CodeIgniter is a PHP full-stack web framework. This vulnerability allows attackers to execute arbitrary code when you use Validation Placeholders. The vulnerability exists in the Validation library, and validation methods in the controller and in-model validation are also vulnerable because they use the Validation library internally. This issue is patched i…
B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_having() function. Note: Multiple third parties have disputed this as not a valid vulnerability.
B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php where() function. Note: Multiple third parties have disputed this as not a valid vulnerability.
B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where_not_in() function. Note: Multiple third parties have disputed this as not a valid vulnerability.
B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_like() function. Note: Multiple third parties have disputed this as not a valid vulnerability.
B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php where_not_in() function. Note: Multiple third parties have disputed this as not a valid vulnerability.
B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php like() function. Note: Multiple third parties have disputed this as not a valid vulnerability.
B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php having() function. Note: Multiple third parties have disputed this as not a valid vulnerability.
B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where_in() function. Note: Multiple third parties have disputed this as not a valid vulnerability.
B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_not_like() function. Note: Multiple third parties have disputed this as not a valid vulnerability.
B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php. Note: Multiple third parties have disputed this as not a valid vulnerability
B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where() function. Note: Multiple third parties have disputed this as not a valid vulnerability.
B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php where_in() function. Note: Multiple third parties have disputed this as not a valid vulnerability.
CodeIgniter through 4.0.0 allows remote attackers to gain privileges via a modified Email ID to the "Select Role of the User" page. NOTE: A contributor to the CodeIgniter framework argues that the issue should not be attributed to CodeIgniter. Furthermore, the blog post reference shows an unknown website built with the CodeIgniter framework but that CodeIgn…
CodeIgniter is a PHP full-stack web framework A vulnerability was found in the Language class that allowed DoS attacks. This vulnerability can be exploited by an attacker to consume a large amount of memory on the server. Upgrade to v4.4.7 or later.
CodeIgniter is a PHP full-stack web framework. Prior to CodeIgniter4 version 4.4.3, if an error or exception occurs, a detailed error report is displayed even if in the production environment. As a result, confidential information may be leaked. Version 4.4.3 contains a patch. As a workaround, replace `ini_set('display_errors', '0')` with `ini_set('display_…
Shield is an authentication and authorization framework for CodeIgniter 4. This vulnerability may allow [SameSite Attackers](https://canitakeyoursubdomain.name/) to bypass the [CodeIgniter4 CSRF protection](https://codeigniter4.github.io/userguide/libraries/security.html) mechanism with CodeIgniter Shield. For this attack to succeed, the attacker must have …
CodeIgniter is a PHP full-stack web framework. Prior to 4.5.8, CodeIgniter lacked proper header validation for its name and value. The potential attacker can construct deliberately malformed headers with Header class. This could disrupt application functionality, potentially causing errors or generating invalid HTTP requests. In some cases, these malformed …
VuXML only (0) · listed, port not fixed yet
None. pkg audit reports nothing for this version.
Fixed (15)
VuXML entries whose affected range this version has left.
*/*php86*: Sunrise
Please DO NOT use this version in production, it is an early test version.
For upgrade notes please visit:
https://github.com/php/php-src/blob/php-8.6.0alpha1/UPGRADING
Changelog: https://github.com/php/php-src/blob/php-8.6.0alpha1/NEWS
*/*: Mark IGNORE_WITH_PHP=84
These ports are currently not compatible with php84 and is only a limited
set of ports. There might be more ports which has runtime issues. Please
check if your ports are compatible with php84 and if not pleae mark them
IGNORE_WITH_PHP=84
Approved by: portmgr (blanket)
*/*: Remove merged or non-existent USE_PHP directives
- Remove USE_PHP=hash which is available in default php installation of
all versions of php
* security/pear-Horde_Crypt_Blowfish: Remove OPTION MHASH
- Remove USE_PHP=json which is available in default php installation of
all versions of php
* devel/pear-PHPTAL: Remove OPTION JSON
* www/ilias: Remove OPTION SCORM2004
- Remove USE_PHP=mssql which is no longer available in php from php80
and later and has been replaced with sqlsrv module which is Windows
only
* www/codeigniter: Remove OPTION MSSQL
* www/moodle311: Remove OPTION MSSQL
* www/moodle39: Remove OPTION MSSQL
* www/moodle40: Remove OPTION MSSQL
* www/moodle41: Remove OPTION MSSQL
- Remove USE_PHP=openssl which is available in default php installation
of all versions of php
* databases/phpmyadmin: Remove OPTION OPENSSL
* databases/phpmyadmin5: Remove OPTION OPENSSL
* security/pear-Horde_Crypt_Blowfish: Remove OPTION OPENSSL
* www/nextcloud: Remove OPTION SSL
* www/owncloud: Remove OPTION SSL
- Remove USE_PHP=pcre which is available in default php installation of
all versions of php
* sysutils/racktables: Remove OPTION PCRE
- Remove USE_PHP=postgresql which should be USE_PHP=pgsql and update
following ports
* www/typo3-11
* www/typo3-12
- Remove USE_PHP=pdf which is no longer available as php module
* databases/phpmyadmin: Remove OPTION PDF
- Remove USE_PHP=spl which is available in default php installation of
all versions of php
- Remove USE_PHP=sqlsrv which was never imported into FreeBSD as that is
Windows only php module
* www/typo3-11: Remove OPTION SQLSRV
* www/typo3-12: Remove OPTION SQLSRV
- Bump where DEFAULT OPTIONS are affected
Sponsored by: Bounce Experts
Approved by: portmgr(blanket)
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.
There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.
The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.
Approved by: portmgr (tcberner)
www/codeigniter: Update to 3.1.13
- Remove outdated CONFLICTS:
- codeigniter17 has been removed over 8 years
- codeigniter22 has been removed over 6 years
- Remove DOCS option
Changes: https://github.com/bcit-ci/CodeIgniter/commits/develop
Update to 3.1.10
- Convert PORTDOCS to PLIST entries
- Convert to options variable helper
- Use INSTALL_DATA instead of CP
- Clean up Makefile
Changes: https://www.codeigniter.com/user_guide/changelog.html
www/codeigniter: update 3.1.5 -> 3.1.6 and pass back to ports@
Security: https://vuxml.FreeBSD.org/freebsd/ef3423e4-d056-11e7-a52c-002590263bf5.html
MFH: 2017Q4
Never set WRKSRC when using USE_GITHUB.
If you want to set WRKSRC, set GH_PROJECT instead.
- The GitHub URLs are case insensitive, but the distribution files you
get out of them are not.
- If the repository was renamed, the old URL will still work, but the
distribution name will be ith the new name.
Sponsored by: Absolight
Always set the DEFAULT github DISTFILE with .tar.gz for EXTRACT_SUFX.
Fix distinfo for the offending ports.
lang/yorick's tag was moved, and the added patch was no longer needed.
PR: 207644
Submitted by: mat
Exp-run by by: antoine
Sponsored by: Absolight
Differential Revision: https://reviews.freebsd.org/D4268
www/codeigniter: update 2.2.6 -> 3.0.3
- Update PORTVERSION, distinfo, and pkg-plist for 3.0.3
- Add LICENSE
- Fix CONFLICTS
Changes compared to CodeIgniter 2:
* The framework is released under the MIT license
* The database drivers have had extensive refactoring
* PDO is fully functional with subdrivers
* There is a new Session library
* There is a new Encryption library
* The unit testing has been beefed up, and code coverage improved
* PHP 5.4 or newer is recommended, but CI will still work on PHP 5.2.4
UPDATING:
- Add entry documenting the steps for updating a legacy site
Reference: http://www.codeigniter.com/user_guide/installation/upgrade_300.html
PR: 203403
www/codeigniter*: repo copy in preparation of CodeIgniter 3.x update
- Repo copy www/codeigniter -> www/codeigniter22
- Mark www/codeigniter22 as DEPRECATED and add a PKGNAMESUFFIX
- Register CONFLICTS
- Connect www/codeigniter22 to the build
PR: 203403
www/codeigniter: update 2.2.4 -> 2.2.5
- Convert to USE_GITHUB as 2.2.5 was not available at original MASTER_SITES
PR: 203403
Approved by: maintainer timeout (21 days)
Security: https://vuxml.FreeBSD.org/freebsd/95602550-76cf-11e5-a2a1-002590263bf5.html
MFH: 2015Q4
Fix depends: - DEFAULT_PHP_VER is deprecated - Using it after bsd.port.pre.mk was hazardous, when php was not yet installed it was depending on /usr/local/lib/php/20131226/session.so:/usr/ports/www/php5-session, i.e. a php 5.6 file and a php 5.4 port