SuPHP has no upstream maintainer and thus is not actively having
bugs and security issues addressed.
Its security track record is pretty good. The worst so far has been
privilege escalation to the httpd user, which is no worse than not
using SuPHP.
It is advisable to convert your system to PHP-FPM if possible.
The port maintainer's thoughts on sandboxing PHP are here:
http://blog.shatow.net/post/2013-07-17-sandboxing-php-part1.markdown
An overview of using PHP-FPM for application sandboxing is here:
http://blog.shatow.net/post/2013-11-27-sandboxing-php-part2.markdown
Note
Size, dependencies, options and messages are those of suphp-php82.
Packages by version and architecture
latest
FreeBSD version
amd64
aarch64
i386
FreeBSD 16
✗
✗
–
FreeBSD 15
0.7.2_2
0.7.2_2
–
FreeBSD 14
0.7.2_2
0.7.2_2
0.7.2_2
quarterly (2026Q4)
FreeBSD version
amd64
aarch64
i386
FreeBSD 15
0.7.2_2
0.7.2_2
–
FreeBSD 14
0.7.2_2
0.7.2_2
0.7.2_2
version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.
Unaddressed and VuXML only (0)
No unaddressed CVE and nothing reported by pkg audit for the packaged version 0.7.2_2.
Fixed (2)
Show 2 fixed
VuXML entries whose affected range the packaged version has left.
Problem reports (0) · open in Bugzilla, most recently changed first
None.
Commits (75)
Muhammad Moinur Rahman (bofh) · 0.7.2_2
Mk/Uses/apache.mk: Refactor after removal of older versions
apache22 and apache25 had been removed a long time ago however the
apache.mk file has never been refactored and is out of sync from the
file Mk/bsd.default-versions.mk. These changes refactors the removals of
the older versions. In addition:
- Move some keywords like USE_APACHE, USE_APACHE_BUILD, USE_APACHE_RUN
from SANITY_DEPRECATED to SANITY_UNSUPPORTED
- Remove apache versions from ports Makefiles as currently there is only
one available version in the tree. However the version checks are
still valid and should work flawlessly whenever a new version is
added. For example USES=apache:2.2+ are simply replaced with
USES=apache. As currently there are no other versions available for
test this could not be checked on it's own ground.
- Update FOO_USE=APACHE=yes to FOO_USES=apache
- Remove trailing whitespaces
Approved by: portmgr
Differential Revision: https://reviews.freebsd.org/D38113
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.
There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.
The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.
Approved by: portmgr (tcberner)
- Switch to options helpers - Unsilence install commands - Fix build from plain user by creating a directory with correct permissions
Approved by: portmgr blanket
Bring back SuPHP.
Quite a few users still depend on this and are getting it from untrusted
sources. Its security track record is actually pretty good still.
SuPHP is still the simplest solution for shared hosting.
Other vendors still provide this as well.
- Add a pkg-message explaining the situation and advising users to move
away from this if possible.
- Stage
- Take maintainership
- Mark DEPRECATED as upstream is dead and has marked this EOL [1], which is not good for a port that is supposed to improve security. Suggest using nginx+php-fpm with a separate user for each site.
[1] https://lists.marsching.com/pipermail/suphp/2013-May/002554.html
- USE_APACHE= s/22+/22/ - adopt new Makefile header
Port build fails on local exp-run with apache24 with
error: 'conn_rec' has no member named 'remote_ip'
or various other apache22 specific functions/parameters
with hat apache@
- Unbroke with clang/gcc47+ by use restrictive C++ construction - Declare that code use gnu89 style - No PORTREVISION bump, users with base gcc not affected
PR: 168579
Submitted by: myself
Approved by: maintainer timeout (> 2 weeks)
Obtained from: PkgSrc repo
- fix pkg-plist if installed from port (leftover in httpd.conf) - remove MD5 from distfile
PR: ports/154754
Submitted by: myself
Approved by: maintainer timeout
-Repocopy devel/libtool15 -> libtool22 and libltdl15 -> libltdl22. -Update libtool and libltdl to 2.2.6a. -Remove devel/libtool15 and devel/libltdl15. -Fix ports build with libtool22/libltdl22. -Bump ports that depend on libltdl22 due to shared library version change. -Explain what to do update in the UPDATING.
It has been tested with GNOME2, XFCE4, KDE3, KDE4 and other many wm/desktop
and applications in the runtime.
With help: marcus and kwm
Pointyhat-exp: a few times by pav
Tested by: pgollucci, "Romain Tartière" <romain@blogreen.org>, and
a few MarcusCom CVS users. Also, I might have missed a few.
Repocopy by: marcus
Approved by: portmgr
- Update to 0.6.3, to address security holes pertaining to symlinks when running in "owner" mode (the default). http://lists.marsching.biz/pipermail/suphp/2008-March/001750.html
Security: http://lists.marsching.biz/pipermail/suphp/2008-March/001750.html
Fix for previous commit; user reported privately that Apache would print "Cannot get media type from 'x-httpd-php'" as a warning in the ErrorLog. Issue caused by incorrect AddType syntax.
This commit fixes the pkg-message syntax described, as well as the example
suphp.conf to reflect the proper type (value "application/x-httpd-php", not
"x-httpd-php").
Submitted by: <dark@aspu.ru>
Upgrade to suPHP 0.6.2. This upgrade is quite major; it introduces numerous features necessary for hosting, adds the use of a configuration file (vs. compile-time settings) for configuration details, and is presently supported by the software author.
Changes to httpd.conf are required for this to work, otherwise PHP
content is offered for download and not parsed. pkg-message contains
full migration details, but here's the simple version:
suPHP 0.5.2 suPHP 0.6.2
=========== ===========
AddType application/x-httpd-php .php AddType x-httpd-php .php
AddHandler x-httpd-php .php suPHP_AddHandler x-httpd-php
Tested on RELENG_6 and RELENG_7, using Apache 2.0 and 2.2, with the
help of the PR submitter.
Testing for Apache 1.3 was not performed, thus the port requires the
use of 2.0 or later. suPHP 0.6.2 does support Apache 1.3, but I'll
need someone running 1.3 to work with me on fixing the port to support
it, if desired.
PR: ports/116281
Submitted by: Vladimir Korkodinov <viper@perm.raid.ru>