summaryrefslogtreecommitdiffstats
path: root/meta-webserver
Commit message (Collapse)AuthorAgeFilesLines
* phpmyadmin: CVE-2015-8669Liu Jian2016-02-212-1/+21
| | | | | | | | | | | | | libraries/config/messages.inc.php in phpMyAdmin 4.0.x before 4.0.10.12, 4.4.x before 4.4.15.2, and 4.5.x before 4.5.3.1 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message. This patch is from https://github.com/phpmyadmin/phpmyadmin/commit/c4d649325b25139d7c097e56e2e46cc7187fae45 Signed-off-by: Jian Liu <jian.liu@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* phpmyadmin: fix CVE-2015-7873Wenzong Fan2015-12-202-0/+49
| | | | | | | | | | | | | The redirection feature in url.php in phpMyAdmin 4.4.x before 4.4.15.1 and 4.5.x before 4.5.1 allows remote attackers to spoof content via the url parameter. Backport upstream commit to fix it: https://github.com/phpmyadmin/phpmyadmin/commit/cd097656758f981f80fb9029c7d6b4294582b706 Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* apache2: fix host-user-contaminated warningsKai Kang2015-12-201-0/+2
| | | | | | | | | | | | | | It shows warnings when build apache2 such as: | WARNING: QA Issue: apache2: /apache2-dev/usr/share/apache2/icons/small/movie.gif | is owned by uid 1785, which is the same as the user running bitbake. | This may be due to host contamination [host-user-contaminated] Set the owner and group to root to fix it. Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* phpmyadmin: exclude bash dependency with SIGGEN_EXCLUDE_SAFE_RECIPE_DEPSMartin Jansa2015-11-161-0/+4
| | | | | | | | | | | | | | * see: http://lists.openembedded.org/pipermail/openembedded-devel/2015-September/103271.html * fixes: ERROR: phpmyadmin different signature for task do_package_write_ipk.sigdata between qemux86copy and qemuarm runtaskdeps changed from ['bashbash_4.3.30.bb.do_packagedata', 'opkg-utilsopkg-utils_git.bb.do_populate_sysroot:virtual:native', 'phpmyadminphpmyadmin_4.4.9.bb.do_package', 'phpmyadminphpmyadmin_4.4.9.bb.do_packagedata', 'pseudopseudo_1.7.4.bb.do_populate_sysroot:virtual:native'] to ['bashbash_4.3.30.bb.do_packagedata', 'opkg-utilsopkg-utils_git.bb.do_populate_sysroot:virtual:native', 'phpmyadminphpmyadmin_4.4.9.bb.do_package', 'phpmyadminphpmyadmin_4.4.9.bb.do_packagedata', 'pseudopseudo_1.7.4.bb.do_populate_sysroot:virtual:native'] openembedded-core/meta/recipes-extended/bash/bash_4.3.30.bb.do_packagedata with hash c08b791d0f860a835a911f5a4c9a32d9 changed to openembedded-core/meta/recipes-extended/bash/bash_4.3.30.bb.do_packagedata with hash 91674ffdfc796e4ab503093d2c8379da Hash for dependent task bashbash_4.3.30.bb.do_packagedata changed from c08b791d0f860a835a911f5a4c9a32d9 to 91674ffdfc796e4ab503093d2c8379da Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* README: update maintainers list for jethroArmin Kuster2015-11-111-5/+7
| | | | | Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* nginx: Fix systemd service fileAmarnath Valluri2015-11-112-1/+2
| | | | | | | systemd service file expects full path of the executatbles. Signed-off-by: Amarnath Valluri <amarnath.valluri@intel.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* nginx: Add support for altering build configurationAmarnath Valluri2015-11-111-1/+4
| | | | | | | | Passing EXTRA_OECONF to ./configure, this allows to alter build configure Signed-off-by: Amarnath Valluri <amarnath.valluri@intel.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* apache2: fix config_vars.mk path contaminationGeorge McCollister2015-11-021-0/+4
| | | | | | | | Replace contaminated paths with staging paths so apxs can be successfully used in other recipes to build modules when host and target arch differ. Signed-off-by: George McCollister <george.mccollister@gmail.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* webmin: remove perl-module-sdbm from RDEPENDSQi.Chen@windriver.com2015-10-231-1/+1
| | | | | | | | | | Remove 'perl-module-sdbm' from RDEPENDS as perl don't build out this module. This also fixes the following warning. WARNING: QA Issue: webmin rdepends on perl-module-sdbm, but it isn't a build dependency? [build-deps] Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* phpmyadmin: 4.4.9 -> 4.5.0.2Kai Kang2015-10-231-4/+5
| | | | | | | | | | | | | | | | Upgrade phpmyadmin from 4.4.9 to 4.5.0.2 and SRC_URI is updated. Accoring to release note, there is NO API changes for 4.5.0.x serial. So upgrade to 4.5.0.2 rather than 4.4.15 which will only support for security fixes only. And license file has some text update. See: https://github.com/phpmyadmin/phpmyadmin/commit/9d080a482fae73bde5049620088d4687da245163 Change files owner to fix [host-user-contaminated] warnings. Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* nginx: update to 1.9.5Jens Rehsack2015-10-232-11/+12
| | | | Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* nginx: fix broken proxy_pass featureJens Rehsack2015-10-231-0/+3
| | | | | | | | | | | | | [NGINX ticket #748 - https://trac.nginx.org/nginx/ticket/748] Accoriding to #748 or https://github.com/archlinuxarm/PKGBUILDs/issues/1161, respectively, proxy_pass is broken on some architectures without position independent code. The solution is adding -fPIE -pie as build flags. Signed-off-by: Jens Rehsack <sno@netbsd.org> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* webmin: fix QA host-user-contaminatedAnders Darander2015-10-231-1/+4
| | | | | | | | | | | | | | Due to the way most files were installed, using cp ..., during packaging we got spammed with messages like: WARNING: QA Issue: webmin: /webmin-module-fail2ban/usr/lib/webmin/webmin/fail2ban/lang/no is owned by gid 100, which is the same as the user running bitbake. This may be due to host contamination [host-user-contaminated] WARNING: QA Issue: webmin: /webmin-module-system-status/usr/lib/webmin/webmin/system-status/lang/no is owned by gid 100, which is the same as the user running bitbake. This may be due to host contamination [host-user-contaminated] Do the install in a similar way as is done in bin_package.bbclass. By doing that, we're not getting any QA-errors from host-user-contaminated. Signed-off-by: Anders Darander <anders@chargestorm.se> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* apache2: cleanup buildpaths for target stuffsWenzong Fan2015-10-131-0/+9
| | | | | | | | | | | | | | | Those buildpaths were generated from configure substitutions, they are required for cross-compiling, but obviously they should be cleaned up from target stuffs. Cleanup buildpaths from config_vars.mk and config.nice: * remove ${STAGING_DIR_HOST} from CC, CFLAGS ... * set APU_INCLUDEDIR, APU_CONFIG as empty * remove buildpath from configure line Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* apache2: wait for server to start/stop/restartAdam Chappell2015-08-311-4/+161
| | | | | | | | | | | Change start, stop, and restart functions in apache2 init script to return only after completion (i.e. the server has started/stopped, not just received a kill signal). Starting and stopping the server in quick sucession results in an error because the server will attempt to stop before it has had time to start and vice versa. Signed-off-by: Adam Chappell <adam.chappell@ni.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* apache: upgrade to 2.4.16Roy Li2015-08-243-63/+4
| | | | | | | | 2.4.16 includes fixes for CVE-2015-3185, CVE-2015-0253 and CVE-2015-3183 remove a backport patch 0001-SECURITY-CVE-2015-0228-cve.mitre.org.patch Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* hiawatha: fix the installation failure due to no /var/run dirRoy Li2015-08-181-1/+0
| | | | | | | | after cmake is upgrade to 3.2.2, the /var/run dir is not created, so not need to remove it. Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* apache2: fix build warning.Armin Kuster2015-07-161-0/+1
| | | | | | | WARNING: QA Issue: /usr/bin/apxs_apache2-dev contained in package apache2-dev requires /usr/bin/perl, but no providers found in its RDEPENDS [file-rdeps] Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* phpmyadmin: upgrade 4.4.9Roy Li2015-06-231-2/+2
| | | | | | | | | upgrade to include CVE fixes: CVE-2015-3903 CVE-2015-3902 Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* webmin: upgrade to 1.750Roy Li2015-06-082-3/+3
| | | | | | | | | 1. Upgrade to fix the CVE: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1377 2. update the patch remove-startup-option.patch Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* nginx: Add suport for systemdAlejandro Hernandez2015-05-222-1/+24
| | | | | | | Adds support for systemd, creates a service for nginx and installs it if required Signed-off-by: Alejandro Hernandez <alejandro.hernandez@linux.intel.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* apache2: upgrade to 2.4.12Roy Li2015-05-135-321/+98
| | | | | | | | | Remove apache-CVE-2014-0117.patch which apache2 2.4.12 has it Update the apache-ssl-ltmain-rpath.patch Backport the patch to fix CVE-2015-0228 Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* phpmyadmin: upgrade to 4.4.4Roy Li2015-05-111-2/+2
| | | | | Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* spawn-fcgi: add initial recipeAndre McCurdy2015-03-212-0/+51
| | | | | Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* Monkey: new v1.5.6 release.Eduardo Silva2015-03-061-3/+3
| | | | | | | | | | | | | | | | | This patch add the new Monkey HTTP Server v1.5.6. For more details about software changes please visit: http://monkey-project.com/Announcements/v1.5.6 === Build Tests == This version have been tested on Yocto/Dizzy based on RPM. monkey-yocto/5aee7684cd66f78fb51f78138603a4dde4ef2484 Signed-off-by: Eduardo Silva <eduardo@monkey.io> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* cherokee: add PACKAGECONFIG for geoipRobert Yang2015-02-121-0/+1
| | | | | | | | Fixed: cherokee/rule_geoip.h:34:19: fatal error: GeoIP.h: No such file or directory Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* apache2: fix a typosRoy Li2015-01-281-1/+1
| | | | | | | | | fix a typos to remove a warning: systemd[1]: [/lib/systemd/system/apache2.service:2] Unknown lvalue 'Decription' in section 'Unit' Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* phpmyadmin: update to 4.3.4Paul Eggleton2015-01-084-106/+2
| | | | | | Drop patches merged upstream. Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
* xdebug: update to 2.2.6Paul Eggleton2015-01-081-2/+2
| | | | Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
* xdebug: fix DEPENDS and un-blacklistPaul Eggleton2015-01-081-3/+1
| | | | | | Now we use a single php recipe there is no conflict. Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
* README: update for modphp merging into phpPaul Eggleton2015-01-081-1/+15
| | | | Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
* modphp: removePaul Eggleton2015-01-089-594/+0
| | | | | | This is now built out of the standard php recipe. Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
* phpmyadmin: don't install patchesWenzong Fan2014-12-191-0/+2
| | | | | | | Don't install local patch files to target. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* PNBLACKLIST: use weak assignmentsMartin Jansa2014-12-172-2/+2
| | | | | | | * this makes it easier to unblacklist it from local.conf which is parsed before the recipes Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* apache2: add PACKAGECONFIG for selinuxWenzong Fan2014-12-092-0/+44
| | | | | | | | | | Add PACKAGECONFIG for 'selinux', otherwise there would be warnings like below: WARN: apache2: apache2 rdepends on libselinux, but it isn't a build dependency? Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* webmin: remove init script for gentooChong.Lu@windriver.com2014-10-311-0/+1
| | | | | | | | | | The configure.initd.gentoo script is used for gentoo, it is invalid for oe. So remove it to solve the following warning: webmin-1.700: webmin-module-ajaxterm requires /sbin/runscript, but no providers in its RDEPENDS [file-rdeps] Signed-off-by: Chong Lu <Chong.Lu@windriver.com>
* phpmyadmin: fix for Security Advisory CVE-2014-7217Roy Li2014-10-312-0/+30
| | | | | | | | | | | | | Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.4, 4.1.x before 4.1.14.5, and 4.2.x before 4.2.9.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted ENUM value that is improperly handled during rendering of the (1) table search or (2) table structure page, related to libraries/TableSearch.class.php and libraries/Util.class.php. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7217 Signed-off-by: Roy Li <rongqing.li@windriver.com>
* phpmyadmin: fix for Security Advisory CVE-2014-5274Roy Li2014-10-312-0/+44
| | | | | | | | | | | Cross-site scripting (XSS) vulnerability in the view operations page in phpMyAdmin 4.1.x before 4.1.14.3 and 4.2.x before 4.2.7.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted view name, related to js/functions.js. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-5274 Signed-off-by: Roy Li <rongqing.li@windriver.com>
* phpmyadmin: fix for Security Advisory CVE-2014-5273Roy Li2014-10-312-0/+30
| | | | | | | | | | | | | | Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.2, 4.1.x before 4.1.14.3, and 4.2.x before 4.2.7.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) browse table page, related to js/sql.js; (2) ENUM editor page, related to js/functions.js; (3) monitor page, related to js/server_status_monitor.js; (4) query charts page, related to js/tbl_chart.js; or (5) table relations page, related to libraries/tbl_relation.lib.php. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-5273 Signed-off-by: Roy Li <rongqing.li@windriver.com>
* apache: add fix for CVE-2014-0117 Security AdvisoryKang Kai2014-10-312-1/+292
| | | | | | | | | | | | | | | | The patch comes from upstream: http://svn.apache.org/viewvc?view=revision&revision=1610674 SECURITY (CVE-2014-0117): Fix a crash in mod_proxy. In a reverse proxy configuration, a remote attacker could send a carefully crafted request which could crash a server process, resulting in denial of service. Thanks to Marek Kroemeke working with HP's Zero Day Initiative for reporting this issue. Submitted by: Edward Lu, breser, covener Signed-off-by: Zhang Xiao <xiao.zhang@windriver.com> Signed-off-by: Kai Kang <kai.kang@windriver.com>
* modphp: Security Advisory - php - CVE-2014-3597Yue Tao2014-10-302-0/+283
| | | | | | | | | | | | | | Multiple buffer overflows in the php_parserr function in ext/standard/dns.c in PHP before 5.4.32 and 5.5.x before 5.5.16 allow remote DNS servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted DNS record, related to the dns_get_record function and the dn_expand function. NOTE: this issue exists because of an incomplete fix for CVE-2014-4049. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3597 Signed-off-by: Yue Tao <Yue.Tao@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* modphp: Security Advisory - php - CVE-2014-3587Yue Tao2014-10-302-0/+32
| | | | | | | | | | | | | Integer overflow in the cdf_read_property_info function in cdf.c in file through 5.19, as used in the Fileinfo component in PHP before 5.4.32 and 5.5.x before 5.5.16, allows remote attackers to cause a denial of service (application crash) via a crafted CDF file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1571. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3587 Signed-off-by: Yue Tao <Yue.Tao@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* modphp: Security Advisory - php - CVE-2014-5120Yue Tao2014-10-302-0/+36
| | | | | | | | | | | | | gd_ctx.c in the GD component in PHP 5.4.x before 5.4.32 and 5.5.x before 5.5.16 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to overwrite arbitrary files via crafted input to an application that calls the (1) imagegd, (2) imagegd2, (3) imagegif, (4) imagejpeg, (5) imagepng, (6) imagewbmp, or (7) imagewebp function. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-5120 Signed-off-by: Yue Tao <Yue.Tao@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* modphp, xdebug: blacklist because of conflict with phpMartin Jansa2014-10-272-0/+4
| | | | Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* Monkey: new v1.5.4 release.Eduardo Silva2014-10-271-2/+2
| | | | | | | | | | | | | | | | | This patch add the new Monkey HTTP Server v1.5.4. For more details about software changes please visit: http://monkey-project.com/Announcements/v1.5.4 === Build Tests == This version have been tested on Yocto/Daisy based on RPM. monkey-yocto/a617991e40bd5c3779ad7b3689f78857d3e45248 Signed-off-by: Eduardo Silva <eduardo@monkey.io> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* modphp: using PKGCONFIG and PACKAGECONFIG for libxml and soapRoy.Li2014-10-142-2/+78
| | | | | Signed-off-by: Roy.Li <rongqing.li@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* webmin: fix hardcode of python2.3Robert Yang2014-09-262-1/+28
| | | | | | Use "/usr/bin/env python" to fix it. Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
* apache2: split apache2-scripts subpkgRobert Yang2014-09-261-2/+8
| | | | | | | | | | Split apache2-scripts subpkg to put the perl script dbmmanage, so that apache2 doesn't have to RDEPEND on perl. Add another perl script apxs to apache2-dev pkg as Olof Johansson suggested. Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
* phpmyadmin: add bash to RDEPENDS_phpmyadminRobert Yang2014-09-261-0/+1
| | | | | | | | | | | | | | | | Bashism: possible bashism in plugins/transformations/generator_plugin.sh line 16 (echo -e): echo -e "Usage: ./generator_plugin.sh MIMEType MIMESubtype TransformationName [Description]\n" possible bashism in plugins/transformations/generator_plugin.sh line 28 (${parm,[,][pat]} or ${parm^[^][pat]}): MT="${MT^}" possible bashism in plugins/transformations/generator_plugin.sh line 29 (${parm,[,][pat]} or ${parm^[^][pat]}): MS="${MS^}" possible bashism in plugins/transformations/generator_plugin.sh line 30 (${parm,[,][pat]} or ${parm^[^][pat]}): TN="${TN^}" possible bashism in plugins/transformations/generator_plugin.sh line 51 (should be 'b = a'): if [ "$4" == "--generate_only_main_class" ]; then Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
* apache2: add systemd unit fileChen Qi2014-08-272-2/+25
| | | | | | | Add systemd unit file for apache2. Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-06-17 08:32:48 +0000