CVS commit: pkgsrc

["Emmanuel Dreyfus" <manu%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   manu
Date:           Tue Nov  9 01:50:45 UTC 2021

Modified Files:
        pkgsrc/doc: CHANGES-2021
        pkgsrc/www/ap2-auth-mellon: Makefile distinfo

Log Message:
Updated www/ap2-auth-mellon to 0.18.0

Change sine 0.17 from NEWS file:

Version 0.18.0
---------------------------------------------------------------------------

Security fixes:

* [CVE-2019-13038] Redirect URL validation bypass

  Version 0.17.0 and older of mod_auth_mellon allows the redirect URL
  validation to be bypassed by specifying an URL formatted as
  "///fishing-site.example.com/logout.html". In this case, the browser
  would interpret the URL differently than the APR parsing utility
  mellon uses and redirect to fishing-site.example.com.
  This could be reproduced with:
     https://rp.example.co.jp/mellon/logout?ReturnTo=///fishing-site.example.com
/logout.html

  This version fixes that issue by rejecting all URLs that start with "///".

Enhancements:

* A new option MellonSessionIdleTimeout that represents the amount of time
  a user can be inactive before the user's session times out in seconds.

Bug fixes:

* Several build-time fixes

* The CookieTest SameSite attribute was only set to None if mellon configure
  option MellonCookieSameSite was set to something other than default.
  This is now fixed.


To generate a diff of this commit:
cvs rdiff -u -r1.5496 -r1.5497 pkgsrc/doc/CHANGES-2021
cvs rdiff -u -r1.65 -r1.66 pkgsrc/www/ap2-auth-mellon/Makefile
cvs rdiff -u -r1.23 -r1.24 pkgsrc/www/ap2-auth-mellon/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/doc/CHANGES-2021
diff -u pkgsrc/doc/CHANGES-2021:1.5496 pkgsrc/doc/CHANGES-2021:1.5497
--- pkgsrc/doc/CHANGES-2021:1.5496      Tue Nov  9 01:40:14 2021
+++ pkgsrc/doc/CHANGES-2021     Tue Nov  9 01:50:45 2021
@@ -1,4 +1,4 @@
-$NetBSD: CHANGES-2021,v 1.5496 2021/11/09 01:40:14 manu Exp $
+$NetBSD: CHANGES-2021,v 1.5497 2021/11/09 01:50:45 manu Exp $
 
 Changes to the packages collection and infrastructure in 2021:
 
@@ -8307,3 +8307,4 @@ Changes to the packages collection and i
        Updated devel/py-curtsies to 0.3.10 [adam 2021-11-08]
        Updated devel/bpython to 0.22 [adam 2021-11-08]
        Updated net/nagios-plugin-dotpid to 0.6 [manu 2021-11-09]
+       Updated www/ap2-auth-mellon to 0.18.0 [manu 2021-11-09]

Index: pkgsrc/www/ap2-auth-mellon/Makefile
diff -u pkgsrc/www/ap2-auth-mellon/Makefile:1.65 pkgsrc/www/ap2-auth-mellon/Makefile:1.66
--- pkgsrc/www/ap2-auth-mellon/Makefile:1.65    Wed Sep 29 19:01:25 2021
+++ pkgsrc/www/ap2-auth-mellon/Makefile Tue Nov  9 01:50:45 2021
@@ -1,13 +1,14 @@
-# $NetBSD: Makefile,v 1.65 2021/09/29 19:01:25 adam Exp $
+# $NetBSD: Makefile,v 1.66 2021/11/09 01:50:45 manu Exp $
 
-DISTNAME=      mod_auth_mellon-0.17.0
+DISTNAME=      mod_auth_mellon-0.18.0
 PKGNAME=       ${APACHE_PKG_PREFIX}-${DISTNAME:S/mod_//:S/_/-/g}
 PKGREVISION=   1
 #PKGREVISION=  1
 CATEGORIES=    www security
 MASTER_SITES=  ${MASTER_SITE_GITHUB:=latchset/}
 GITHUB_PROJECT=        mod_auth_mellon
-GITHUB_RELEASE=        v${PKGVERSION_NOREV}
+GITHUB_TAG=    refs/tags/v${PKGVERSION_NOREV}
+WRKSRC=                ${WRKDIR}/${DISTNAME}
 
 MAINTAINER=    manu%NetBSD.org@localhost
 HOMEPAGE=      https://github.com/latchset/mod_auth_mellon
@@ -16,7 +17,7 @@ LICENSE=      gnu-gpl-v2 # or later
 
 GNU_CONFIGURE= YES
 USE_LIBTOOL=   YES
-USE_TOOLS+=    pkg-config
+USE_TOOLS+=    pkg-config autoconf automake
 
 APACHE_MODULE= YES
 .include "../../mk/apache.mk"
@@ -29,6 +30,9 @@ SUBST_NOOP_OK.pthflags=       yes
 
 INSTALLATION_DIRS+=    lib/httpd
 
+pre-configure:
+       cd ${WRKSRC} && ./autogen.sh
+
 do-install:
        cd ${WRKSRC} &&                                                 \
            libexecdir=`${APXS} -q LIBEXECDIR` &&                       \

Index: pkgsrc/www/ap2-auth-mellon/distinfo
diff -u pkgsrc/www/ap2-auth-mellon/distinfo:1.23 pkgsrc/www/ap2-auth-mellon/distinfo:1.24
--- pkgsrc/www/ap2-auth-mellon/distinfo:1.23    Tue Oct 26 11:29:18 2021
+++ pkgsrc/www/ap2-auth-mellon/distinfo Tue Nov  9 01:50:45 2021
@@ -1,5 +1,6 @@
-$NetBSD: distinfo,v 1.23 2021/10/26 11:29:18 nia Exp $
+$NetBSD: distinfo,v 1.24 2021/11/09 01:50:45 manu Exp $
 
-BLAKE2s (mod_auth_mellon-0.17.0.tar.gz) = a616ec354f289e4ea985c9c59fbd341877a9dbf1eb778dbad44ea93a51956145
-SHA512 (mod_auth_mellon-0.17.0.tar.gz) = 93919b46e5966d16b334f8f633345d8566f6873a68d1e619835a52a12a70fa7068fe036c69a43ca7b46e51b4c49354d51df13ffd64c60b82747eec86fe357d2e
-Size (mod_auth_mellon-0.17.0.tar.gz) = 955298 bytes
+SHA1 (mod_auth_mellon-0.18.0.tar.gz) = 7103c5f2e50bcbba81710c4f26087d8ac98f1e65
+RMD160 (mod_auth_mellon-0.18.0.tar.gz) = 9ef0edbbfd11d326ceb88d3525e9a3b282b45001
+SHA512 (mod_auth_mellon-0.18.0.tar.gz) = 477ac302fda9ed33b2ca51e88379250a41cc85111e71cacc8ba9f16cd8a2b63af6393fb038fc8f5c211b97926ef368c5989c92570c2e3c9eae072c7b4d32d7d5
+Size (mod_auth_mellon-0.18.0.tar.gz) = 918471 bytes