for libstemmer_c.tgz
The libstemmer_c.tgz distfile tarball gets recreated at intervals. I
have diff'd the contents of a freshly downloaded tarball against the
older tarball matching the previous distinfo, and I can confirm that
there are no changes to the files contained therein.
Reported by: portscout
Upstream re-rolled the distfle without incrementing the version number.
Side by side comparison shows the only changes are to correct internal
references to the version number in documentation and autoconf scripts
from '2.0.9-dev' to '2.0.8-release' No changes to the C++ code.
PR: 178375
Submitted by: Sam <samorders@gmail.com>
Rely on bsdtar to autodetermine the format of the distfiles when possible
For a while now bsdtar is able to autotermine compression and archive format.
Let's then use tar directly instead of piping to tar.
Now USE_BZIP2 and USE_XZ only set EXTRACT_SUFX to the right format
Update to 2.0.8
ChangeLog:
Bug fixes
---------
* fixed #1515, log strings over 2KB were clipped when
query_log_format=plain
* fixed #1514, RT index disk chunk lose attribute update on daemon
restart
* fixed #1512, crash while formatting log messages
* fixed #1511, crash on indexing PostgreSQL data source with MVA
attributes
* fixed #1509, blend_chars vs incomplete multi-form and overshort
* fixed #1504, RT binlog replay vs descending tid on update
* fixed #1499, sql_field_str2wordcount actually is int, not string
* fixed #1498, now working with exceptions starting with number too
* fixed #1496, multiple destination keywords in wordform
* fixed #1494, lost 'mod', '%' operations in select list. Also corrected
few typers in the doc.
* fixed #1490, expand_keywords vs prefix
* fixed #1487, `id` in expression fixed
* fixed #1483, snippets limits fix
* fixed #1481, shebang config changes check on rotation
* fixed #1479, port handling in PHP Sphinx API
* fixed #1474, daemon crash at SphinxQL packet overflows max_packet_size
* fixed #1472, crash on loading index to indextool for check
* fixed #1465, expansion_limit got lost in index rotation
* fixed #1427, #1506, utf8 3 and 4-bytes codepoints
* fixed #1405, between with mixed int float values
Update to 2.0.7
FreeBSD specific Mutex code now incorporated upstream, so patches to
sphinxstd.cpp, sphinxstd.h no longer required.
Not-exactly-a-ChangeLog:
http://sphinxsearch.com/blog/2013/01/10/highlighting-some-changes-in-sphinx-2-0-7/
Feature safe: yes