CVS commit: pkgsrc/www/ikiwiki

["Amitai Schleier" <schmonz%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   schmonz
Date:           Thu Feb 28 22:00:49 UTC 2019

Modified Files:
        pkgsrc/www/ikiwiki: Makefile distinfo

Log Message:
Update to ikiwiki. From the changelog:

* aggregate: Use LWPx::ParanoidAgent if available.
  Previously blogspam, openid and pinger used this module if available,
  but aggregate did not. This prevents server-side request forgery or
  local file disclosure, and mitigates denial of service when slow
  "tarpit" URLs are accessed.
  (CVE-2019-9187)
* blogspam, openid, pinger: Use a HTTP proxy if configured, even if
  LWPx::ParanoidAgent is installed.
  Previously, only aggregate would obey proxy configuration. If a proxy
  is used, the proxy (not ikiwiki) is responsible for preventing attacks
  like CVE-2019-9187.
* aggregate, blogspam, openid, pinger: Do not access non-http, non-https
  URLs.
  Previously, these plugins would have allowed non-HTTP-based requests if
  LWPx::ParanoidAgent was not installed. Preventing file URIs avoids local
  file disclosure, and preventing other rarely-used URI schemes like
  gopher mitigates request forgery attacks.
* aggregate, openid, pinger: Document LWPx::ParanoidAgent as strongly
  recommended.
  These plugins can request attacker-controlled URLs in some site
  configurations.
* blogspam: Document LWPx::ParanoidAgent as desirable.
  This plugin doesn't request attacker-controlled URLs, so it's
  non-critical here.
* blogspam, openid, pinger: Consistently use cookiejar if configured.
  Previously, these plugins would only obey this configuration if
  LWPx::ParanoidAgent was not installed, but this appears to have been
  unintended.
* po: Always filter .po files.
  The po plugin in previous ikiwiki releases made the second and
  subsequent filter call per (page, destpage) pair into a no-op,
  apparently in an attempt to prevent *recursive* filtering (which as
  far as we can tell can't happen anyway), with the undesired effect
  of interpreting the raw .po file as page content (e.g. Markdown)
  if it was inlined into the same page twice, which is apparently
  something that tails.org does. Simplify this by deleting the code
  that prevented repeated filtering. Thanks, intrigeri
  (Closes: #911356)


To generate a diff of this commit:
cvs rdiff -u -r1.160 -r1.161 pkgsrc/www/ikiwiki/Makefile
cvs rdiff -u -r1.131 -r1.132 pkgsrc/www/ikiwiki/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/ikiwiki/Makefile
diff -u pkgsrc/www/ikiwiki/Makefile:1.160 pkgsrc/www/ikiwiki/Makefile:1.161
--- pkgsrc/www/ikiwiki/Makefile:1.160   Thu Feb  7 15:47:32 2019
+++ pkgsrc/www/ikiwiki/Makefile Thu Feb 28 22:00:48 2019
@@ -1,7 +1,7 @@
-# $NetBSD: Makefile,v 1.160 2019/02/07 15:47:32 schmonz Exp $
+# $NetBSD: Makefile,v 1.161 2019/02/28 22:00:48 schmonz Exp $
 #
 
-DISTNAME=              ikiwiki_3.20190207.orig
+DISTNAME=              ikiwiki_3.20190228.orig
 PKGNAME=               ${DISTNAME:S/_/-/:S/.orig//}
 CATEGORIES=            www textproc
 MASTER_SITES=          ${MASTER_SITE_DEBIAN:=pool/main/i/ikiwiki/}

Index: pkgsrc/www/ikiwiki/distinfo
diff -u pkgsrc/www/ikiwiki/distinfo:1.131 pkgsrc/www/ikiwiki/distinfo:1.132
--- pkgsrc/www/ikiwiki/distinfo:1.131   Thu Feb  7 15:47:32 2019
+++ pkgsrc/www/ikiwiki/distinfo Thu Feb 28 22:00:48 2019
@@ -1,7 +1,7 @@
-$NetBSD: distinfo,v 1.131 2019/02/07 15:47:32 schmonz Exp $
+$NetBSD: distinfo,v 1.132 2019/02/28 22:00:48 schmonz Exp $
 
-SHA1 (ikiwiki_3.20190207.orig.tar.xz) = 3caa33eebec59eca406159b9862eae8f5cb77aa6
-RMD160 (ikiwiki_3.20190207.orig.tar.xz) = 5ac30ade28070a53413554e95de5e68e886fce05
-SHA512 (ikiwiki_3.20190207.orig.tar.xz) = f5b6961a4efe11d0911d96bfa7cc28643cbeaa1654f12c63053eb8ac070bc7f622942386b3b2a150f09bffd66a572a96e981fa111f3bdffa6844124feb91c32a
-Size (ikiwiki_3.20190207.orig.tar.xz) = 2668840 bytes
+SHA1 (ikiwiki_3.20190228.orig.tar.xz) = 46f5b0a1498c1e098fe248eae1f2e3f56b25dc2f
+RMD160 (ikiwiki_3.20190228.orig.tar.xz) = f47968a69528aea864ad412c8508a8c5063edb9d
+SHA512 (ikiwiki_3.20190228.orig.tar.xz) = 125147d83dae6166b45541ed9176398ba4bd22ef3389d3efb3f442e558e326e0b004583d29aa32ed4bfca489c9d55b4232f074aab5fa649e51d9edd103685172
+Size (ikiwiki_3.20190228.orig.tar.xz) = 2672244 bytes
 SHA1 (patch-ikiwiki-mass-rebuild) = b8d5785d77736508de9cfc0f059cc36e0e607bce