Number of commits found: 92

- security update to bugzilla 3.0.9 and 4.0.6
- update russian/bugzilla3-ru template
- patch german templates so revision match and no warning is displayed
- add vuxml entry

Approved by:    skv (implicit)
Security:       https://bugzilla.mozilla.org/show_bug.cgi?id=728639
                https://bugzilla.mozilla.org/show_bug.cgi?id=745397
                CVE-2012-0465
                CVE-2012-0466

- update to 4.0.5

Vulnerability Details
=====================

Class:       Cross-Site Request Forgery
Versions:    4.0.2 to 4.0.4, 4.1.1 to 4.2rc2
Fixed In:    4.0.5, 4.2
Description: Due to a lack of validation of the enctype form
             attribute when making POST requests to xmlrpc.cgi,
             a possible CSRF vulnerability was discovered. If a user
             visits an HTML page with some malicious HTML code in it,
             an attacker could make changes to a remote Bugzilla installation
             on behalf of the victim's account by using the XML-RPC API
             on a site running mod_perl. Sites running under mod_cgi
             are not affected. Also the user would have had to be
             already logged in to the target site for the vulnerability
             to work.
References:  https://bugzilla.mozilla.org/show_bug.cgi?id=725663
CVE Number:  CVE-2012-0453

Approved by:    skv (implicit)

Update to 4.0.4

Changes:       
http://www.bugzilla.org/releases/4.0.4/release-notes.html#v40_point
Security:      
http://www.vuxml.org/freebsd/309542b5-50b9-11e1-b0d8-00151735203a.html

- update to version 3.6.7
- CVE-2011-3657
- CVE-2011-3667

Summary
=======

The following security issues have been discovered in Bugzilla:

* When viewing tabular or graphical reports as well as new charts,
  an XSS vulnerability is possible in debug mode.

* The User.offer_account_by_email WebService method lets you create
  a new user account even if the active authentication method forbids
  users to create an account.

* A CSRF vulnerability in post_bug.cgi and in attachment.cgi could
  lead to the creation of unwanted bug reports and attachments.

All affected installations are encouraged to upgrade as soon as possible.

Full Release Notes:
http://www.bugzilla.org/security/3.4.12/

Approved by:    skv@ (explicit)

Remove references to mysql 323 and 40, most commonly of the form:

IGNORE_WITH_MYSQL=     323 40

- Fix checksetup issue if p5-version>=0.92 is installed (which is in current
ports tree)
  See https://bugzilla.mozilla.org/show_bug.cgi?id=678772

PR:             ports/159823
Submitted by:   ohauer
Approved by:    skv (per mail)
Obtained from: 
https://bugzilla.mozilla.org/attachment.cgi?id=552915&action=diff

Update to 4.0.2

Changes:        http://www.bugzilla.org/releases/4.0.2/release-notes.html
Security:      
http://www.vuxml.org/freebsd/dc8741b9-c5d5-11e0-8a8e-00151735203a.html
PR:             ports/159576
Submitted by:   Peter Vereshagin <peter@vereshagin.org>

- create missing (empty) directory (bugzilla) so checksetup does not fail
- use DIST_SUBDIR for bugzilla and all translations
- sort pkg-plist (genplist)

OK from bugzilla maintainers per PM.

PR:             ports/158766
Submitted by:   ohauer

- Update to 4.0.1 [1]
- Cleanup CONFLICTS/PORTSCOUT among Makefiles and Makefile.common

Submitted by:   ohauer (via private e-mail) [1]

- Remove obsolete devel/bugzilla2
- Tune devel/bugzilla* : add PORTSCOUT, LATEST_LINK, CONFLICTS, LICENSE

- Copy devel/bugzilla to devel/bugzilla3; russian/bugzilla-ru to
russian/bugzilla3-ru
- Update devel/bugzilla, russian/bugzilla-ru to 4.0.1
- Update devel/bugzilla3, russian/bugzilla3-ru to 3.6.5

Changes:        http://www.bugzilla.org/releases/4.0.1/release-notes.html
                http://www.bugzilla.org/releases/3.6.5/release-notes.html

- bump because of mod_perl2 update
- order pkg-plist so it match autmated tools like genplist
- add missing empty directories (used by checksetup.pl) [1]

commit with hat apache@

PR:             [1] ports/154295
Submitted by:   me

Update to 3.6.4

Changes:        http://www.bugzilla.org/releases/3.6.4/release-notes.html
Security:      
http://www.vuxml.org/freebsd/c8c927e5-2891-11e0-8f26-00151735203a.html
Feature safe:   yes

- Update to 3.6.3 [1]
- Use WWWDIR instead of some other custom locations [2]
- Add Makefile.common which Makefiles in devel/bugzilla, russian/bugzilla-ru
  and japanese/bugzilla include to use WWWDIR in common [2]

Changes:        http://www.bugzilla.org/releases/3.6.3/release-notes.html [1]
Security:       http://www.bugzilla.org/security/3.2.8/ [1]
PR:     ports/151912 [1], [2]
Submitted by:   ohauer [1], tota (myself) [2]
Approved by:    skv

Explicitly depend on p5-Digest-MD5 only if PERL_LEVEL < 500703
Explicitly depend on p5-Digest-SHA only if PERL_LEVEL < 501000

Update to 3.6.2

Changes:        http://www.bugzilla.org/releases/3.6.2/release-notes.html
Security:      
http://www.vuxml.org/freebsd/8cbf4d65-af9a-11df-89b8-00151735203a.html
PR:             ports/149721
Submitted by:   ohauer

Update to 3.6.1

Changes:        http://www.bugzilla.org/releases/3.6.1/release-notes.html
Security:      
http://www.vuxml.org/freebsd/f1331504-8849-11df-89b8-00151735203a.html
PR:             ports/148149
Submitted by:   olli hauer <ohauer@gmx.de>
Feature safe:   yes

Update to 3.6

Changes:        http://www.bugzilla.org/releases/3.6/release-notes.html

- update to 1.4.1
Reviewed by:    exp8 run on pointyhat
Supported by:   miwi

- Update to 3.4.6 [1]
- Remove ja-bugzilla-2.* from CONFLICT entries of devel/bugzilla,
 devel/bugzilla2 and russian/bugzilla-ru [2]
- Change MAINTAINER address from tota@rtfm.jp to tota@FreeBSD.org

 [1] This port has been updated from the bugzilla Japanized patch to
    bugzilla Japanese language pack installation, both of which are
    maintained differently.
     * Japanized patch is not actively maintained anymore.
     * More sophisticated language pack framework has been introduced since
       Bugzilla 3.0.
 [2] This port no longer conflicts with those ports due to the new language
    pack framework.

Approved by:    maho (mentor)

Fix dependency name.

Pointed by:     QAT

Update to 3.4.6

Changes:        http://www.bugzilla.org/releases/3.4.6/release-notes.html

- update to jpeg-8

- Update to 3.4.5 [1]
- Use $SUB_FILES & $SUB_LIST to dynamically adjust pkg-message [2]

Changes:        http://www.bugzilla.org/security/3.0.10/ [1]
Security:      
http://www.vuxml.org/freebsd/696053c6-0f50-11df-a628-001517351c22.html
PR:             ports/142446 [2]
Submitted by:   Sevan Janiyan <venture37 xx geeklan.co.uk> [2]

- Remove unneeded dependencies which is in perl-5.8.9 dist
  (part 17).

Approved by:    portmgr (itetcu)

- Remove mail/p5-Email-MIME-Creator, it has been folded into mail/p5-Email-MIME
- Remove mail/p5-Email-MIME-Modifier, it has been folded into mail/p5-Email-MIME
- Remove mail/p5-Email-Simple-Creator, it has been folded into
mail/p5-Email-Simple
- Adjust dependencies

Reported by:    pointyhat
With hat:       portmgr

Update to 3.4.4.

Changes:        http://www.bugzilla.org/security/3.4.3/
Security:      
http://www.vuxml.org/freebsd/92ca92c1-d859-11de-89f9-001517351c22.html

Update to 3.4.3

Changes:        http://www.bugzilla.org/releases/3.4.3/release-notes.html
PR:             ports/140327
Submitted by:   Sahil Tandon <sahil xx tandon.net>

Update to 3.4.2.

Changes:        http://www.bugzilla.org/security/3.0.8/
Security:      
http://www.vuxml.org/freebsd/b9ec7fe3-a38a-11de-9c6b-003048818f40.html
Feature safe:   yes

Update to 3.4.1.

Changes:        http://www.bugzilla.org/security/3.4/
Security:      
http://www.vuxml.org/freebsd/d67b517d-8214-11de-88ea-001a4d49522b.html

Update to 3.4

Changes:        http://www.bugzilla.org/releases/3.4/release-notes.html

Update to 3.2.3

Changes:       
http://www.bugzilla.org/releases/3.2.3/release-notes.html#v32_point

Update to 3.2.2

Changes:        http://www.bugzilla.org/releases/3.2.2/release-notes.html
PR:             ports/131404
Submitted by:   pgollucci

Install killer feature - 'Dusk' skin.

Update to 3.2

Changes:        http://www.bugzilla.org/releases/3.2/release-notes.html
PR:             ports/129333
Submitted by:   Eygene Ryabinkin <rea-fbsd xx codelabs.ru>

Update to 3.0.6

Changes:        http://www.bugzilla.org/releases/3.0.6/release-notes.html

Update to 3.0.5

Changes:        http://www.bugzilla.org/releases/3.0.5/release-notes.html
Security:      
http://www.vuxml.org/freebsd/1d96305d-6ae6-11dd-91d5-000c29d47fd7.html

Set PORTSCOUT.

Update to 3.0.4

Changes:               
http://www.bugzilla.org/releases/3.0.4/release-notes.html#v30_point

Update to 3.0.3

Changes:       
http://www.bugzilla.org/releases/3.0.3/release-notes.html#v30_point

Update to 3.0.2

PR:             ports/116517
Submitted by:   Nick Barkas <snb xxx threerings.net>
Changes:        http://www.bugzilla.org/releases/3.0.2/release-notes.html
Security:      
http://www.vuxml.org/freebsd/f8d3689e-6770-11dc-8be8-02e0185f8d72.html

Update to 3.0.1

Changes:        http://www.bugzilla.org/releases/3.0.1/release-notes.html

* fix dependencies
* fix perl path [1]

PR:             ports/112257 [1]
Submitted by:   Christopher McCrory<chrismcc+freebsd xx pricegrabber.com> [1]

Upgrade Bugzilla to 3.0; repocopy 2.x branch to devel/bugzilla2

- Welcome X.org 7.2 \o/.
- Set X11BASE to ${LOCALBASE} for recent ${OSVERSION}.
- Bump PORTREVISION for ports intalling files in ${X11BASE}.

* update to 2.22.2
* remove EMAIL_GATEWAY option (it's by default now)
* add dependency on p5-Mail-Tools [1]

Changes:        http://www.bugzilla.org/releases/2.22.2/release-notes.html
PR:             ports/103453 [1]
Submitted by:   Cezary Morga <cezarym@data.pl> [1]

Update to 2.22.1

Changes:        http://www.bugzilla.org/releases/2.22.1/release-notes.html
PR:             ports/105554
Sumbitted by:   Ulrich Spoerlein <uspoerlein xxx gmail.com>

Change all bogus uses of BROKEN to IGNORE.  See CHANGES 20060705.

PR:             ports/92445
Hat:            portmgr

Remove redundant DEFAULT_MYSQL_VER and fix package for the future mysql
default version bump.

Update to 2.22

Changes:        http://www.bugzilla.org/releases/2.22/release-notes.html

Update Bugzilla to 2.20.1

Approved by:    portmgr (clement)
Pointed by:     mnag
Security:       http://vuxml.FreeBSD.org/46f7b598-a781-11da-906a-fde5cdde365e

Unbreak build.

BROKEN: Missing perl dependency

Update to 2.20

Update to 2.18.3, bug-fixes:

* https://bugzilla.mozilla.org/show_bug.cgi?id=293159
* https://bugzilla.mozilla.org/show_bug.cgi?id=292544

Reported by:    simon
Security:      
http://vuxml.freebsd.org/6e33f4ab-efed-11d9-8310-0001020eed82.html

* reflect renaming on CPAN File-Spec to PathTools
   + add devel/p5-PathTools, remove devel/p5-File-Spec
   + update dependencies for all affected ports (make them unconditional),
     bump PORTREVISION for these ports
module was renamed
* reflect renaming on CPAN PodParser to Pod-Parser
   + add textproc/p5-Pod-Parser, remove textproc/p5-PodParser
   + update dependencies for all affected ports (make them unconditional),
     bump PORTREVISION for these ports

* for all changed ports make dependencies on File::Temp, Digest::MD5,
  Storable unconditional

* remove 'CONFIGURE_ARGS= INSTALLDIRS=site' from Makefile's
  (this variable is forced by bsd.port.mk now)

* update Class-Autouse to 1.17

* update POE-API-Hooks to 1.05

* make portlint happy (clean IGNORE, convert spaces to tabs and so on)

Update to 2.18.1

PR:             ports/81583
Submitted by:   Choe, Cheng-Dae <whitekid at gmail.com>

* fix Data::Dumper detection
* fix pkg-message

* add OPTIONS
* use APACHE_DATADIR if defined
* fix RUN_DEPENDS
* fix pkg-plist
* update pkg-descr
* take maintainership

- Because of bugzilla's bugs. checksetup.pl doesn't check File::Spec modules
version. So disable it's version check.
(https://bugzilla.mozilla.org/show_bug.cgi?id=257933)
- fix web server's uid/gid
- fix plist that not listed

PR:             ports/76946
Submitted by:   "Choe, Cheng-Dae" <whitekid (at) gmail.com>

- Update to 2.18

PR:             ports/76531
Submitted by:   "Choe, Cheng-Dae" <whitekid@gmail.com>

- Update to 2.16.7, a security release:

Class:       Unauthorized Bug Change
Versions:    2.9 through 2.18rc2 and 2.19
Description: It is possible to send a carefully crafted HTTP POST
             message to process_bug.cgi which will remove keywords from
             a bug even if you don't have permissions to edit all bug
             fields (the "editbugs" permission).  Such changes are
             reported in "bug changed" email notifications, so they are
             easily detected and reversed if someone abuses it.
Reference:   https://bugzilla.mozilla.org/show_bug.cgi?id=252638

- Correct SQL command in pkg-message

PR:             ports/71161, ports/73166
Submitted by:   Dmitry A Grigorovich <odip@bionet.nsc.ru>

[PATCH] devel/bugzilla: update to 2.16.6

    - Update to 2.16.6

PR:             ports/69105
Submitted by:   TAKATSU Tomonari <tota@rtfm.jp>

Fix DIST_SUBDIR and make the port fetchable again.

Note that it is still vulnerable to
 
<http://www.freebsd.org/ports/portaudit/672975cb-d526-11d8-b479-02e0185c0b53.html>

BROKEN: Unfetchable

- update devel/bugzilla to 2.16.5
- new slave port japanese/bugzilla

PR:             68318, 68319
Submitted by:   TAKATSU Tomonari <tota@rtfm.jp>

Modifications to make this a master port for upcoming slave port
japanese/bugzilla.  Should have no effect otherwise.

PR:             ports/62545
Submitted by:   TAKATSU Tomonari <tota@rtfm.jp>

Remove redundant master site.

PR:             62372
Submitted by:   Tom McLaughlin

There are several security related problem in bugzilla 2.16.3 and earlier,
The bugzilla developer released a security advisory.
see: http://www.bugzilla.org/security/2.16.3/

PR:             58905
Submitted by:   Kang Liu

Use the FIND and XARGS macros introduced in bsd.port.mk 1.391.

utilize SITE_PERL

PR:             58166
Submitted by:   Cheng-Lung Sung <clsung@dragon2.net>

The devel/bugzilla port has an explicit LIB_DEPENDS dependency on
libmysqlclient.so.10 from the mysql323-client port.  However, bugzilla
will work fine with just about any version of MySQL.

Could just insert USE_MYSQL, but the bugzilla port only really needs
access to the perl DBD::Mysql modules and can depend on MySQL
implicitly through that port..

PR:             57607
Submitted by:   Matthew Seaman <m.seaman@infracaninophile.co.uk>

ECHO -> ECHO_MSG
(ECHO_CMD for deskutils/notebook)

PR:             ports/56767-56770,56772-56774,56776-56784
Submitted by:   KATO Tsuguru <tkato@prontomail.com>

Conditionalise dependencies on databases/p5-DBI: for perl
5.005_03 use databases/p5-DBI-137 as newer versions do not
support the old perl.

Note that for some port, I merely removed the explicit
dependency as they already have implicit dependencies
via other ports.

Approved by:    portmgr (marcus)

Fix a typo: s/NOPORTSDOCS/NOPORTDOCS/ for Makefile [1]
Use ${DOCSDIR} [2]
s/share\/doc\/.../%%DOCSDIR%%/ for pkg-plist [2]

PR:             53911
Submitted by:   Oliver Eikemeier <eikemeier@fillmore-labs.com> [1]
                osa [2]
Approved by:    fjoe (mentor) (implicit)

- Fix something which has been broken in this port for a long time:
  installation to ${PREFIX}/www/data.default.  "data.default" was an artifact
  of a long obsolete version of the Apache port.  Put installation directory
  under control of a variable $BUGZILLADIR instead.  Carry through to
  pkg-plist via a pragma.
- Bump $PORTREVISION.

Security update to 2.16.3.
See http://www.bugzilla.org/security/2.16.2/.

PR:             52096

Add WITH_CONTRIB knob to install contributed scripts.

Submitted by:   Alexey Neyman <alexey.neyman (at) auriga.ru>

Update to 2.16.2

PR:             47883

De-pkg-comment.

Resign from maintainership.  I don't use it anymore.

Update to 2.14.4 (one more security update)

PR:             ports/43883
Submitted by:   Jason Li <delphij@frontfree.net>

Update to 2.14.3.

Fixes broken in 2.14.2 ability to sort bug lists on more then one field
and possible security hole with contrib/bug_email.pl and
contrib/bugzilla_email_append.pl scripts.

This is bugfix release and latest release from 2.14 branch. This update
provided for 2.14 users who would like to stay with 2.14. All new users
should wait until port is updated to 2.16.

Remove leftovers (read *.bak) of REINPLACE_CMD execution.

PERL -> REINPLACE_CMD

PR:             39749
Submitted by:   Paul Marquis <pmarquis@pobox.com>

Update to 2.14.2. This is security update! Upgrade recomended!

PR:             ports/39041
Submitted by:   Paul Marquis <pmarquis@pobox.com>

* FORCED COMMIT SINCE PREVIOUS COMMIT WAS FAILED IN MIDDLE AND   * MAIL
NOTIFICATION WASN'T SEND    

Use perl expression to fix path to sendmail rather than using   plain patches
for each case.    

* reconstruct Makefile defaults to make it more package friendly   * learn
default distribution about some default FreeBSD settings   * add new option to
setup XML modules used to export/import bugs to share     them between different
Bugzilla instances   * use ${INSTALL_SCRIPT} rather than ${INSTALL}. Inspired by
petef's letter.     This also caused me to think "when such complex system as
FreeBSD ports     should do such simple things like prepearing of cap of
coffee?"    

* don't setup README.docs. It's developers resource.   * use ${INSTALL} directly
instead of ${INSTALL_DATA} to preserve     exec permissions for scripts   * add
post-install target to display pkg-message   * rewrite pkg-message to give
minimal quick setup instructions    

Use two colons after "pre-everything" target    

Add bugzilla 2.14, bug-tracking system developed by Mozilla Project    

Number of commits found: 92

12 vulnerabilities affecting 17 ports have been reported in the past 14 days

^* - modified, not new

All vulnerabilities