www/rt50: Update to 5.0.10
This release fixes the following vulnerabilities:
CVE-2026-44231
CVE-2026-41075
CVE-2026-41076
CVE-2026-6841
CVE-2026-44227
CVE-2026-44230
CVE-2026-44229
CVE-2026-41073
Changelog: https://github.com/bestpractical/rt/releases/tag/rt-5.0.10
databases/p5-DBD-mysql: Fix for MariaDB users
Add a new variable DBD_MYSQL, use that in *_DEPENDS and add mysql to USES
where required. DBD_MYSQL will automatically set the correct DBD dependency.
In cd16748194e2 databases/p5-DBD-mysql was updated to 5.x, in 5.x the
support for MariaDB was removed and only MySQL >= 8.0 is supported.
In the 4.x releases MariaDB is still supported, according to upstream 4.x
will still be supported for a while [1], so use that for now when we detect
that MYSQL_FLAVOUR is set to mariadb. databases/p5-DBD-mysql4 was added in
d95f49cb3b54.
DBD:MariaDB would be another alternative, but migrating to it might need
more analysis than just staying with the 4.x releases of p5-DBD-mysql. This
thread on the amavis-users mailing list has a very good summary [2] from
the author of DBD:MariaDB.
This includes ideas and suggestions from vvd and mat. Thanks!
[1] https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=277889#c17
[2] https://lists.amavis.org/pipermail/amavis-users/2024-March/006823.html
PR: 275100, 277889
Reviewed by: vvd, mat
Fixes: cd16748194e2
Differential Revision: https://reviews.freebsd.org/D44662
www/rt50: Fix vulnerabilities
The following issues are addressed with these security updates:
- RT is vulnerable to unvalidated email headers in incoming email and the
mail-gateway REST interface.
This vulnerability is assigned CVE-2023-41259.
- RT is vulnerable to information leakage via response messages returned from
requests sent via the mail-gateway REST interface.
This vulnerability is assigned CVE-2023-41260.
- RT 5.0 is vulnerable to information leakage via transaction searches made by
authenticated users in the transaction query builder.
This vulnerability is assigned CVE-2023-45024.
- RT 5.0 can reveal information about data on various RT objects in errors and
other response messages to REST 2 requests.
Mk/Uses/apache.mk: Refactor after removal of older versions
apache22 and apache25 had been removed a long time ago however the
apache.mk file has never been refactored and is out of sync from the
file Mk/bsd.default-versions.mk. These changes refactors the removals of
the older versions. In addition:
- Move some keywords like USE_APACHE, USE_APACHE_BUILD, USE_APACHE_RUN
from SANITY_DEPRECATED to SANITY_UNSUPPORTED
- Remove apache versions from ports Makefiles as currently there is only
one available version in the tree. However the version checks are
still valid and should work flawlessly whenever a new version is
added. For example USES=apache:2.2+ are simply replaced with
USES=apache. As currently there are no other versions available for
test this could not be checked on it's own ground.
- Update FOO_USE=APACHE=yes to FOO_USES=apache
- Remove trailing whitespaces
Approved by: portmgr
Differential Revision: https://reviews.freebsd.org/D38113
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.
There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.
The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.
Approved by: portmgr (tcberner)
*/*: Remove redundant '-[0-9]*' from CONFLICTS_INSTALL
The conflict checks compare the patterns first against the package
names without version (as reported by "pkg query "%n"), then - if
there was no match - agsinst the full package names including the
version (as reported by "pkg query "%n-%v").
Approved by: portmgr (blanket)
www/rt50: add dependency on textproc/p5-Pod-Parse
Add dependency on textproc/p5-Pod-Parse:
RT::Shredder::POD uses Pod::Select, which is provided by
textproc/p5-Pod-Parser
While here, fix rt-test-dependencies by providing the correct path
PR: 250197
Reported by: David Siebörger
MFH: 2020Q4 (blanket: runtime fix)
www/rt50: create port
RT is a battle-tested issue tracking system which thousands of
organizations use for bug tracking, help desk ticketing, customer
service, workflow processes, change management, network operations,
youth counselling and even more. Organizations around the world have
been running smoothly thanks to RT for over 10 years.
WWW: http://www.bestpractical.com/rt/
Changelog: https://github.com/bestpractical/rt/releases/tag/rt-5.0.0