All people using mod_rewrite are strongly encouraged to update.
An off-by-one flaw exists in the Rewrite module, mod_rewrite.
Depending on the manner in which Apache httpd was compiled, this
software defect may result in a vulnerability which, in combination
with certain types of Rewrite rules in the web server configuration
files, could be triggered remotely. For vulnerable builds, the nature
of the vulnerability can be denial of service (crashing of web server
processes) or potentially allow arbitrary code execution.
This issue has been rated as having important security impact
by the Apache HTTP Server Security Team
Updates to latest versions will follow soon.
Notified by: so@ (simon)
Obtained from: Apache Security Team
Security: CVE-2006-3747
We have not checked for this KEYWORD for a long time now, so this
is a complete noop, and thus no PORTREVISION bump. Removing it at
this point is mostly for pedantic reasons, and partly to avoid
perpetuating this anachronism by copy and paste to future scripts.
mod_ssl: Fix a possible crash during access control checks if a
non-SSL request is processed for an SSL vhost (such as the
"HTTP request received on SSL port" error message when an 400
ErrorDocument is configured, or if using "SSLEngine optional").
[1]
- reintroduce support of multiple instances of apache in startup
script [2]
- Add configtest command to apache22.sh [2]
- rewrite detection of accf_http filter to make it works on all
supported branches.
- fix rcorder [3]
- fix startup at boot time when profiles are used [4]
Spotted by: simon [1], flz[3]
Submitted by: Jarrod Sayers <jarrod@netleader.com.au> [2],
Joe Horn <joehorn@mi.chu.edu.tw> [4]
PR: ports/91154 [2], ports/90708 [4]
- Add apache22_http_accept_enable to load accf_http kernel module [2]
Additionnally, if it's not defined, we drop accept filter support
- Drop obsolete apache22ssl_enable rc.conf option
- Sync apache22.sh behavior with apachectl
Add graceful and graceful-stop targets
- Rework categories (add CACHE_MODULES)
- Add support for apr_dbd: MySQL, PostgrSQL and SQLite3 backends are supported
It adds mod_auth_dbd and mod_dbd automatically
more fixes to come soon...
PR: ports/90309 [1],
ports/90103 [2]
Submitted by: Simun Mikecin <sime@data.home.hr> [1],
Melvyn Sopacua <melvyn@melvyn.homeunix.net> [2]
mod_imap: Escape untrusted referer header before outputting in HTML
to avoid potential cross-site scripting. Change also made to
ap_escape_html so we escape quotes. Reported by JPCERT.
[Mark Cox]
Reported by: simon
- workaround apr detection. Now apache22 build his own apr, even if apr
is installed, unless you define WITH_APR_FROM_PORTS.
Reported by: pointyhat via kris [1]
It's a temporary layout, I need more time to find the best.
note that ${PREFIX}/www/(data|errors|cgi)(-dist) disappeared in favor of
${PREFIX}/www/apache22
- Use apache{2,21}flags variable in apache{2,21}_checkconfig().
It fixes restart when apache2ssl_enable is set to YES in rc.conf
and httpd.conf is "old" (i.e. non -DSSL safe) [1]
o Makefile
- split post-install target to add install-startup-script:
User can now upgrade startup script without reinstalling apache2.
NOTE: this is NOT package-safe and NOT supported, even if in most of
cases they're no risk.
Noticed by: many [1]
dist config files installed in ${PREFIX}/etc/apache21
- Add support for Event MPM and add backport from apr to support
APR_POLLSET_THREADSAFE (needed by Event MPM and forgotten @ release
time) [1]
- misc cleanups
- Bump PORTREVISION to reflect all cool changes which occured today ;)
Obtained from: apr svn repository
3rd party modules easy. [1]
o Include <limits.h> before <sys/syslimits.h> to reduce warnings on -CURRENT
PR: 44104 [1]
Submitted by: Clement Laforet <sheepkiller@cultdeadsheep.org> [1]
Mark apache13-ssl FORBIDDEN because the new version does not yet exist.
Partially based on patches submitted by below authors.
Submitted by: "Sergey A. Osokin" <osa@freebsd.org.ru>,
Udo Schweigert <udo.schweigert@siemens.com>,
Lev A. Serebryakov <lev@serebryakov.spb.ru>
PR: ports/43682, ports/43688, ports/43666, ports/43681
(worker MPM with this hack seems to work without visible problems.
and still requires -DFORCE_THREADING_MPM to build for worker MPM.)
- Fix plist for worker MPM
- Comment out fancy modules from default httpd.conf
Tested on: ref5.freebsd.org, several 4-stable machines [1]
2. Port printed message to "pw userdel www" if port removed permanently.
However master.passwd 1.25.2.5 has user www by default, so this is no
longer correct advice. Removed pkg-deinstall to correct this.
PR: 37849 and 36907
Approved by: MAINTAINER: Hye-Shik Chang <perky@fallin.lv>
