kpriv/pkgsrc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
pkgsrc/mail/prayer/distinfo

18 lines
1.2 KiB
Text
Raw Normal View History

prayer: Fix building with OpenSSL 1.1. Disable SSLv3. From Debian.
2020-03-19 12:30:26 +01:00
$NetBSD: distinfo,v 1.19 2020/03/19 11:30:26 nia Exp $
Import of prayer 1.0.5 Prayer is a small and fast HTTP to IMAP gateway written entirely in C. * Uses persistent connections to IMAP server and support servers. * Target folders remain SELECTed: not a simple-minded proxy. * Full caching (including sort/thread cache) for each open folder. * Up to five persistent IMAP connections (typically one or two in use): o INBOX and one other folder o Postponed message folder stream o Preferences stream o Folder transfer stream o Various optimisations/sharing to minimise actual IMAP connections * Directory cache: single round trip to IMAP server for directory listing. * Works well with UW IMAP server (even using Unix format mail folders). * Little discernible load on a Pentium III class system running Linux with 5,000 logins/day (400 logins/hour, 150 concurrent logins) * Uses 10% to 20% of the CPU and 400 MBytes of RAM on a PIII class system with 23,000 logins/day (1,700 logins/hour, 850 concurrent logins peak) * Aggressive HTTP/1.0 and 1.1 connection caching to reduce SSL overhead. * Optional gzip compression of pages tunable by IP address range.
2002-12-27 13:52:07 +01:00
Updated prayer to 1.3.5 (from 2012). Comment out non-existing HOMEPAGE. No changelog found.
2017-02-20 11:06:43 +01:00
SHA1 (prayer-1.3.5.tar.gz) = cce72edba8859b2c4e71799a7f93a420326f87b6
RMD160 (prayer-1.3.5.tar.gz) = 8c2c9a4ddb723c8defd7f8742d529de0b6dbaa89
SHA512 (prayer-1.3.5.tar.gz) = 6bb190fda2ac60c6f3801bc89eb719bea7b479c4417eb5e3315d95118dcfecceca9274fb0478360756d2f361d08ebf1f8176a393dbf1b5a3775a52f46e315be1
Size (prayer-1.3.5.tar.gz) = 751658 bytes
Update to 1.3.4; Add PKG_DESTDIR_SUPPORT; Add LICENSE `$Cambridge: hermes/src/prayer/docs/DONE,v 1.66 2011/06/27 13:39:56 dpc22 Exp $ 27/06/2010 ========== Release: Prayer 1.3.4 22/06/2011 ========== draft.c fixes: Fold long lines of addresses before the entry which reaches 78 characters when possible, rather than after the first entry which crosses that boundary. Long standing bug bear of mine but several support functions needed to be rewritten to use scratch string in place of output buffer. Long subject lines which are not RFC1522 encoded need to be folded. separately. Reported by Andrey N. Oktyabrski <ano@bestmx.ru>. RFC1522 is not allowed to fold lines in the middle of a UTF-8 multibyte character. Reported by Andrey N. Oktyabrski <ano@bestmx.ru>. Tidy library: Add support for tidyp fork of (apparently abandoned) tidy library. Fix cross site scripting problem: MSIE and Chrome think that <!---> is a complete comment. Allows people to hide scripts inside <!---><script>...<!--->. Strip all comments (which is something that the old sanitiser had been doing already) Sieve blocks should check "From: " address in body as well as envelope sender address. Check "Sender: " as well for completeness. Linux needs IPPROTO_IPV6 to bind to '0.0.0.0' and '::' 01/11/2010 ========== Mike Brudenell <mike.brudenell@york.ac.uk> reported problem with RFC 2183/RFC 2231 quoting with vey long filenames, or filenames with strange characters from ASCII range. 20/07/2010 ========== Release: Prayer 1.3.3 08/07/2010 ========== Better handling of complex multipart messages: Rather than just displaying the first text/plain or text/html that we can find in the top, (leaving people to access sections for the other parts), display the entire tree: multipart/alternative are handled as before, but with other multipart messages, recurse into the subtrees and repeat. Given: 1 (Nested multipart) 1.1 text/html 1.2 text/plain 2 text/plain we display sections 1.1 and 2. Previously we would display section 2, which is a bit of a disaster if section (1) was the original message and a listserver has helpfully tagged on a message footer as a separate bodypart Combine os_*.c back into a single file (which is where I started off many years back). Eliminates lots of repeated code. 07/07/2010 ========== Bugs ==== os_bind_inet_socket(unsigned long port, char *interface) If interface resolves to multiple IP addresses then only binds to the first. Should really walk along ai->ai_next and bind to each IP address in turn. Unfortuanetly this means that os_bind_inet_socket() needs to return an array of sockfds rather than a single int. Parent routines probably aren't going to play ball either. Most likely cause will be a hostname which generates both IPv4 and IPv6 addresses. Unfortanately it is a probably that we are going to have to solve eventually. 05/07/2010 ========== Fix XSS problems reported by: Jacob H. Hilton <jhh40@cam.ac.uk> Dr Andrew C Aitchison <A.C.Aitchison@dpmms.cam.ac.uk> Rather than trying to spot dangerous tags by simple substring matching in C, I now feed the html through Tidy library (http://tidy.sourceforge.net/), and then prune unwanted nodes from the parse tree before setting it to the pretty printer. The only problem is that the Tidy library doesn't provide any public API for manipulating the parse tree (although it does provide a public API for walking the tree!?), so I had to dig around to find the private functions required to remove and manipulate nodes. Javascript embedded into CSS is also a problem: I need to strip off CSS character entities before looking for dangerous expressions. The final part is still a simple string match: I hope that I don't end up having to generate parse trees for CSS as well as the HTML. Now passes full test suite at: https://secure.grepular.com/email_privacy_tester/ Better vacation screen Subject line Phrasing Coping with multiple logins as single user from single browser: SessionID stored in HTTP Cookie: second login blats first Can store SessionID in URL (Prayer does this if no cookies available) Not secure: leaks in HTTP "Referrer" header with links from HTML email. Solution: Use HTTP Cookie keyed by PID of login session. Smaller cleanups: Improve gap between words in spell check (Cambridge house style) Remove extra blank lines after postpone, restore cycle.
2011-06-30 03:17:37 +02:00
SHA1 (patch-defaults_Config) = 71c552e34dec46097fd420f6b6720fdb3f739374
SHA1 (patch-files_Makefile) = 522ac0b3354c4f2cb62db186209aa706fb95b94b
SHA1 (patch-files_install.sh) = 8590e20625cda6b37e517e24df18ce27eedbbe5d
SHA1 (patch-lib_os.c) = 7e9646b4aaa2518152f3c338ea22700e71f5c8be
SHA1 (patch-lib_os__bsd.h) = b64c720e1ddbcf1756c05fed505aca00a7c61b8f
prayer: Fix building with OpenSSL 1.1. Disable SSLv3. From Debian.
2020-03-19 12:30:26 +01:00
SHA1 (patch-lib_ssl.c) = d32c2d1fb0771ba0192c5ed8e1a3e509b090a5b0
mail/prayer: Install manpages into ${PKGMANDIR}. Patch the project's man/Makefile to use the correct location for installed manpages under ${PKGMANDIR}.
2017-08-19 02:24:50 +02:00
SHA1 (patch-man_Makefile) = 642e082aa5a2813932c057ef4088256a80831636
Update to 1.3.4; Add PKG_DESTDIR_SUPPORT; Add LICENSE `$Cambridge: hermes/src/prayer/docs/DONE,v 1.66 2011/06/27 13:39:56 dpc22 Exp $ 27/06/2010 ========== Release: Prayer 1.3.4 22/06/2011 ========== draft.c fixes: Fold long lines of addresses before the entry which reaches 78 characters when possible, rather than after the first entry which crosses that boundary. Long standing bug bear of mine but several support functions needed to be rewritten to use scratch string in place of output buffer. Long subject lines which are not RFC1522 encoded need to be folded. separately. Reported by Andrey N. Oktyabrski <ano@bestmx.ru>. RFC1522 is not allowed to fold lines in the middle of a UTF-8 multibyte character. Reported by Andrey N. Oktyabrski <ano@bestmx.ru>. Tidy library: Add support for tidyp fork of (apparently abandoned) tidy library. Fix cross site scripting problem: MSIE and Chrome think that <!---> is a complete comment. Allows people to hide scripts inside <!---><script>...<!--->. Strip all comments (which is something that the old sanitiser had been doing already) Sieve blocks should check "From: " address in body as well as envelope sender address. Check "Sender: " as well for completeness. Linux needs IPPROTO_IPV6 to bind to '0.0.0.0' and '::' 01/11/2010 ========== Mike Brudenell <mike.brudenell@york.ac.uk> reported problem with RFC 2183/RFC 2231 quoting with vey long filenames, or filenames with strange characters from ASCII range. 20/07/2010 ========== Release: Prayer 1.3.3 08/07/2010 ========== Better handling of complex multipart messages: Rather than just displaying the first text/plain or text/html that we can find in the top, (leaving people to access sections for the other parts), display the entire tree: multipart/alternative are handled as before, but with other multipart messages, recurse into the subtrees and repeat. Given: 1 (Nested multipart) 1.1 text/html 1.2 text/plain 2 text/plain we display sections 1.1 and 2. Previously we would display section 2, which is a bit of a disaster if section (1) was the original message and a listserver has helpfully tagged on a message footer as a separate bodypart Combine os_*.c back into a single file (which is where I started off many years back). Eliminates lots of repeated code. 07/07/2010 ========== Bugs ==== os_bind_inet_socket(unsigned long port, char *interface) If interface resolves to multiple IP addresses then only binds to the first. Should really walk along ai->ai_next and bind to each IP address in turn. Unfortuanetly this means that os_bind_inet_socket() needs to return an array of sockfds rather than a single int. Parent routines probably aren't going to play ball either. Most likely cause will be a hostname which generates both IPv4 and IPv6 addresses. Unfortanately it is a probably that we are going to have to solve eventually. 05/07/2010 ========== Fix XSS problems reported by: Jacob H. Hilton <jhh40@cam.ac.uk> Dr Andrew C Aitchison <A.C.Aitchison@dpmms.cam.ac.uk> Rather than trying to spot dangerous tags by simple substring matching in C, I now feed the html through Tidy library (http://tidy.sourceforge.net/), and then prune unwanted nodes from the parse tree before setting it to the pretty printer. The only problem is that the Tidy library doesn't provide any public API for manipulating the parse tree (although it does provide a public API for walking the tree!?), so I had to dig around to find the private functions required to remove and manipulate nodes. Javascript embedded into CSS is also a problem: I need to strip off CSS character entities before looking for dangerous expressions. The final part is still a simple string match: I hope that I don't end up having to generate parse trees for CSS as well as the HTML. Now passes full test suite at: https://secure.grepular.com/email_privacy_tester/ Better vacation screen Subject line Phrasing Coping with multiple logins as single user from single browser: SessionID stored in HTTP Cookie: second login blats first Can store SessionID in URL (Prayer does this if no cookies available) Not secure: leaks in HTTP "Referrer" header with links from HTML email. Solution: Use HTTP Cookie keyed by PID of login session. Smaller cleanups: Improve gap between words in spell check (Cambridge house style) Remove extra blank lines after postpone, restore cycle.
2011-06-30 03:17:37 +02:00
SHA1 (patch-servers_Makefile) = db4f3051d7f22b1bb269b8dcc9977b7aa52dde47
Fix build with tidy-5.x.
2017-02-20 10:35:16 +01:00
SHA1 (patch-session_html__secure__tidy.c) = e6a0c0252c09655dbf894cc94107d6cf92839c8b
prayer: Fix building with OpenSSL 1.1. Disable SSLv3. From Debian.
2020-03-19 12:30:26 +01:00
SHA1 (patch-shared_config.c) = 9aefcc6e97d5dc14320a2afab7495f867ca3288b
Update to 1.3.4; Add PKG_DESTDIR_SUPPORT; Add LICENSE `$Cambridge: hermes/src/prayer/docs/DONE,v 1.66 2011/06/27 13:39:56 dpc22 Exp $ 27/06/2010 ========== Release: Prayer 1.3.4 22/06/2011 ========== draft.c fixes: Fold long lines of addresses before the entry which reaches 78 characters when possible, rather than after the first entry which crosses that boundary. Long standing bug bear of mine but several support functions needed to be rewritten to use scratch string in place of output buffer. Long subject lines which are not RFC1522 encoded need to be folded. separately. Reported by Andrey N. Oktyabrski <ano@bestmx.ru>. RFC1522 is not allowed to fold lines in the middle of a UTF-8 multibyte character. Reported by Andrey N. Oktyabrski <ano@bestmx.ru>. Tidy library: Add support for tidyp fork of (apparently abandoned) tidy library. Fix cross site scripting problem: MSIE and Chrome think that <!---> is a complete comment. Allows people to hide scripts inside <!---><script>...<!--->. Strip all comments (which is something that the old sanitiser had been doing already) Sieve blocks should check "From: " address in body as well as envelope sender address. Check "Sender: " as well for completeness. Linux needs IPPROTO_IPV6 to bind to '0.0.0.0' and '::' 01/11/2010 ========== Mike Brudenell <mike.brudenell@york.ac.uk> reported problem with RFC 2183/RFC 2231 quoting with vey long filenames, or filenames with strange characters from ASCII range. 20/07/2010 ========== Release: Prayer 1.3.3 08/07/2010 ========== Better handling of complex multipart messages: Rather than just displaying the first text/plain or text/html that we can find in the top, (leaving people to access sections for the other parts), display the entire tree: multipart/alternative are handled as before, but with other multipart messages, recurse into the subtrees and repeat. Given: 1 (Nested multipart) 1.1 text/html 1.2 text/plain 2 text/plain we display sections 1.1 and 2. Previously we would display section 2, which is a bit of a disaster if section (1) was the original message and a listserver has helpfully tagged on a message footer as a separate bodypart Combine os_*.c back into a single file (which is where I started off many years back). Eliminates lots of repeated code. 07/07/2010 ========== Bugs ==== os_bind_inet_socket(unsigned long port, char *interface) If interface resolves to multiple IP addresses then only binds to the first. Should really walk along ai->ai_next and bind to each IP address in turn. Unfortuanetly this means that os_bind_inet_socket() needs to return an array of sockfds rather than a single int. Parent routines probably aren't going to play ball either. Most likely cause will be a hostname which generates both IPv4 and IPv6 addresses. Unfortanately it is a probably that we are going to have to solve eventually. 05/07/2010 ========== Fix XSS problems reported by: Jacob H. Hilton <jhh40@cam.ac.uk> Dr Andrew C Aitchison <A.C.Aitchison@dpmms.cam.ac.uk> Rather than trying to spot dangerous tags by simple substring matching in C, I now feed the html through Tidy library (http://tidy.sourceforge.net/), and then prune unwanted nodes from the parse tree before setting it to the pretty printer. The only problem is that the Tidy library doesn't provide any public API for manipulating the parse tree (although it does provide a public API for walking the tree!?), so I had to dig around to find the private functions required to remove and manipulate nodes. Javascript embedded into CSS is also a problem: I need to strip off CSS character entities before looking for dangerous expressions. The final part is still a simple string match: I hope that I don't end up having to generate parse trees for CSS as well as the HTML. Now passes full test suite at: https://secure.grepular.com/email_privacy_tester/ Better vacation screen Subject line Phrasing Coping with multiple logins as single user from single browser: SessionID stored in HTTP Cookie: second login blats first Can store SessionID in URL (Prayer does this if no cookies available) Not secure: leaks in HTTP "Referrer" header with links from HTML email. Solution: Use HTTP Cookie keyed by PID of login session. Smaller cleanups: Improve gap between words in spell check (Cambridge house style) Remove extra blank lines after postpone, restore cycle.
2011-06-30 03:17:37 +02:00
SHA1 (patch-utils_Makefile) = 12e95f0603fcb8b83fb20ab737fe2943ecba26b3
Reference in a new issue Copy permalink