A ports freeze means that commits will be few and far between and only by approval.

Number of commits found: 44

- retire www/apache2

- Update to 2.0.55

- Remove useless APR_FROM_PORTS check in post-install
- Add support for modular sbin/envvars
  You can now put your own scripts you want to execute at envvars
  stage in ${PREFIX}/etc/apache2/envvars.d
  Only script ending by *.env are run.

  Example:
        /usr/local/etc/apache2/envvars.d/mod_python3.env

Discussed with: perky on -apache@

- Remove installation of unused highperformance*.conf
- Move examples config files to ${EXAMPLESDIR}
- Relax permissions on ${PREFIX}/www instead of ${PREFIX}/www/data

- As discussed on apache@, don't create httpd.conf.bak, and remove stalled
  httpd.conf.bak file at deinstall time.

- Remove WITH_APR_FROM_PORTS knob
- Add a note to UPDATING, to warn users they won't be able to build apache2
  if they keep apr 0.9.x

Discussed with: Craig Rodrigues (apr maintainer), kuriyama

- Update to 2.0.52
- Use "PORTDOCS= #" and get rid of docs entry in plist.
- Support for FreeBSD 6 in apr
- Move of cache modules from THREADS to EXPERIMENTAL category and make
  sure we enable THREADS modules (cgid only) when a threaded MPM is
  selected.
- Resurect WITH_EXTRA_MODULES knob
- powerlogo.gif is now hosted by FreeBSD mirrors
- WITH_<category> is definitively no longer supported.
- Add Includes dir when installed via a package [1]

PR:             ports/72309 [1]
Submitted by:   Christian Kratzer <ck at cksoft dot de> [1]

- Bump PORTREVISION for all previous changes
- Allow access to /home if mod_userdir is loaded
- We don't need apache2libs.sh if apr is installed from ports.
- Add recent changes to UPGRADING

- Add ldconfig -m to apache2's apr libs (install time and boot time)

Requested by, discussed with: lev

apache2 NG patch 1/5.

o Changes in httpd.conf
  - mod_userdir:
        . set Userdir if mod_userdir is loaded [1]
        . Userdir is denied for users from /etc/ftpusers
  - set more "secure" permissions.
    By default, policy is to deny access to filesystem.
    You HAVE to _ENABLE_ access to your filesystem in httpd.conf.
  - Add an "Includes" directory to ${PREFIX}/etc/apache2/
    to make configuration more flexible
    ${PREFIX}/etc/apache2/*.conf files are now automatically loaded.

o apache.sh
  - be closer to apachectl, apache.sh need envvars [2]
    It should restore subversion behavior.

Partially submitted by:
                kuriyama [1],
                Gregory (Grisha) Trubetskoy <grisha at apache dot org> [2]

Future changes are mostly written, they should be committed during the
week-end.
If you're interrested in changes, feel free contact me.

- remove from plist reference to share/nls/en_US.US-ASCII
  and share/nls/POSIX

Noticed by:     thierry

- Make configure script define DEFAULT_SCOREBOARD.
- Add NOTICE file to respect Apache 2.0 license

- Update to 2.0.50
  Important changes:
  *) SECURITY: CAN-2004-0493 (cve.mitre.org)
     Close a denial of service vulnerability identified by Georgi
     Guninski which could lead to memory exhaustion with certain
     input data.  [Jeff Trawick]
  *) SECURITY: CAN-2004-0488 (cve.mitre.org)
     mod_ssl: Fix a buffer overflow in the FakeBasicAuth code for a
     (trusted) client certificate subject DN which exceeds 6K in length.
     [Joe Orton]
  Details can be found here:
        http://www.apache.org/dist/httpd/CHANGES_2.0
- Use autoconf 2.59
- Add add SUEXEC_LOGFILE tunable to set suexec logfile [1]
- Silently ignore removal of libexec/apache2 directory

(Only the first 15 lines of the commit message are shown above )

Don't remove www/ now that it is created by the system.

-1- make show-options readable from a vt100 ;-)
-2- add WITH_DEBUG knob (supports DEBUG_FLAGS)
-3- convert start script to RCng [1]
    - add possibility to run limits(1) before apache starts
    - apache2.sh reload = apachectl graceful
-4- Add threadpool MPM
-5- Adapt COMMENT to fit MPM.
-6- Bump PORTREVISION

PR:             ports/66955 [1]
Submitted by:   nork [1] (partially)
Requested by:   ume [1]

- Fix plist after upgrading libtool to 1.5

Notice by:       Fritz Heinrichmeyer <fritz.heinrichmeyer@fernuni-hagen.de>

Update to 2.0.49

Full ChangeLogand announcement:
http://www.apache.org/dist/httpd/Announcement2.html

Port changes:
- buildconf patches improvement
- Fix typo [1]

PR:             64297 [1]
Submitted by:   TSUMAI Yasuyuki <ral@ta-ko.jp> [1]

- Improve apr from ports support.
  Thanks a lot to kuriyama.

Submitted by:   kuriyama

- fix LDAP deps (typo) [1]
- fix nasty typo in DBM code (missing + in LIB_DEPENDS=)
- remove NO_{ERROR;WWWDATE;CGI;ICONS;WWW} and utilize WITHOUT_WWW and
  WITH_CUSTOM_WWW [2]
- HTTP_PORT => WITH_HTTP_PORT and IPV6_ONLY => WITH_IPV6_ONLY [3]
- add support for FreeBSD libc db [4]
- add db41 support [5]
- more typos and a few things...

Notified by:    Oliver Eikemeier <eikemeier@fillmore-labs.com> [1]
Discussed with: Oliver Eikemeier <eikemeier@fillmore-labs.com> [2] [3]
Requested by:   Fritz Heinrichmeyer <fritz.heinrichmeyer@fernuni-hagen.de> [4]
Submitted by:   <swp@uni-altai.ru> [5]

PR:             58739
Submitted by:   Clement Laforet <sheepkiller@cultdeadsheep.org>

Update to 2.0.48, which has corrections for two security bugs:
- CAN-2003-0789:  information leak in mod_cgid
<URL:http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0789>
- CAN-2003-0542:  buffer overflow in mod_alias and mod_rewrite
<URL:http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0542>

Use a DIST_SUBDIR.  Use the DOCSDIR macro.

Add options: HTTP_PORT, IPV6_V6ONLY, NO_CGI, NO_ERROR, NO_ICONS,
NO_WWW, NO_WWWDATA, WITHOUT_AUTH, WITHOUT_DAV, WITHOUT_MODULES,
WITHOUT_MODULES, WITHOUT_PROXY, WITH_ALL_STATIC_APACHE, WITH_BERKELEYDB,
WITH_CUSTOM_AUTH, WITH_CUSTOM_PROXY, WITH_DBM, WITH_EXTRA_MODULES,
WITH_MODULES, WITH_MPM, WITH_STATIC_APACHE, WITH_STATIC_MODULES and
WITH_STATIC_SUPPORT

PR:             58654
Submitted by:   Clement Laforet (maintainer)

Add forgotten file to plist.

PR:             58211
Submitted by:   Dimitry Andric <dimitry@andric.com>
Approved by:    maintainer

Update 2.0.46 --> 2.0.47

Approved by:    MAINTAINER (dominic.marks@btinternet.com)
Notified by:    striker@apache.org on announce@apache.org

Add a new knob WITH_LDAP that brings mod_auth_ldap and mod_ldap.

Submitted by:   Jean-Baptiste Quenot <jb.quenot@caraldi.com>
Requested by:   Moti Levy <moti@flncs.com>,
                Milan Andric <mandric@eecs.berkeley.edu>,

[SECURITY FIX]
Update to 2.0.46

See vulnerability details at:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0245
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0189

PR:             52768 [1]
Submitted by:   Xin Li <delphij@freebsdchina.org> [1],
                Miguel Mendez <flynn@energyhq.es.eu.org>,
                Trevor Johnson <trevor@FreeBSD.org>,
                Mark Gooderum <mark@verniernetworks.com>,
                John Walsh <zed@maths.tcd.ie>

Update to 2.0.45. This update fixes a DDOS vulnerability.

PR:             50564 [1]
Submitted by:   Cy Schubert <cy@FreeBSD.org>, delphij@hotmail.com [1]
Requested by:   many

Update to 2.0.44

New knob IPV6_V6ONLY=yes disables accepting v4 connection via v4-mapped
v6 socket.

Move bin/ap[ru]-config to lib/apache2/ to coexist with devel/apr-devel
Bumped PORTREVISION accordingly.

PR:             ports/39091
Submitted by:   Marc Recht <marc@informatik.uni-bremen.de>

o Change installbuilddir to $PREFIX/share/apache2/build to make porting
  3rd party modules easy. [1]
o Include <limits.h> before <sys/syslimits.h> to reduce warnings on -CURRENT

PR:             44104 [1]
Submitted by:   Clement Laforet <sheepkiller@cultdeadsheep.org> [1]

Update to apache 1.3.27 and 2.0.43.  This fixes a security vulnerability.
Mark apache13-ssl FORBIDDEN because the new version does not yet exist.

Partially based on patches submitted by below authors.

Submitted by:   "Sergey A. Osokin" <osa@freebsd.org.ru>,
                Udo Schweigert <udo.schweigert@siemens.com>,
                Lev A. Serebryakov <lev@serebryakov.spb.ru>
PR:             ports/43682, ports/43688, ports/43666, ports/43681

Update to 2.0.42

Approved by:    will (portmgr)

Update to 2.0.40

- Add a small hack for worker MPM [1]
  (worker MPM with this hack seems to work without visible problems.
   and still requires -DFORCE_THREADING_MPM to build for worker MPM.)
- Fix plist for worker MPM
- Comment out fancy modules from default httpd.conf

Tested on:      ref5.freebsd.org, several 4-stable machines [1]

o Install mod_deflate by default
o Add mod_bucketeer and mod_optional_* modules to WITH_EXPERIMENTAL modules
o Bump port revision

PR:             40529
Submitted by:   Lawrence Ho <lawrenceho@fastmail.fm>

o Fix the htpasswd logic bug around -c and -n options
o Take away WITH_BUNDLED_EXPAT option (use textproc/expat2)
o Bump PORTREVISION

Prompted by:    Jon Noack <noackjr@rice.edu> (htpasswd)
Obtained from:  Apache Project's CVS (htpasswd)

- Sync www/apache13's change (.default -> -dist)
- Change default to WITH_BULDLED_EXPAT
- Reorder .if .endif blocks (.if WITH_MPM must appear earlier than .if
WITHOUT_CACHE)
- Some minor style fixes
- Bump PORTREVISION

PR:             ports/39635
Submitted by:   maintainer

- Update to 2.0.39, the emergency security update.
- Unmark FORBIDDEN

PR:             ports/39477
Submitted by:   maintainer

- Better WITH_SUEXEC support
- Build with textproc/expat2 unless defined(WITH_BUNDLED_EXPAT)

PR:             38552
Submitted by:   maintainer

1.  Upgrade 2.0.35 --> 2.0.36

2.  Port printed message to "pw userdel www" if port removed permanently.
    However master.passwd 1.25.2.5 has user www by default, so this is no
    longer correct advice.  Removed pkg-deinstall to correct this.

PR:             37849 and 36907
Approved by:    MAINTAINER:  Hye-Shik Chang <perky@fallin.lv>

Respect $DESTDIR for all paths

PR:             37211
Submitted by:   maintainer

Update to 2.0.35 (first GA release!)

PR:             36834
Submitted by:   maintainer

Update to 2.0.32

PR:             36040
Submitted by:   maintainer

PLIST cleanup.    

Update to 2.0.28    

Bring in Apache 2.0.16-beta.  Just in time for the release...    

Number of commits found: 44

14 vulnerabilities affecting 30 ports have been reported in the past 14 days

^* - modified, not new

All vulnerabilities