pkgsrc/www/firefox/mozilla-common.mk

273 lines
9.8 KiB
Makefile
Raw Normal View History

firefox: Update to 80.0 Changelog: New Firefox can now be set as the default system PDF viewer. The name reported by accessibility tools for items in multi-tiered tree controls no longer incorrectly includes information from items at deeper levels, providing users with the correct level of content when using a screen reader. Fixed Various security fixes. Several crashes while using a screen reader were fixed including a frequently encountered crash when using the JAWS screen reader. Firefox Developer Tools received significant fixes allowing screen reader users to benefit from some of the tools that were previously inaccessible. SVG title and desc elements (labels and descriptions) are now correctly exposed to assistive technology products such as screen readers. Changed For users with reduced motion settings, we've reduced a number of animations such as tab loading to reduce motion for users with migraines and epilepsy. The new add-ons blocklist has been enabled to improve performance and scalability. Enterprise A number of bug fixes and new policies have been implemented in the latest version of Firefox. You can see more details in the Firefox for Enterprise 80 Release Notes. Today's release is the final scheduled for Firefox 68 ESR (68.12) unless there is a critical security issue found prior to the release of Firefox ESR 78.3 on September 22, 2020. Users of Firefox 68 ESR will be automatically upgraded to the Firefox 78 ESR series with the release of 78.3. Developer We've shipped an experimental sidebar panel in the inspector to Firefox Developer Edition that helps developers more quickly identify potential browser compatibility problems based on MDN data. In the Network Monitor request list, a turtle icon is shown for "slow" requests that exceed a threshold for the waiting time. Firefox now supports RTX and Transport-cc for improved call quality in poor network conditions and better bandwidth estimation. These features also provide better compatibility with many websites using WebRTC. Security fixes: #CVE-2020-15663: Downgrade attack on the Mozilla Maintenance Service could have resulted in escalation of privilege #CVE-2020-15664: Attacker-induced prompt for extension installation #CVE-2020-12401: Timing-attack on ECDSA signature generation #CVE-2020-6829: P-384 and P-521 vulnerable to an electro-magnetic side channel attack on signature generation #CVE-2020-12400: P-384 and P-521 vulnerable to a side channel attack on modular inversion #CVE-2020-15665: Address bar not reset when choosing to stay on a page after the beforeunload dialog is shown #CVE-2020-15666: MediaError message property leaks cross-origin response status #CVE-2020-15667: Heap overflow when processing an update file #CVE-2020-15668: Data Race when reading certificate information #CVE-2020-15670: Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2
2020-08-25 16:35:24 +02:00
# $NetBSD: mozilla-common.mk,v 1.178 2020/08/25 14:35:24 ryoon Exp $
#
# common Makefile fragment for mozilla packages based on gecko 2.0.
#
# used by www/firefox/Makefile
.include "../../mk/bsd.prefs.mk"
# Python 2.7 and Python 3.6 or later are required simultaneously.
PYTHON_VERSIONS_ACCEPTED= 27
PYTHON_FOR_BUILD_ONLY= tool
2019-10-18 12:12:08 +02:00
.if !empty(PYTHON_VERSION_DEFAULT:M3[6789])
TOOL_DEPENDS+= python${PYTHON_VERSION_DEFAULT}-[0-9]*:../../lang/python${PYTHON_VERSION_DEFAULT}
ALL_ENV+= PYTHON3=${LOCALBASE}/bin/python${PYTHON_VERSION_DEFAULT:S/3/3./}
.else
TOOL_DEPENDS+= python37-[0-9]*:../../lang/python37
ALL_ENV+= PYTHON3=${LOCALBASE}/bin/python3.7
.endif
HAS_CONFIGURE= yes
CONFIGURE_ARGS+= --prefix=${PREFIX}
USE_TOOLS+= pkg-config perl gmake autoconf213 unzip zip
UNLIMIT_RESOURCES+= datasize virtualsize
# firefox needs a compiler that supports gnu++14 and gnu++17.
# However, passing --std=gnu++17 (from wrappers, as a result of
# USE_LANGUAGES), results in problems for some Rust modules (as of
# 74.0). Therefore, do not declare the languages that are actually
# needed.
# \todo In pkgsrc infrastructure, separate the concept of needing a
# compiler that can implement a standard, and the concept of forcibly
# adding a --std flag. (The build system of a package should be
# setting the --std flag that is needed, rather than relying on the
# defaults of a particular compiler version.)
# NB: Even when building firefox with PKGSRC_COMPILER=gcc, the package
# will depend on and use clang, doing so outside the normal compiler
# selection framework.
USE_LANGUAGES+= c99 c++
firefox: update to 79.0 New We’ve rolled out WebRender to more Windows users with Intel and AMD GPUs, bringing improved graphics performance to an even larger audience. Firefox users in Germany will now see more Pocket recommendations in their new tab featuring some of the best stories on the web. If you don’t see them, you can turn on Pocket articles in your new tab by following these steps. Fixed Various security fixes. Several crashes while using a screen reader were fixed, including a frequently encountered crash when using the JAWS screen reader. Firefox Developer Tools received significant fixes allowing screen reader users to benefit from some of the tools that were previously inaccessible. SVG title and desc elements (labels and descriptions) are now correctly exposed to assistive technology products such as screen readers. Enterprise A number of bug fixes and new policies have been implemented in the latest version of Firefox. You can see more details in the Firefox for Enterprise 79 Release Notes. Updates to the password policy allow admins to require a primary password (formerly called master password. Previously the policy could disable the primary password but not force a primary password. Users required to use a primary password will only be asked to create a primary password the first time they try to save a password. Developer Developer Information Newly added asynchronous call stacks let developers trace their async code through events, timeouts, and promises. The async execution chains are shown in the Debugger’s call stack, but also for stack traces in Console errors and Network initiators. Erroneous network responses with 4xx/5xx status codes display as errors in the Console, making it easy to understand them in the context of related logs. The request/response details can be expanded or resent for quick debugging. JavaScript errors are now visible not only in the Console, but also in the Debugger. The relevant line of code will be highlighted and display error details on hover. Opening SCSS and CSS-in-JS sources from the Inspector now works more reliably thanks to improved source map handling across all panels. Inspecting accessibility properties from the browser context menu is now available to all users by default.
2020-07-31 03:26:43 +02:00
TOOL_DEPENDS+= cbindgen>=0.14.3:../../devel/cbindgen
.if ${MACHINE_ARCH} == "sparc64"
CONFIGURE_ARGS+= --disable-nodejs
.else
Update to 63.0.1 * Minimize pkgsrc specific patches. * A build system written in Rust lang does not find a C++ header files from pkgsrc (non-base) GCC, this version is not buildable on NetBSD 7. I will investigate this problem again. Changelog: 63.0.1 Fixed Snippets are not loaded due to missing element (bug 1503047) Print preview always shows 30% scale when it is actually Shrink To Fit (bug 1501952) Dialog displayed when closing multiple windows shows unreplaced %1$S placeholder in Japanese and potentially other locales (bug 1500823) 63.0 New Performance and visual improvements for Windows users Performance improvements for macOS users Added content blocking, a collection of Firefox settings that offer users greater control over technology that can track them around the web. In 63, users can opt to block third-party tracking cookies or block all trackers and create exceptions for trusted sites that don't work correctly with content blocking enabled. WebExtensions now run in their own process on Linux Firefox now warns about having multiple windows and tabs open when quitting from the main menu. The Save and Quit feature has been removed. You can restore your session by ticking the box for Restore previous session in the General->Startup options or by using Restore Previous Session in the main menu. Firefox now recognizes the operating system accessibility setting for reducing animation Added search shortcuts for Top Sites: Amazon and Google appear as Top Sites tiles on the Firefox Home (New Tab) page. When selected these tiles will change focus to the address bar to initiate a search. Currently in US only. Fixed Resolved an issue that prevented the address bar from autofilling bookmarked URLs in certain cases Various security fixes Changed In the Library, the Open in Sidebar feature for individual bookmarks was removed The option to Never check for updates was removed from about:preferences. You can use the DisableAppUpdate enterprise policy as a substitute. The Ctrl+Tab shortcut now displays thumbnail previews of your tabs and cycles through tabs in recently used order. This new default behavior is activated only in new profiles and can be changed in preferences. #CVE-2018-12391: HTTP Live Stream audio data is accessible cross-origin #CVE-2018-12392: Crash with nested event loops #CVE-2018-12393: Integer overflow during Unicode conversion while loading JavaScript #CVE-2018-12395: WebExtension bypass of domain restrictions through header rewriting #CVE-2018-12396: WebExtension content scripts can execute in disallowed contexts #CVE-2018-12397: Missing warning prompt when WebExtension requests local file access #CVE-2018-12398: CSP bypass through stylesheet injection in resource URIs #CVE-2018-12399: Spoofing of protocol registration notification bar #CVE-2018-12400: Favicons are cached in private browsing mode on Firefox for Android #CVE-2018-12401: DOS attack through special resource URI parsing #CVE-2018-12402: SameSite cookies leak when pages are explicitly saved #CVE-2018-12403: Mixed content warning is not displayed when HTTPS page loads a favicon over HTTP #CVE-2018-12388: Memory safety bugs fixed in Firefox 63 #CVE-2018-12390: Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3
2018-11-04 01:38:44 +01:00
TOOL_DEPENDS+= nodejs-[0-9]*:../../lang/nodejs
.endif
Update to 63.0.1 * Minimize pkgsrc specific patches. * A build system written in Rust lang does not find a C++ header files from pkgsrc (non-base) GCC, this version is not buildable on NetBSD 7. I will investigate this problem again. Changelog: 63.0.1 Fixed Snippets are not loaded due to missing element (bug 1503047) Print preview always shows 30% scale when it is actually Shrink To Fit (bug 1501952) Dialog displayed when closing multiple windows shows unreplaced %1$S placeholder in Japanese and potentially other locales (bug 1500823) 63.0 New Performance and visual improvements for Windows users Performance improvements for macOS users Added content blocking, a collection of Firefox settings that offer users greater control over technology that can track them around the web. In 63, users can opt to block third-party tracking cookies or block all trackers and create exceptions for trusted sites that don't work correctly with content blocking enabled. WebExtensions now run in their own process on Linux Firefox now warns about having multiple windows and tabs open when quitting from the main menu. The Save and Quit feature has been removed. You can restore your session by ticking the box for Restore previous session in the General->Startup options or by using Restore Previous Session in the main menu. Firefox now recognizes the operating system accessibility setting for reducing animation Added search shortcuts for Top Sites: Amazon and Google appear as Top Sites tiles on the Firefox Home (New Tab) page. When selected these tiles will change focus to the address bar to initiate a search. Currently in US only. Fixed Resolved an issue that prevented the address bar from autofilling bookmarked URLs in certain cases Various security fixes Changed In the Library, the Open in Sidebar feature for individual bookmarks was removed The option to Never check for updates was removed from about:preferences. You can use the DisableAppUpdate enterprise policy as a substitute. The Ctrl+Tab shortcut now displays thumbnail previews of your tabs and cycles through tabs in recently used order. This new default behavior is activated only in new profiles and can be changed in preferences. #CVE-2018-12391: HTTP Live Stream audio data is accessible cross-origin #CVE-2018-12392: Crash with nested event loops #CVE-2018-12393: Integer overflow during Unicode conversion while loading JavaScript #CVE-2018-12395: WebExtension bypass of domain restrictions through header rewriting #CVE-2018-12396: WebExtension content scripts can execute in disallowed contexts #CVE-2018-12397: Missing warning prompt when WebExtension requests local file access #CVE-2018-12398: CSP bypass through stylesheet injection in resource URIs #CVE-2018-12399: Spoofing of protocol registration notification bar #CVE-2018-12400: Favicons are cached in private browsing mode on Firefox for Android #CVE-2018-12401: DOS attack through special resource URI parsing #CVE-2018-12402: SameSite cookies leak when pages are explicitly saved #CVE-2018-12403: Mixed content warning is not displayed when HTTPS page loads a favicon over HTTP #CVE-2018-12388: Memory safety bugs fixed in Firefox 63 #CVE-2018-12390: Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3
2018-11-04 01:38:44 +01:00
firefox: Update to 75.0 Changelog: New With today's release, a number of improvements will help you search smarter, faster. Type less and find more with Firefox's revamped address bar: Focused, clean search experience that's optimized for smaller laptop screens Top sites now appear when you select the address Improved readability of search suggestions with a focus on new search terms Suggestions include solutions to common Firefox issues On Linux, the behavior when clicking on the Address Bar and the Search Bar now matches other desktop platforms: a single click selects all without primary selection, a double click selects a word, and a triple click selects all with primary selection Firefox will locally cache all trusted Web PKI Certificate Authority certificates known to Mozilla. This will improve HTTPS compatibility with misconfigured web servers and improve security. Firefox is now available in Flatpak, an easier way to install and use Firefox on Linux. Direct Composition is being integrated for our users on Windows to help improve performance and enable our ongoing work to ship WebRender on Windows 10 laptops with Intel graphics cards. Fixed Various security fixes Enterprise Experimental support for using client certificates from the OS certificate store can be enabled on macOS by setting the preference security.osclientcerts.autoload to true. Enterprise policies may be used to exclude domains from being resolved via TRR (Trusted Recursive Resolver) using DNS over HTTPS. Developer Developer Information Save bandwidth and reduce browser memory by using the loading attribute on the <img> element. The default "eager" value loads images immediately, and the "lazy" value delays loading until the image is within range of the viewport. Instant evaluation for Console expressions lets developers identify and fix errors more rapidly than before. As long as expressions typed into the Web Console are side-effect free, their results will be previewed while you type. Security fixes: #CVE-2020-6821: Uninitialized memory could be read when using the WebGL copyTexSubImage method #CVE-2020-6822: Out of bounds write in GMPDecodeData when processing large images #CVE-2020-6823: Malicious Extension could obtain auth codes from OAuth login flows #CVE-2020-6824: Generated passwords may be identical on the same site between separate private browsing sessions #CVE-2020-6825: Memory safety bugs fixed in Firefox 75 and Firefox ESR 68.7 #CVE-2020-6826: Memory safety bugs fixed in Firefox 75
2020-04-09 16:01:26 +02:00
# Depend on Python3 sqlite3 module.
.if !empty(PYTHON_VERSION_DEFAULT:M3[6789])
BUILD_DEPENDS+= py${PYTHON_VERSION_DEFAULT}-sqlite3-[0-9]*:../../databases/py-sqlite3
.else
BUILD_DEPENDS+= py37-sqlite3-[0-9]*:../../databases/py-sqlite3
.endif
.if ${MACHINE_ARCH} == "i386" || ${MACHINE_ARCH} == "x86_64"
2020-05-15 08:59:25 +02:00
TOOL_DEPENDS+= nasm>=2.14:../../devel/nasm
2020-05-07 12:14:16 +02:00
TOOL_DEPENDS+= yasm>=1.1:../../devel/yasm
.endif
Update to 58.0 Changelog: New Performance improvements, including: Rendering graphics for Windows users by using Off-Main-Threa Painting (OMTP) Loading pages faster by changing how Firefox caches and retrieves JavaScript Improvements to Firefox Screenshots: Copy and paste screenshots directly to your clipboard Firefox Screenshots now works in Private Browsing mode Added Nepali (ne-NP) locale In case you missed it--57 Release privacy and performance feature: Users can enable Tracking Protection at all times. Learn how to turn Tracking Protection on. Fixed Fonts installed in non-standard directories will no longer appear blank for Linux users Various security fixes Changed User profiles created in Firefox 58 (and in future releases) are not supported in previous versions of Firefox. Users who downgrade to a previous version should create a new profile for that version. Learn about alternatives to downgrading on our support site. Added a warning to alert users and site owners of planned security changes to sites affected by the gradual distrust plan for the Symantec certificate authority #CVE-2018-5091: Use-after-free with DTMF timers #CVE-2018-5092: Use-after-free in Web Workers #CVE-2018-5093: Buffer overflow in WebAssembly during Memory/Table resizing #CVE-2018-5094: Buffer overflow in WebAssembly with garbage collection on uninitialized memory #CVE-2018-5095: Integer overflow in Skia library during edge builder allocation #CVE-2018-5097: Use-after-free when source document is manipulated during XSLT #CVE-2018-5098: Use-after-free while manipulating form input elements #CVE-2018-5099: Use-after-free with widget listener #CVE-2018-5100: Use-after-free when IsPotentiallyScrollable arguments are freed from memory #CVE-2018-5101: Use-after-free with floating first-letter style elements #CVE-2018-5102: Use-after-free in HTML media elements #CVE-2018-5103: Use-after-free during mouse event handling #CVE-2018-5104: Use-after-free during font face manipulation #CVE-2018-5105: WebExtensions can save and execute files on local file system without user prompts #CVE-2018-5106: Developer Tools can expose style editor information cross-origin through service worker #CVE-2018-5107: Printing process will follow symlinks for local file access #CVE-2018-5108: Manually entered blob URL can be accessed by subsequent private browsing tabs #CVE-2018-5109: Audio capture prompts and starts with incorrect origin attribution #CVE-2018-5110: Cursor can be made invisible on OS X #CVE-2018-5117: URL spoofing with right-to-left text aligned left-to-right #CVE-2018-5118: Activity Stream images can attempt to load local content through file: #CVE-2018-5119: Reader view will load cross-origin content in violation of CORS headers #CVE-2018-5121: OS X Tibetan characters render incompletely in the addressbar #CVE-2018-5122: Potential integer overflow in DoCrypt #CVE-2018-5090: Memory safety bugs fixed in Firefox 58 #CVE-2018-5089: Memory safety bugs fixed in Firefox 58 and Firefox ESR 52.6
2018-01-24 17:52:08 +01:00
# For rustc/cargo detection
2020-03-12 20:34:56 +01:00
CONFIGURE_ARGS+= --target=${MACHINE_GNU_PLATFORM}
CONFIGURE_ARGS+= --host=${MACHINE_GNU_PLATFORM}
CONFIGURE_ENV+= BINDGEN_CFLAGS="-isystem${PREFIX}/include/nspr \
-isystem${X11BASE}/include/pixman-1"
test:
cd ${WRKSRC}/${OBJDIR}/dist/bin && \
./run-mozilla.sh ${WRKSRC}/mach check-spidermonkey
# tar(1) of OpenBSD 5.5 has no --exclude command line option.
.if ${OPSYS} == "OpenBSD"
TOOLS_PLATFORM.tar= ${TOOLS_PATH.bsdtar}
USE_TOOLS+= bsdtar
.endif
.if ${MACHINE_ARCH} == "i386"
# Fix for PR pkg/48152.
2015-09-29 17:22:07 +02:00
CXXFLAGS+= -march=i586
2015-03-17 04:19:08 +01:00
# This is required for SSE2 code under i386.
CXXFLAGS+= -mstackrealign
.endif
CHECK_PORTABILITY_SKIP+= ${MOZILLA_DIR}security/nss/tests/libpkix/libpkix.sh
CHECK_PORTABILITY_SKIP+= ${MOZILLA_DIR}security/nss/tests/multinit/multinit.sh
CHECK_PORTABILITY_SKIP+= ${MOZILLA_DIR}js/src/tests/update-test262.sh
CHECK_PORTABILITY_SKIP+= ${MOZILLA_DIR}intl/icu/source/configure
CHECK_PORTABILITY_SKIP+= ${MOZILLA_DIR}browser/components/loop/run-all-loop-tests.sh
CHECK_PORTABILITY_SKIP+= ${MOZILLA_DIR}browser/extensions/loop/run-all-loop-tests.sh
#CHECK_PORTABILITY_SKIP+= ${MOZILLA_DIR}modules/pdfium/update.sh
CONFIGURE_ARGS+= --enable-default-toolkit=cairo-gtk3
Update to 63.0.1 * Minimize pkgsrc specific patches. * A build system written in Rust lang does not find a C++ header files from pkgsrc (non-base) GCC, this version is not buildable on NetBSD 7. I will investigate this problem again. Changelog: 63.0.1 Fixed Snippets are not loaded due to missing element (bug 1503047) Print preview always shows 30% scale when it is actually Shrink To Fit (bug 1501952) Dialog displayed when closing multiple windows shows unreplaced %1$S placeholder in Japanese and potentially other locales (bug 1500823) 63.0 New Performance and visual improvements for Windows users Performance improvements for macOS users Added content blocking, a collection of Firefox settings that offer users greater control over technology that can track them around the web. In 63, users can opt to block third-party tracking cookies or block all trackers and create exceptions for trusted sites that don't work correctly with content blocking enabled. WebExtensions now run in their own process on Linux Firefox now warns about having multiple windows and tabs open when quitting from the main menu. The Save and Quit feature has been removed. You can restore your session by ticking the box for Restore previous session in the General->Startup options or by using Restore Previous Session in the main menu. Firefox now recognizes the operating system accessibility setting for reducing animation Added search shortcuts for Top Sites: Amazon and Google appear as Top Sites tiles on the Firefox Home (New Tab) page. When selected these tiles will change focus to the address bar to initiate a search. Currently in US only. Fixed Resolved an issue that prevented the address bar from autofilling bookmarked URLs in certain cases Various security fixes Changed In the Library, the Open in Sidebar feature for individual bookmarks was removed The option to Never check for updates was removed from about:preferences. You can use the DisableAppUpdate enterprise policy as a substitute. The Ctrl+Tab shortcut now displays thumbnail previews of your tabs and cycles through tabs in recently used order. This new default behavior is activated only in new profiles and can be changed in preferences. #CVE-2018-12391: HTTP Live Stream audio data is accessible cross-origin #CVE-2018-12392: Crash with nested event loops #CVE-2018-12393: Integer overflow during Unicode conversion while loading JavaScript #CVE-2018-12395: WebExtension bypass of domain restrictions through header rewriting #CVE-2018-12396: WebExtension content scripts can execute in disallowed contexts #CVE-2018-12397: Missing warning prompt when WebExtension requests local file access #CVE-2018-12398: CSP bypass through stylesheet injection in resource URIs #CVE-2018-12399: Spoofing of protocol registration notification bar #CVE-2018-12400: Favicons are cached in private browsing mode on Firefox for Android #CVE-2018-12401: DOS attack through special resource URI parsing #CVE-2018-12402: SameSite cookies leak when pages are explicitly saved #CVE-2018-12403: Mixed content warning is not displayed when HTTPS page loads a favicon over HTTP #CVE-2018-12388: Memory safety bugs fixed in Firefox 63 #CVE-2018-12390: Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3
2018-11-04 01:38:44 +01:00
CONFIGURE_ARGS+= --enable-release
# Disable Rust SIMD option to fix build with lang/rust-1.33.0
# This should be enabled later again.
#CONFIGURE_ARGS+= --enable-rust-simd
Update to 23.0 * Install SDK to firefox-sdk directory. * Split multiple CONFIGURE_ARS's arguments. * Enable libmozjs.so build. Changelog: NEW Mixed content blocking enabled to protects users from man-in-the-middle attacks and eavesdroppers on HTTPS pages (learn more) NEW Options panel created for Web Developer Toolbox CHANGED "Enable JavaScript" preference checkbox has been removed and user-set values will be reset to the default CHANGED Updated Firefox Logo CHANGED Improved about:memory's functional UI CHANGED Simplified interface for notifications of plugin installation CHANGED Enabled DXVA2 on Windows Vista+ to accelerate H.264 video decoding CHANGED Users can now switch to a new search provider across the entire browser CHANGED CSP policies using the standard syntax and semantics will now be enforced CHANGED <input type='file'> rendering improvements (see bug 838675) CHANGED Replace fixed-ratio audio resampler in webrtc.org capture code with Speex resampler and eliminate pseudo-44000Hz rate CHANGED "Load images automatically" and Always show the tab bar" checkboxes removed from preferences and reset to defaults DEVELOPER HTML5 <input type="range"> form control implemented DEVELOPER Write more accessible pages on touch interfaces with new ARIA role for key buttons DEVELOPER Social share functionality DEVELOPER Added unprefixed requestAnimationFrame DEVELOPER Implemented a global browser console DEVELOPER Dropped blink effect from text-decoration: blink; and completely removed <blink> element DEVELOPER New feature in toolbox: Network Monitor FIXED Various security fixes n Firefox 23 MFSA 2013-75 Local Java applets may read contents of local file system MFSA 2013-74 Firefox full and stub installer DLL hijacking MFSA 2013-73 Same-origin bypass with web workers and XMLHttpRequest MFSA 2013-72 Wrong principal used for validating URI for some Javascript components MFSA 2013-71 Further Privilege escalation through Mozilla Updater MFSA 2013-70 Bypass of XrayWrappers using XBL Scopes MFSA 2013-69 CRMF requests allow for code execution and XSS attacks MFSA 2013-68 Document URI misrepresentation and masquerading MFSA 2013-67 Crash during WAV audio file decoding MFSA 2013-66 Buffer overflow in Mozilla Maintenance Service and Mozilla Updater MFSA 2013-65 Buffer underflow when generating CRMF requests MFSA 2013-64 Use after free mutating DOM during SetBody MFSA 2013-63 Miscellaneous memory safety hazards (rv:23.0 / rv:17.0.8)
2013-08-07 14:17:54 +02:00
CONFIGURE_ARGS+= --disable-tests
Update to 59.0.1 Changelog: 59.0.1 Security fix #CVE-2018-5146: Out of bounds memory write in libvorbis 59.0 New Performance enhancements: - Faster load times for content on the Firefox Home page - Faster page load times by loading either from the networked cache or the cache on the user's hard drive (Race Cache With Network) - Improved graphics rendering using Off-Main-Thread Painting (OMTP) for Mac users (OMTP for Windows was released in Firefox 58) Drag-and-drop to rearrange Top Sites on the Firefox Home page, and customize new windows and tabs in other ways Added features for Firefox Screenshots: - Basic annotation lets the user draw on and highlight saved screenshots - Recropping to change the viewable area of saved screenshots Enhanced WebExtensions API including better support for decentralized protocols and the ability to dynamically register content scripts Improved Real-Time Communications (RTC) capabilities. - Implemented RTP Transceiver to give pages more fine grained control over calls - Implemented features to support large scale conferences Added support for W3C specs for pointer events and improved platform integration with added device support for mouse, pen, and touch screen pointer input Added the Ecosia search engine as an option for German Firefox Added the Qwant search engine as an option for French Firefox Added settings in about:preferences to stop websites from asking to send notifications or access your device's camera, microphone, and location, while still allowing trusted websites to use these features Fixed Various security fixes Changed Firefox Private Browsing Mode will remove path information from referrers to prevent cross-site tracking Security fixes: #CVE-2018-5127: Buffer overflow manipulating SVG animatedPathSegList #CVE-2018-5128: Use-after-free manipulating editor selection ranges #CVE-2018-5129: Out-of-bounds write with malformed IPC messages #CVE-2018-5130: Mismatched RTP payload type can trigger memory corruption #CVE-2018-5131: Fetch API improperly returns cached copies of no-store/no-cache resources #CVE-2018-5132: WebExtension Find API can search privileged pages #CVE-2018-5133: Value of the app.support.baseURL preference is not properly sanitized #CVE-2018-5134: WebExtensions may use view-source: URLs to bypass content restrictions #CVE-2018-5135: WebExtension browserAction can inject scripts into unintended contexts #CVE-2018-5136: Same-origin policy violation with data: URL shared workers #CVE-2018-5137: Script content can access legacy extension non-contentaccessible resources #CVE-2018-5138: Android Custom Tab address spoofing through long domain names #CVE-2018-5140: Moz-icon images accessible to web content through moz-icon: protocol #CVE-2018-5141: DOS attack through notifications Push API #CVE-2018-5142: Media Capture and Streams API permissions display incorrect origin with data: and blob: URLs #CVE-2018-5143: Self-XSS pasting javascript: URL with embedded tab into addressbar #CVE-2018-5126: Memory safety bugs fixed in Firefox 59 #CVE-2018-5125: Memory safety bugs fixed in Firefox 59 and Firefox ESR 52.7
2018-03-17 01:59:02 +01:00
# Mozilla Bug 1432751
#CONFIGURE_ARGS+= --enable-system-cairo
CONFIGURE_ARGS+= --enable-system-pixman
# webrtc option requires internal libvpx
#CONFIGURE_ARGS+= --with-system-libvpx
CONFIGURE_ARGS+= --enable-system-ffi
Update to 24.0, ESR edition. * Merge some patches via FreeBSD ports. * Tested on NetBSD/amd64 6.99.23 and DragonFly/amd64 3.4.1. * Use system hunspell dictionaries. * DuckDuckGo search window. * Enable system icu support. Changelog: NEW Support for new scrollbar style in Mac OS X 10.7 and newer NEW Implemented Close tabs to the right NEW Social: Ability to tear-off chat windows to view separately by simply dragging them out CHANGED Accessibility related improvements on using pinned tabs (see 577727) CHANGED Removed support for Revocation Lists feature (see 867465) CHANGED Performance improvements on New Tab Page loads (see 791670) DEVELOPER Major SVG rendering improvements around Image tiling and scaling (see 600207 ) DEVELOPER Improved and unified Browser console for enhanced debugging experience, replacing existing Error console DEVELOPER Removed support for sherlock files that are loaded from application or profile directory FIXED Replace fixed-ratio audio resampler in webrtc.org capture code with Speex resampler and eliminate pseudo-44000Hz rate ( see 886886) FIXED 24.0: Security fixes can be found here Fixed in Firefox 24 MFSA 2013-92 GC hazard with default compartments and frame chain restoration MFSA 2013-91 User-defined properties on DOM proxies get the wrong "this" object MFSA 2013-90 Memory corruption involving scrolling MFSA 2013-89 Buffer overflow with multi-column, lists, and floats MFSA 2013-88 compartment mismatch re-attaching XBL-backed nodes MFSA 2013-87 Shared object library loading from writable location MFSA 2013-86 WebGL Information disclosure through OS X NVIDIA graphic drivers MFSA 2013-85 Uninitialized data in IonMonkey MFSA 2013-84 Same-origin bypass through symbolic links MFSA 2013-83 Mozilla Updater does not lock MAR file after signature verification MFSA 2013-82 Calling scope for new Javascript objects can lead to memory corruption MFSA 2013-81 Use-after-free with select element MFSA 2013-80 NativeKey continues handling key messages after widget is destroyed MFSA 2013-79 Use-after-free in Animation Manager during stylesheet cloning MFSA 2013-78 Integer overflow in ANGLE library MFSA 2013-77 Improper state in HTML5 Tree Builder with templates MFSA 2013-76 Miscellaneous memory safety hazards (rv:24.0 / rv:17.0.9)
2013-09-19 14:37:49 +02:00
CONFIGURE_ARGS+= --with-system-icu
CONFIGURE_ARGS+= --with-system-nss
CONFIGURE_ARGS+= --with-system-nspr
Update to 63.0.1 * Minimize pkgsrc specific patches. * A build system written in Rust lang does not find a C++ header files from pkgsrc (non-base) GCC, this version is not buildable on NetBSD 7. I will investigate this problem again. Changelog: 63.0.1 Fixed Snippets are not loaded due to missing element (bug 1503047) Print preview always shows 30% scale when it is actually Shrink To Fit (bug 1501952) Dialog displayed when closing multiple windows shows unreplaced %1$S placeholder in Japanese and potentially other locales (bug 1500823) 63.0 New Performance and visual improvements for Windows users Performance improvements for macOS users Added content blocking, a collection of Firefox settings that offer users greater control over technology that can track them around the web. In 63, users can opt to block third-party tracking cookies or block all trackers and create exceptions for trusted sites that don't work correctly with content blocking enabled. WebExtensions now run in their own process on Linux Firefox now warns about having multiple windows and tabs open when quitting from the main menu. The Save and Quit feature has been removed. You can restore your session by ticking the box for Restore previous session in the General->Startup options or by using Restore Previous Session in the main menu. Firefox now recognizes the operating system accessibility setting for reducing animation Added search shortcuts for Top Sites: Amazon and Google appear as Top Sites tiles on the Firefox Home (New Tab) page. When selected these tiles will change focus to the address bar to initiate a search. Currently in US only. Fixed Resolved an issue that prevented the address bar from autofilling bookmarked URLs in certain cases Various security fixes Changed In the Library, the Open in Sidebar feature for individual bookmarks was removed The option to Never check for updates was removed from about:preferences. You can use the DisableAppUpdate enterprise policy as a substitute. The Ctrl+Tab shortcut now displays thumbnail previews of your tabs and cycles through tabs in recently used order. This new default behavior is activated only in new profiles and can be changed in preferences. #CVE-2018-12391: HTTP Live Stream audio data is accessible cross-origin #CVE-2018-12392: Crash with nested event loops #CVE-2018-12393: Integer overflow during Unicode conversion while loading JavaScript #CVE-2018-12395: WebExtension bypass of domain restrictions through header rewriting #CVE-2018-12396: WebExtension content scripts can execute in disallowed contexts #CVE-2018-12397: Missing warning prompt when WebExtension requests local file access #CVE-2018-12398: CSP bypass through stylesheet injection in resource URIs #CVE-2018-12399: Spoofing of protocol registration notification bar #CVE-2018-12400: Favicons are cached in private browsing mode on Firefox for Android #CVE-2018-12401: DOS attack through special resource URI parsing #CVE-2018-12402: SameSite cookies leak when pages are explicitly saved #CVE-2018-12403: Mixed content warning is not displayed when HTTPS page loads a favicon over HTTP #CVE-2018-12388: Memory safety bugs fixed in Firefox 63 #CVE-2018-12390: Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3
2018-11-04 01:38:44 +01:00
#CONFIGURE_ARGS+= --with-system-jpeg
Update to 23.0 * Install SDK to firefox-sdk directory. * Split multiple CONFIGURE_ARS's arguments. * Enable libmozjs.so build. Changelog: NEW Mixed content blocking enabled to protects users from man-in-the-middle attacks and eavesdroppers on HTTPS pages (learn more) NEW Options panel created for Web Developer Toolbox CHANGED "Enable JavaScript" preference checkbox has been removed and user-set values will be reset to the default CHANGED Updated Firefox Logo CHANGED Improved about:memory's functional UI CHANGED Simplified interface for notifications of plugin installation CHANGED Enabled DXVA2 on Windows Vista+ to accelerate H.264 video decoding CHANGED Users can now switch to a new search provider across the entire browser CHANGED CSP policies using the standard syntax and semantics will now be enforced CHANGED <input type='file'> rendering improvements (see bug 838675) CHANGED Replace fixed-ratio audio resampler in webrtc.org capture code with Speex resampler and eliminate pseudo-44000Hz rate CHANGED "Load images automatically" and Always show the tab bar" checkboxes removed from preferences and reset to defaults DEVELOPER HTML5 <input type="range"> form control implemented DEVELOPER Write more accessible pages on touch interfaces with new ARIA role for key buttons DEVELOPER Social share functionality DEVELOPER Added unprefixed requestAnimationFrame DEVELOPER Implemented a global browser console DEVELOPER Dropped blink effect from text-decoration: blink; and completely removed <blink> element DEVELOPER New feature in toolbox: Network Monitor FIXED Various security fixes n Firefox 23 MFSA 2013-75 Local Java applets may read contents of local file system MFSA 2013-74 Firefox full and stub installer DLL hijacking MFSA 2013-73 Same-origin bypass with web workers and XMLHttpRequest MFSA 2013-72 Wrong principal used for validating URI for some Javascript components MFSA 2013-71 Further Privilege escalation through Mozilla Updater MFSA 2013-70 Bypass of XrayWrappers using XBL Scopes MFSA 2013-69 CRMF requests allow for code execution and XSS attacks MFSA 2013-68 Document URI misrepresentation and masquerading MFSA 2013-67 Crash during WAV audio file decoding MFSA 2013-66 Buffer overflow in Mozilla Maintenance Service and Mozilla Updater MFSA 2013-65 Buffer underflow when generating CRMF requests MFSA 2013-64 Use after free mutating DOM during SetBody MFSA 2013-63 Miscellaneous memory safety hazards (rv:23.0 / rv:17.0.8)
2013-08-07 14:17:54 +02:00
CONFIGURE_ARGS+= --with-system-zlib
CONFIGURE_ARGS+= --with-system-libevent=${BUILDLINK_PREFIX.libevent}
CONFIGURE_ARGS+= --disable-crashreporter
CONFIGURE_ARGS+= --disable-necko-wifi
CONFIGURE_ARGS+= --enable-chrome-format=flat
CONFIGURE_ARGS+= --with-system-webp
Update to 23.0 * Install SDK to firefox-sdk directory. * Split multiple CONFIGURE_ARS's arguments. * Enable libmozjs.so build. Changelog: NEW Mixed content blocking enabled to protects users from man-in-the-middle attacks and eavesdroppers on HTTPS pages (learn more) NEW Options panel created for Web Developer Toolbox CHANGED "Enable JavaScript" preference checkbox has been removed and user-set values will be reset to the default CHANGED Updated Firefox Logo CHANGED Improved about:memory's functional UI CHANGED Simplified interface for notifications of plugin installation CHANGED Enabled DXVA2 on Windows Vista+ to accelerate H.264 video decoding CHANGED Users can now switch to a new search provider across the entire browser CHANGED CSP policies using the standard syntax and semantics will now be enforced CHANGED <input type='file'> rendering improvements (see bug 838675) CHANGED Replace fixed-ratio audio resampler in webrtc.org capture code with Speex resampler and eliminate pseudo-44000Hz rate CHANGED "Load images automatically" and Always show the tab bar" checkboxes removed from preferences and reset to defaults DEVELOPER HTML5 <input type="range"> form control implemented DEVELOPER Write more accessible pages on touch interfaces with new ARIA role for key buttons DEVELOPER Social share functionality DEVELOPER Added unprefixed requestAnimationFrame DEVELOPER Implemented a global browser console DEVELOPER Dropped blink effect from text-decoration: blink; and completely removed <blink> element DEVELOPER New feature in toolbox: Network Monitor FIXED Various security fixes n Firefox 23 MFSA 2013-75 Local Java applets may read contents of local file system MFSA 2013-74 Firefox full and stub installer DLL hijacking MFSA 2013-73 Same-origin bypass with web workers and XMLHttpRequest MFSA 2013-72 Wrong principal used for validating URI for some Javascript components MFSA 2013-71 Further Privilege escalation through Mozilla Updater MFSA 2013-70 Bypass of XrayWrappers using XBL Scopes MFSA 2013-69 CRMF requests allow for code execution and XSS attacks MFSA 2013-68 Document URI misrepresentation and masquerading MFSA 2013-67 Crash during WAV audio file decoding MFSA 2013-66 Buffer overflow in Mozilla Maintenance Service and Mozilla Updater MFSA 2013-65 Buffer underflow when generating CRMF requests MFSA 2013-64 Use after free mutating DOM during SetBody MFSA 2013-63 Miscellaneous memory safety hazards (rv:23.0 / rv:17.0.8)
2013-08-07 14:17:54 +02:00
#CONFIGURE_ARGS+= --enable-readline
Update to 24.0, ESR edition. * Merge some patches via FreeBSD ports. * Tested on NetBSD/amd64 6.99.23 and DragonFly/amd64 3.4.1. * Use system hunspell dictionaries. * DuckDuckGo search window. * Enable system icu support. Changelog: NEW Support for new scrollbar style in Mac OS X 10.7 and newer NEW Implemented Close tabs to the right NEW Social: Ability to tear-off chat windows to view separately by simply dragging them out CHANGED Accessibility related improvements on using pinned tabs (see 577727) CHANGED Removed support for Revocation Lists feature (see 867465) CHANGED Performance improvements on New Tab Page loads (see 791670) DEVELOPER Major SVG rendering improvements around Image tiling and scaling (see 600207 ) DEVELOPER Improved and unified Browser console for enhanced debugging experience, replacing existing Error console DEVELOPER Removed support for sherlock files that are loaded from application or profile directory FIXED Replace fixed-ratio audio resampler in webrtc.org capture code with Speex resampler and eliminate pseudo-44000Hz rate ( see 886886) FIXED 24.0: Security fixes can be found here Fixed in Firefox 24 MFSA 2013-92 GC hazard with default compartments and frame chain restoration MFSA 2013-91 User-defined properties on DOM proxies get the wrong "this" object MFSA 2013-90 Memory corruption involving scrolling MFSA 2013-89 Buffer overflow with multi-column, lists, and floats MFSA 2013-88 compartment mismatch re-attaching XBL-backed nodes MFSA 2013-87 Shared object library loading from writable location MFSA 2013-86 WebGL Information disclosure through OS X NVIDIA graphic drivers MFSA 2013-85 Uninitialized data in IonMonkey MFSA 2013-84 Same-origin bypass through symbolic links MFSA 2013-83 Mozilla Updater does not lock MAR file after signature verification MFSA 2013-82 Calling scope for new Javascript objects can lead to memory corruption MFSA 2013-81 Use-after-free with select element MFSA 2013-80 NativeKey continues handling key messages after widget is destroyed MFSA 2013-79 Use-after-free in Animation Manager during stylesheet cloning MFSA 2013-78 Integer overflow in ANGLE library MFSA 2013-77 Improper state in HTML5 Tree Builder with templates MFSA 2013-76 Miscellaneous memory safety hazards (rv:24.0 / rv:17.0.9)
2013-09-19 14:37:49 +02:00
CONFIGURE_ARGS+= --disable-icf
Update to 26.0 * Build outside WRKSRC, fix build Changelog: NEW All Java plug-ins are defaulted to 'click to play' NEW Password manager now supports script-generated password fields NEW Updates can now be performed by Windows users without write permissions to Firefox install directory (requires Mozilla Maintenance Service) NEW Support for H.264 on Linux if the appropriate gstreamer plug-ins are installed CHANGED Support for MP3 decoding on Windows XP, completing MP3 support across Windows OS versions CHANGED CSP implementation now supports multiple policies, including the case of both an enforced and Report-Only policy, per the spec DEVELOPER Social API now supports Social Bookmarking for multiple providers through its SocialMarks functionality (see MDN docs) DEVELOPER Math.ToFloat32 takes a JS value and converts it to a Float32, whenever possible DEVELOPER There is no longer a prompt when websites use appcache DEVELOPER Support for the CSS image orientation property DEVELOPER New App Manager allows you to deploy and debug HTML5 webapps on Firefox OS phones and the Firefox OS Simulator DEVELOPER IndexedDB can now be used as a "optimistic" storage area so it doesn't require any prompts and data is stored in a pool with LRU eviction policy, in short temporary storage FIXED When displaying a standalone image, Firefox matches the EXIF orientation information contained within the JPEG image (298619) FIXED Text Rendering Issues on Windows 7 with Platform Update KB2670838 (MSIE 10 Prerequisite) or on Windows 8.1 (812695) FIXED Improved page load times due to no longer decoding images that aren't visible (847223) FIXED AudioToolbox MP3 backend for OSX (914479) FIXED Various security fixes Fixed in Firefox 26 MFSA 2013-117 Mis-issued ANSSI/DCSSI certificate MFSA 2013-116 JPEG information leak MFSA 2013-115 GetElementIC typed array stubs can be generated outside observed typesets MFSA 2013-114 Use-after-free in synthetic mouse movement MFSA 2013-113 Trust settings for built-in roots ignored during EV certificate validation MFSA 2013-112 Linux clipboard information disclosure though selection paste MFSA 2013-111 Segmentation violation when replacing ordered list elements MFSA 2013-110 Potential overflow in JavaScript binary search algorithms MFSA 2013-109 Use-after-free during Table Editing MFSA 2013-108 Use-after-free in event listeners MFSA 2013-107 Sandbox restrictions not applied to nested object elements MFSA 2013-106 Character encoding cross-origin XSS attack MFSA 2013-105 Application Installation doorhanger persists on navigation MFSA 2013-104 Miscellaneous memory safety hazards (rv:26.0 / rv:24.2)
2013-12-15 14:54:37 +01:00
CONFIGURE_ARGS+= --disable-updater
Update to 23.0 * Install SDK to firefox-sdk directory. * Split multiple CONFIGURE_ARS's arguments. * Enable libmozjs.so build. Changelog: NEW Mixed content blocking enabled to protects users from man-in-the-middle attacks and eavesdroppers on HTTPS pages (learn more) NEW Options panel created for Web Developer Toolbox CHANGED "Enable JavaScript" preference checkbox has been removed and user-set values will be reset to the default CHANGED Updated Firefox Logo CHANGED Improved about:memory's functional UI CHANGED Simplified interface for notifications of plugin installation CHANGED Enabled DXVA2 on Windows Vista+ to accelerate H.264 video decoding CHANGED Users can now switch to a new search provider across the entire browser CHANGED CSP policies using the standard syntax and semantics will now be enforced CHANGED <input type='file'> rendering improvements (see bug 838675) CHANGED Replace fixed-ratio audio resampler in webrtc.org capture code with Speex resampler and eliminate pseudo-44000Hz rate CHANGED "Load images automatically" and Always show the tab bar" checkboxes removed from preferences and reset to defaults DEVELOPER HTML5 <input type="range"> form control implemented DEVELOPER Write more accessible pages on touch interfaces with new ARIA role for key buttons DEVELOPER Social share functionality DEVELOPER Added unprefixed requestAnimationFrame DEVELOPER Implemented a global browser console DEVELOPER Dropped blink effect from text-decoration: blink; and completely removed <blink> element DEVELOPER New feature in toolbox: Network Monitor FIXED Various security fixes n Firefox 23 MFSA 2013-75 Local Java applets may read contents of local file system MFSA 2013-74 Firefox full and stub installer DLL hijacking MFSA 2013-73 Same-origin bypass with web workers and XMLHttpRequest MFSA 2013-72 Wrong principal used for validating URI for some Javascript components MFSA 2013-71 Further Privilege escalation through Mozilla Updater MFSA 2013-70 Bypass of XrayWrappers using XBL Scopes MFSA 2013-69 CRMF requests allow for code execution and XSS attacks MFSA 2013-68 Document URI misrepresentation and masquerading MFSA 2013-67 Crash during WAV audio file decoding MFSA 2013-66 Buffer overflow in Mozilla Maintenance Service and Mozilla Updater MFSA 2013-65 Buffer underflow when generating CRMF requests MFSA 2013-64 Use after free mutating DOM during SetBody MFSA 2013-63 Miscellaneous memory safety hazards (rv:23.0 / rv:17.0.8)
2013-08-07 14:17:54 +02:00
Update to 69.0 * Use clang to compile all files. Mix of gcc and clang causes some errors in Rust c++ command invocation (C++ header mismatches). Changelog: New Enhanced Tracking Protection (ETP) rolls out stronger privacy protections: The default standard setting for this feature now blocks third-party tracking cookies and cryptominers. The optional strict setting blocks fingerprinters as well as the items blocked in the standard setting. The Block Autoplay feature is enhanced to give users the option to block any video that automatically starts playing, not just those that automatically play with sound. For our users in the US or using the en-US browser, we are shipping a new “New Tab” page experience that connects you to the best of Pocket’s content. Support for the Web Authentication HmacSecret extension via Windows Hello now comes with this release, for versions of Windows 10 May 2019 or newer, enabling more passwordless experiences on the web. Support for receiving multiple video codecs with this release makes it easier for WebRTC conferencing services to mix video from different clients. For our users on Windows 10, you’ll see performance and UI improvements: Firefox will give Windows hints to appropriately set content process priority levels, meaning more processor time spent on the tasks you're actively working on, and less processor time spent on things in the background (with the exception of video and audio playback). For our existing Windows 10 users, you can easily find and launch Firefox from a shortcut on the Win10 taskbar. For our users on macOS, battery life and download UI are both improved: macOS users on dual-graphics-card machines (like MacBook Pro) will switch back to the low-power GPU more aggressively, saving battery life. Finder on macOS now displays download progress for files being downloaded. JIT support comes to ARM64 for improved performance of our JavaScript Optimizing JIT compiler. Fixed Various security fixes Changed As previously announced in the Plugin Roadmap for Firefox, the "Always Activate" option for Flash plugin content has been removed. Firefox will now always ask for user permission before activating Flash content on a website. With the deprecation of Adobe Flash Player, there is no longer a need to identify users on 32-bit version of the Firefox browser on 64-bit version operating systems reducing user agent fingerprinting factors providing greater level of privacy to our users as well as improving the experience of downloading other apps. Firefox no longer loads userChrome.css or userContent.css by default improving start-up performance. Users who wish to customize Firefox by using these files can set the toolkit.legacyUserProfileCustomizations.stylesheets preference to true to restore this ability. Enterprise For Enterprise system administrators that manage macOS computers, we begin shipping a Mozilla signed PKG installer to simplify your deployments. Developer For our mobile web developers, we have migrated remote debugging from the old WebIDE into a re-designed about:debugging, making debugging GeckoView on remote devices via USB rock solid. The network panel will now show blocked resources to allow developers to best understand the impact of content blocking and ad blocking extensions given our ongoing expansion of Enhanced Tracking Protection to all users with this release. The new event listener breakpoint feature allows developers to pause on a host of different event types, whether it be related to animations, DOM, media, mouse, touch, worker, and many other event types. Firefox Developer Tools now offers an audit for the presence of text alternatives for non-text content, the a11y panel checks toolbar has been augmented to better help developers adhere to WCAG Guideline 1.1. Security fixes: #CVE-2019-11751: Malicious code execution through command line parameters #CVE-2019-11746: Use-after-free while manipulating video #CVE-2019-11744: XSS by breaking out of title and textarea elements using innerHTML #CVE-2019-11742: Same-origin policy violation with SVG filters and canvas to steal cross-origin images #CVE-2019-11736: File manipulation and privilege escalation in Mozilla Maintenance Service #CVE-2019-11753: Privilege escalation with Mozilla Maintenance Service in custom Firefox installation location #CVE-2019-11752: Use-after-free while extracting a key value in IndexedDB #CVE-2019-9812: Sandbox escape through Firefox Sync #CVE-2019-11741: Isolate addons.mozilla.org and accounts.firefox.com #CVE-2019-11743: Cross-origin access to unload event attributes #CVE-2019-11749: Camera information available without prompting using getUserMedia #CVE-2019-5849: Out-of-bounds read in Skia #CVE-2019-11750: Type confusion in Spidermonkey #CVE-2019-11737: Content security policy directives ignore port and path if host is a wildcard #CVE-2019-11738: Content security policy bypass through hash-based sources in directives #CVE-2019-11747: 'Forget about this site' removes sites from pre-loaded HSTS list #CVE-2019-11734: Memory safety bugs fixed in Firefox 69 #CVE-2019-11735: Memory safety bugs fixed in Firefox 69 and Firefox ESR 68.1 #CVE-2019-11740: Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9
2019-09-06 05:00:23 +02:00
#CONFIGURE_ARGS+= --with-libclang-path=${PREFIX}/lib
SUBST_CLASSES+= fix-paths
SUBST_STAGE.fix-paths= pre-configure
SUBST_MESSAGE.fix-paths= Fixing absolute paths.
SUBST_FILES.fix-paths+= ${MOZILLA_DIR}xpcom/io/nsAppFileLocationProvider.cpp
SUBST_SED.fix-paths+= -e 's,/usr/lib/mozilla/plugins,${PREFIX}/lib/netscape/plugins,g'
CONFIG_GUESS_OVERRIDE+= ${MOZILLA_DIR}build/autoconf/config.guess
CONFIG_GUESS_OVERRIDE+= ${MOZILLA_DIR}js/src/build/autoconf/config.guess
CONFIG_GUESS_OVERRIDE+= ${MOZILLA_DIR}nsprpub/build/autoconf/config.guess
CONFIG_GUESS_OVERRIDE+= ${MOZILLA_DIR}/js/ctypes/libffi/config.guess
CONFIG_SUB_OVERRIDE+= ${MOZILLA_DIR}build/autoconf/config.sub
CONFIG_SUB_OVERRIDE+= ${MOZILLA_DIR}js/src/build/autoconf/config.sub
CONFIG_SUB_OVERRIDE+= ${MOZILLA_DIR}nsprpub/build/autoconf/config.sub
CONFIG_SUB_OVERRIDE+= ${MOZILLA_DIR}/js/ctypes/libffi/config.sub
2020-03-12 20:34:56 +01:00
CONFIGURE_ENV+= CPP=${CPP:Q}
ALL_ENV+= SHELL=${CONFIG_SHELL:Q}
Update to 26.0 * Build outside WRKSRC, fix build Changelog: NEW All Java plug-ins are defaulted to 'click to play' NEW Password manager now supports script-generated password fields NEW Updates can now be performed by Windows users without write permissions to Firefox install directory (requires Mozilla Maintenance Service) NEW Support for H.264 on Linux if the appropriate gstreamer plug-ins are installed CHANGED Support for MP3 decoding on Windows XP, completing MP3 support across Windows OS versions CHANGED CSP implementation now supports multiple policies, including the case of both an enforced and Report-Only policy, per the spec DEVELOPER Social API now supports Social Bookmarking for multiple providers through its SocialMarks functionality (see MDN docs) DEVELOPER Math.ToFloat32 takes a JS value and converts it to a Float32, whenever possible DEVELOPER There is no longer a prompt when websites use appcache DEVELOPER Support for the CSS image orientation property DEVELOPER New App Manager allows you to deploy and debug HTML5 webapps on Firefox OS phones and the Firefox OS Simulator DEVELOPER IndexedDB can now be used as a "optimistic" storage area so it doesn't require any prompts and data is stored in a pool with LRU eviction policy, in short temporary storage FIXED When displaying a standalone image, Firefox matches the EXIF orientation information contained within the JPEG image (298619) FIXED Text Rendering Issues on Windows 7 with Platform Update KB2670838 (MSIE 10 Prerequisite) or on Windows 8.1 (812695) FIXED Improved page load times due to no longer decoding images that aren't visible (847223) FIXED AudioToolbox MP3 backend for OSX (914479) FIXED Various security fixes Fixed in Firefox 26 MFSA 2013-117 Mis-issued ANSSI/DCSSI certificate MFSA 2013-116 JPEG information leak MFSA 2013-115 GetElementIC typed array stubs can be generated outside observed typesets MFSA 2013-114 Use-after-free in synthetic mouse movement MFSA 2013-113 Trust settings for built-in roots ignored during EV certificate validation MFSA 2013-112 Linux clipboard information disclosure though selection paste MFSA 2013-111 Segmentation violation when replacing ordered list elements MFSA 2013-110 Potential overflow in JavaScript binary search algorithms MFSA 2013-109 Use-after-free during Table Editing MFSA 2013-108 Use-after-free in event listeners MFSA 2013-107 Sandbox restrictions not applied to nested object elements MFSA 2013-106 Character encoding cross-origin XSS attack MFSA 2013-105 Application Installation doorhanger persists on navigation MFSA 2013-104 Miscellaneous memory safety hazards (rv:26.0 / rv:24.2)
2013-12-15 14:54:37 +01:00
# Build outside ${WRKSRC}
2014-06-22 10:56:08 +02:00
# Try to avoid conflict with config/makefiles/xpidl/Makefile.in
Update to 26.0 * Build outside WRKSRC, fix build Changelog: NEW All Java plug-ins are defaulted to 'click to play' NEW Password manager now supports script-generated password fields NEW Updates can now be performed by Windows users without write permissions to Firefox install directory (requires Mozilla Maintenance Service) NEW Support for H.264 on Linux if the appropriate gstreamer plug-ins are installed CHANGED Support for MP3 decoding on Windows XP, completing MP3 support across Windows OS versions CHANGED CSP implementation now supports multiple policies, including the case of both an enforced and Report-Only policy, per the spec DEVELOPER Social API now supports Social Bookmarking for multiple providers through its SocialMarks functionality (see MDN docs) DEVELOPER Math.ToFloat32 takes a JS value and converts it to a Float32, whenever possible DEVELOPER There is no longer a prompt when websites use appcache DEVELOPER Support for the CSS image orientation property DEVELOPER New App Manager allows you to deploy and debug HTML5 webapps on Firefox OS phones and the Firefox OS Simulator DEVELOPER IndexedDB can now be used as a "optimistic" storage area so it doesn't require any prompts and data is stored in a pool with LRU eviction policy, in short temporary storage FIXED When displaying a standalone image, Firefox matches the EXIF orientation information contained within the JPEG image (298619) FIXED Text Rendering Issues on Windows 7 with Platform Update KB2670838 (MSIE 10 Prerequisite) or on Windows 8.1 (812695) FIXED Improved page load times due to no longer decoding images that aren't visible (847223) FIXED AudioToolbox MP3 backend for OSX (914479) FIXED Various security fixes Fixed in Firefox 26 MFSA 2013-117 Mis-issued ANSSI/DCSSI certificate MFSA 2013-116 JPEG information leak MFSA 2013-115 GetElementIC typed array stubs can be generated outside observed typesets MFSA 2013-114 Use-after-free in synthetic mouse movement MFSA 2013-113 Trust settings for built-in roots ignored during EV certificate validation MFSA 2013-112 Linux clipboard information disclosure though selection paste MFSA 2013-111 Segmentation violation when replacing ordered list elements MFSA 2013-110 Potential overflow in JavaScript binary search algorithms MFSA 2013-109 Use-after-free during Table Editing MFSA 2013-108 Use-after-free in event listeners MFSA 2013-107 Sandbox restrictions not applied to nested object elements MFSA 2013-106 Character encoding cross-origin XSS attack MFSA 2013-105 Application Installation doorhanger persists on navigation MFSA 2013-104 Miscellaneous memory safety hazards (rv:26.0 / rv:24.2)
2013-12-15 14:54:37 +01:00
OBJDIR= ../build
CONFIGURE_DIRS= ${OBJDIR}
CONFIGURE_SCRIPT= ${WRKSRC}/configure
Update to 26.0 * Build outside WRKSRC, fix build Changelog: NEW All Java plug-ins are defaulted to 'click to play' NEW Password manager now supports script-generated password fields NEW Updates can now be performed by Windows users without write permissions to Firefox install directory (requires Mozilla Maintenance Service) NEW Support for H.264 on Linux if the appropriate gstreamer plug-ins are installed CHANGED Support for MP3 decoding on Windows XP, completing MP3 support across Windows OS versions CHANGED CSP implementation now supports multiple policies, including the case of both an enforced and Report-Only policy, per the spec DEVELOPER Social API now supports Social Bookmarking for multiple providers through its SocialMarks functionality (see MDN docs) DEVELOPER Math.ToFloat32 takes a JS value and converts it to a Float32, whenever possible DEVELOPER There is no longer a prompt when websites use appcache DEVELOPER Support for the CSS image orientation property DEVELOPER New App Manager allows you to deploy and debug HTML5 webapps on Firefox OS phones and the Firefox OS Simulator DEVELOPER IndexedDB can now be used as a "optimistic" storage area so it doesn't require any prompts and data is stored in a pool with LRU eviction policy, in short temporary storage FIXED When displaying a standalone image, Firefox matches the EXIF orientation information contained within the JPEG image (298619) FIXED Text Rendering Issues on Windows 7 with Platform Update KB2670838 (MSIE 10 Prerequisite) or on Windows 8.1 (812695) FIXED Improved page load times due to no longer decoding images that aren't visible (847223) FIXED AudioToolbox MP3 backend for OSX (914479) FIXED Various security fixes Fixed in Firefox 26 MFSA 2013-117 Mis-issued ANSSI/DCSSI certificate MFSA 2013-116 JPEG information leak MFSA 2013-115 GetElementIC typed array stubs can be generated outside observed typesets MFSA 2013-114 Use-after-free in synthetic mouse movement MFSA 2013-113 Trust settings for built-in roots ignored during EV certificate validation MFSA 2013-112 Linux clipboard information disclosure though selection paste MFSA 2013-111 Segmentation violation when replacing ordered list elements MFSA 2013-110 Potential overflow in JavaScript binary search algorithms MFSA 2013-109 Use-after-free during Table Editing MFSA 2013-108 Use-after-free in event listeners MFSA 2013-107 Sandbox restrictions not applied to nested object elements MFSA 2013-106 Character encoding cross-origin XSS attack MFSA 2013-105 Application Installation doorhanger persists on navigation MFSA 2013-104 Miscellaneous memory safety hazards (rv:26.0 / rv:24.2)
2013-12-15 14:54:37 +01:00
PLIST_VARS+= sps vorbis tremor glskia throwwrapper mozglue ffvpx
.include "../../mk/endian.mk"
2013-08-29 22:49:26 +02:00
.if ${MACHINE_ENDIAN} == "little"
PLIST.glskia= yes
.endif
.if ${MACHINE_ARCH} == "aarch64" || \
!empty(MACHINE_ARCH:M*arm*) || \
${MACHINE_ARCH} == "i386" || \
${MACHINE_ARCH} == "x86_64"
PLIST.ffvpx= yes # see media/ffvpx/ffvpxcommon.mozbuild
.endif
.if ${MACHINE_ARCH} != "sparc64"
# For some reasons the configure test for GCC bug 26905 still triggers on
# sparc64, which makes mozilla skip the installation of a few wrapper headers.
# Other archs end up with one additional file in the SDK headers
PLIST.throwwrapper= yes
.endif
.if !empty(MACHINE_PLATFORM:S/i386/x86/:MLinux-*-x86*)
PLIST.sps= yes
.endif
.if !empty(MACHINE_PLATFORM:MLinux-*-arm*)
PLIST.tremor= yes
.else
PLIST.vorbis= yes
.endif
# See ${WRKSRC}/mozglue/build/moz.build: libmozglue is built and
# installed as a shared library on these platforms.
.if ${OPSYS} == "Cygwin" || ${OPSYS} == "Darwin" # or Android
PLIST.mozglue= yes
.endif
Fix many issues on Darwin PLIST: * lib/firefox/libmozglue.so is built and installed as a shared library on some platforms including Darwin. mozilla-common.mk: * Sandboxing support is only available when the toolkit is cairo-cocoa. * It tries to use MacOS X 10.6 SDK by default, which is not always possible. patches/patch-build_gyp.mozbuild: * Don't assume iOS just because the toolkit is not cocoa. Ideally there should be an AC_SUBST just like 'ARM_ARCH' but nothing exists currently. * MacOS X SDK version should be able to configure with ./configure --enable-macos-target=VER patches/patch-extensions_spellcheck_hunspell_src_mozHunspell.cpp: * NS_NewNativeLocalFile() can fail and leave hunDir null, so we must check if it succeeded. This is not Darwin specific though. * "%%LOCALBASE%%" in the hunspell path is currently not substituted, which looks very erroneous to me. But since I don't know why ryoon@ changed it from "@PREFIX@" to "%%LOCALBASE%%" I leave it as it is. patches/patch-ipc_glue_moz.build: * Don't assume cocoa toolkit just because OS_ARCH is Darwin. patches/patch-js_src_asmjs_AsmJSSignalHandlers.cpp: * Increase portability for non-x86 Darwin by not hardwiring x86_THREAD_STATE. patches/patch-js_xpconnect_src_xpcprivate.h: * The declaration has to be C++11 'extern template', otherwise non-weak symbol collision will occur between libmozjs and libxul. We can't easily test if the feature is supported by compiler due to GCC bug #1773: http://gcc.gnu.org/bugzilla/show_bug.cgi?id=1773 patches/patch-memory_mozalloc_VolatileBufferOSX.cpp: * Try to fallback to valloc(3) if posix_memalign(3) is not avialble. It has been added since MacOS 10.6. patches/patch-toolkit_library_moz.build: * GSTREAMER_LIBS are linked to libxul on Darwin, while they are dlopen(3)'ed at runtime on other platforms. The problem is that the toolkit being cocoa isn't relevant at all. It's Darwin that needs the special handling, not Cocoa. patches/patch-toolkit_xre_nsAppRunner.cpp: * MacOS X < 10.6 had an undocumented behavior concerning execve(2) inside a threaded process. If a process tried to call execve(2) and had more than one active thread, the kernel returned ENOTSUP. So we have to either fork(2) or vfork(2) before calling execve(2) to make sure the caller is single-threaded as otherwise the application fails to restart itself. patches/patch-xpcom_base_nsStackWalk.cpp, patches/patch-xpcom_build_PoisonIOInterposer.h: * Replace XP_MACOSX with XP_DARWIN as the former is not defined when the toolkit is not cocoa. patches/patch-xpcom_glue_standalone_nsXPCOMGlue.cpp: * Fix inconsistent use of XP_DARWIN and XP_MACOSX: LEADING_UNDERSCORE should be empty when we are going to load XPCOM using dlopen(3), not NSAddImage().
2015-01-30 08:32:24 +01:00
# See ${WRKSRC}/security/sandbox/mac/Sandbox.mm: On Darwin, sandboxing
# support is only available when the toolkit is cairo-cocoa.
2016-02-26 11:57:45 +01:00
CONFIGURE_ARGS.Darwin+= --disable-sandbox
Fix many issues on Darwin PLIST: * lib/firefox/libmozglue.so is built and installed as a shared library on some platforms including Darwin. mozilla-common.mk: * Sandboxing support is only available when the toolkit is cairo-cocoa. * It tries to use MacOS X 10.6 SDK by default, which is not always possible. patches/patch-build_gyp.mozbuild: * Don't assume iOS just because the toolkit is not cocoa. Ideally there should be an AC_SUBST just like 'ARM_ARCH' but nothing exists currently. * MacOS X SDK version should be able to configure with ./configure --enable-macos-target=VER patches/patch-extensions_spellcheck_hunspell_src_mozHunspell.cpp: * NS_NewNativeLocalFile() can fail and leave hunDir null, so we must check if it succeeded. This is not Darwin specific though. * "%%LOCALBASE%%" in the hunspell path is currently not substituted, which looks very erroneous to me. But since I don't know why ryoon@ changed it from "@PREFIX@" to "%%LOCALBASE%%" I leave it as it is. patches/patch-ipc_glue_moz.build: * Don't assume cocoa toolkit just because OS_ARCH is Darwin. patches/patch-js_src_asmjs_AsmJSSignalHandlers.cpp: * Increase portability for non-x86 Darwin by not hardwiring x86_THREAD_STATE. patches/patch-js_xpconnect_src_xpcprivate.h: * The declaration has to be C++11 'extern template', otherwise non-weak symbol collision will occur between libmozjs and libxul. We can't easily test if the feature is supported by compiler due to GCC bug #1773: http://gcc.gnu.org/bugzilla/show_bug.cgi?id=1773 patches/patch-memory_mozalloc_VolatileBufferOSX.cpp: * Try to fallback to valloc(3) if posix_memalign(3) is not avialble. It has been added since MacOS 10.6. patches/patch-toolkit_library_moz.build: * GSTREAMER_LIBS are linked to libxul on Darwin, while they are dlopen(3)'ed at runtime on other platforms. The problem is that the toolkit being cocoa isn't relevant at all. It's Darwin that needs the special handling, not Cocoa. patches/patch-toolkit_xre_nsAppRunner.cpp: * MacOS X < 10.6 had an undocumented behavior concerning execve(2) inside a threaded process. If a process tried to call execve(2) and had more than one active thread, the kernel returned ENOTSUP. So we have to either fork(2) or vfork(2) before calling execve(2) to make sure the caller is single-threaded as otherwise the application fails to restart itself. patches/patch-xpcom_base_nsStackWalk.cpp, patches/patch-xpcom_build_PoisonIOInterposer.h: * Replace XP_MACOSX with XP_DARWIN as the former is not defined when the toolkit is not cocoa. patches/patch-xpcom_glue_standalone_nsXPCOMGlue.cpp: * Fix inconsistent use of XP_DARWIN and XP_MACOSX: LEADING_UNDERSCORE should be empty when we are going to load XPCOM using dlopen(3), not NSAddImage().
2015-01-30 08:32:24 +01:00
# See ${WRKSRC}/configure.in: It tries to use MacOS X 10.6 SDK by
# default, which is not always possible.
.if !empty(MACHINE_PLATFORM:MDarwin-8.*-*)
CONFIGURE_ARGS+= --enable-macos-target=10.4
.elif !empty(MACHINE_PLATFORM:MDarwin-9.*-*)
CONFIGURE_ARGS+= --enable-macos-target=10.5
.endif
# Makefiles sometimes call "rm -f" without more arguments. Kludge around ...
.PHONY: create-rm-wrapper
pre-configure: create-rm-wrapper
create-rm-wrapper:
printf '#!/bin/sh\n[ "$$*" = "-f" ] && exit 0\nexec /bin/rm $$@\n' > \
${WRAPPER_DIR}/bin/rm
chmod +x ${WRAPPER_DIR}/bin/rm
# The configure test for __thread succeeds, but later we end up with:
# dist/bin/libxul.so: undefined reference to `__tls_get_addr'
2016-02-26 11:57:45 +01:00
CONFIGURE_ENV.NetBSD+= ac_cv_thread_keyword=no
# In unspecified case, clock_gettime(CLOCK_MONOTONIC, ...) fails.
CONFIGURE_ENV.NetBSD+= ac_cv_clock_monotonic=
.if ${OPSYS} == "OpenBSD"
PLIST_SUBST+= DLL_SUFFIX=".so.1.0"
.elif ${OPSYS} == "Darwin"
PLIST_SUBST+= DLL_SUFFIX=".dylib"
.else
PLIST_SUBST+= DLL_SUFFIX=".so"
.endif
# PR pkg/55456
.if ${OPSYS} == "NetBSD" && ${MACHINE_ARCH} == "i386"
.include "../../devel/libatomic/buildlink3.mk"
CONFIGURE_ENV.NetBSD+= ac_cv_needs_atomic=yes
.endif
BUILDLINK_API_DEPENDS.libevent+= libevent>=1.1
.include "../../devel/libevent/buildlink3.mk"
.include "../../devel/libffi/buildlink3.mk"
firefox: update to 79.0 New We’ve rolled out WebRender to more Windows users with Intel and AMD GPUs, bringing improved graphics performance to an even larger audience. Firefox users in Germany will now see more Pocket recommendations in their new tab featuring some of the best stories on the web. If you don’t see them, you can turn on Pocket articles in your new tab by following these steps. Fixed Various security fixes. Several crashes while using a screen reader were fixed, including a frequently encountered crash when using the JAWS screen reader. Firefox Developer Tools received significant fixes allowing screen reader users to benefit from some of the tools that were previously inaccessible. SVG title and desc elements (labels and descriptions) are now correctly exposed to assistive technology products such as screen readers. Enterprise A number of bug fixes and new policies have been implemented in the latest version of Firefox. You can see more details in the Firefox for Enterprise 79 Release Notes. Updates to the password policy allow admins to require a primary password (formerly called master password. Previously the policy could disable the primary password but not force a primary password. Users required to use a primary password will only be asked to create a primary password the first time they try to save a password. Developer Developer Information Newly added asynchronous call stacks let developers trace their async code through events, timeouts, and promises. The async execution chains are shown in the Debugger’s call stack, but also for stack traces in Console errors and Network initiators. Erroneous network responses with 4xx/5xx status codes display as errors in the Console, making it easy to understand them in the context of related logs. The request/response details can be expanded or resent for quick debugging. JavaScript errors are now visible not only in the Console, but also in the Debugger. The relevant line of code will be highlighted and display error details on hover. Opening SCSS and CSS-in-JS sources from the Inspector now works more reliably thanks to improved source map handling across all panels. Inspecting accessibility properties from the browser context menu is now available to all users by default.
2020-07-31 03:26:43 +02:00
BUILDLINK_API_DEPENDS.nspr+= nspr>=4.26
.include "../../devel/nspr/buildlink3.mk"
Update to 24.0, ESR edition. * Merge some patches via FreeBSD ports. * Tested on NetBSD/amd64 6.99.23 and DragonFly/amd64 3.4.1. * Use system hunspell dictionaries. * DuckDuckGo search window. * Enable system icu support. Changelog: NEW Support for new scrollbar style in Mac OS X 10.7 and newer NEW Implemented Close tabs to the right NEW Social: Ability to tear-off chat windows to view separately by simply dragging them out CHANGED Accessibility related improvements on using pinned tabs (see 577727) CHANGED Removed support for Revocation Lists feature (see 867465) CHANGED Performance improvements on New Tab Page loads (see 791670) DEVELOPER Major SVG rendering improvements around Image tiling and scaling (see 600207 ) DEVELOPER Improved and unified Browser console for enhanced debugging experience, replacing existing Error console DEVELOPER Removed support for sherlock files that are loaded from application or profile directory FIXED Replace fixed-ratio audio resampler in webrtc.org capture code with Speex resampler and eliminate pseudo-44000Hz rate ( see 886886) FIXED 24.0: Security fixes can be found here Fixed in Firefox 24 MFSA 2013-92 GC hazard with default compartments and frame chain restoration MFSA 2013-91 User-defined properties on DOM proxies get the wrong "this" object MFSA 2013-90 Memory corruption involving scrolling MFSA 2013-89 Buffer overflow with multi-column, lists, and floats MFSA 2013-88 compartment mismatch re-attaching XBL-backed nodes MFSA 2013-87 Shared object library loading from writable location MFSA 2013-86 WebGL Information disclosure through OS X NVIDIA graphic drivers MFSA 2013-85 Uninitialized data in IonMonkey MFSA 2013-84 Same-origin bypass through symbolic links MFSA 2013-83 Mozilla Updater does not lock MAR file after signature verification MFSA 2013-82 Calling scope for new Javascript objects can lead to memory corruption MFSA 2013-81 Use-after-free with select element MFSA 2013-80 NativeKey continues handling key messages after widget is destroyed MFSA 2013-79 Use-after-free in Animation Manager during stylesheet cloning MFSA 2013-78 Integer overflow in ANGLE library MFSA 2013-77 Improper state in HTML5 Tree Builder with templates MFSA 2013-76 Miscellaneous memory safety hazards (rv:24.0 / rv:17.0.9)
2013-09-19 14:37:49 +02:00
.include "../../textproc/icu/buildlink3.mk"
firefox: Update to 80.0 Changelog: New Firefox can now be set as the default system PDF viewer. The name reported by accessibility tools for items in multi-tiered tree controls no longer incorrectly includes information from items at deeper levels, providing users with the correct level of content when using a screen reader. Fixed Various security fixes. Several crashes while using a screen reader were fixed including a frequently encountered crash when using the JAWS screen reader. Firefox Developer Tools received significant fixes allowing screen reader users to benefit from some of the tools that were previously inaccessible. SVG title and desc elements (labels and descriptions) are now correctly exposed to assistive technology products such as screen readers. Changed For users with reduced motion settings, we've reduced a number of animations such as tab loading to reduce motion for users with migraines and epilepsy. The new add-ons blocklist has been enabled to improve performance and scalability. Enterprise A number of bug fixes and new policies have been implemented in the latest version of Firefox. You can see more details in the Firefox for Enterprise 80 Release Notes. Today's release is the final scheduled for Firefox 68 ESR (68.12) unless there is a critical security issue found prior to the release of Firefox ESR 78.3 on September 22, 2020. Users of Firefox 68 ESR will be automatically upgraded to the Firefox 78 ESR series with the release of 78.3. Developer We've shipped an experimental sidebar panel in the inspector to Firefox Developer Edition that helps developers more quickly identify potential browser compatibility problems based on MDN data. In the Network Monitor request list, a turtle icon is shown for "slow" requests that exceed a threshold for the waiting time. Firefox now supports RTX and Transport-cc for improved call quality in poor network conditions and better bandwidth estimation. These features also provide better compatibility with many websites using WebRTC. Security fixes: #CVE-2020-15663: Downgrade attack on the Mozilla Maintenance Service could have resulted in escalation of privilege #CVE-2020-15664: Attacker-induced prompt for extension installation #CVE-2020-12401: Timing-attack on ECDSA signature generation #CVE-2020-6829: P-384 and P-521 vulnerable to an electro-magnetic side channel attack on signature generation #CVE-2020-12400: P-384 and P-521 vulnerable to a side channel attack on modular inversion #CVE-2020-15665: Address bar not reset when choosing to stay on a page after the beforeunload dialog is shown #CVE-2020-15666: MediaError message property leaks cross-origin response status #CVE-2020-15667: Heap overflow when processing an update file #CVE-2020-15668: Data Race when reading certificate information #CVE-2020-15670: Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2
2020-08-25 16:35:24 +02:00
BUILDLINK_API_DEPENDS.nss+= nss>=3.55
.include "../../devel/nss/buildlink3.mk"
.include "../../devel/zlib/buildlink3.mk"
Update to 63.0.1 * Minimize pkgsrc specific patches. * A build system written in Rust lang does not find a C++ header files from pkgsrc (non-base) GCC, this version is not buildable on NetBSD 7. I will investigate this problem again. Changelog: 63.0.1 Fixed Snippets are not loaded due to missing element (bug 1503047) Print preview always shows 30% scale when it is actually Shrink To Fit (bug 1501952) Dialog displayed when closing multiple windows shows unreplaced %1$S placeholder in Japanese and potentially other locales (bug 1500823) 63.0 New Performance and visual improvements for Windows users Performance improvements for macOS users Added content blocking, a collection of Firefox settings that offer users greater control over technology that can track them around the web. In 63, users can opt to block third-party tracking cookies or block all trackers and create exceptions for trusted sites that don't work correctly with content blocking enabled. WebExtensions now run in their own process on Linux Firefox now warns about having multiple windows and tabs open when quitting from the main menu. The Save and Quit feature has been removed. You can restore your session by ticking the box for Restore previous session in the General->Startup options or by using Restore Previous Session in the main menu. Firefox now recognizes the operating system accessibility setting for reducing animation Added search shortcuts for Top Sites: Amazon and Google appear as Top Sites tiles on the Firefox Home (New Tab) page. When selected these tiles will change focus to the address bar to initiate a search. Currently in US only. Fixed Resolved an issue that prevented the address bar from autofilling bookmarked URLs in certain cases Various security fixes Changed In the Library, the Open in Sidebar feature for individual bookmarks was removed The option to Never check for updates was removed from about:preferences. You can use the DisableAppUpdate enterprise policy as a substitute. The Ctrl+Tab shortcut now displays thumbnail previews of your tabs and cycles through tabs in recently used order. This new default behavior is activated only in new profiles and can be changed in preferences. #CVE-2018-12391: HTTP Live Stream audio data is accessible cross-origin #CVE-2018-12392: Crash with nested event loops #CVE-2018-12393: Integer overflow during Unicode conversion while loading JavaScript #CVE-2018-12395: WebExtension bypass of domain restrictions through header rewriting #CVE-2018-12396: WebExtension content scripts can execute in disallowed contexts #CVE-2018-12397: Missing warning prompt when WebExtension requests local file access #CVE-2018-12398: CSP bypass through stylesheet injection in resource URIs #CVE-2018-12399: Spoofing of protocol registration notification bar #CVE-2018-12400: Favicons are cached in private browsing mode on Firefox for Android #CVE-2018-12401: DOS attack through special resource URI parsing #CVE-2018-12402: SameSite cookies leak when pages are explicitly saved #CVE-2018-12403: Mixed content warning is not displayed when HTTPS page loads a favicon over HTTP #CVE-2018-12388: Memory safety bugs fixed in Firefox 63 #CVE-2018-12390: Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3
2018-11-04 01:38:44 +01:00
#.include "../../mk/jpeg.buildlink3.mk"
.include "../../graphics/MesaLib/buildlink3.mk"
Update to 59.0.1 Changelog: 59.0.1 Security fix #CVE-2018-5146: Out of bounds memory write in libvorbis 59.0 New Performance enhancements: - Faster load times for content on the Firefox Home page - Faster page load times by loading either from the networked cache or the cache on the user's hard drive (Race Cache With Network) - Improved graphics rendering using Off-Main-Thread Painting (OMTP) for Mac users (OMTP for Windows was released in Firefox 58) Drag-and-drop to rearrange Top Sites on the Firefox Home page, and customize new windows and tabs in other ways Added features for Firefox Screenshots: - Basic annotation lets the user draw on and highlight saved screenshots - Recropping to change the viewable area of saved screenshots Enhanced WebExtensions API including better support for decentralized protocols and the ability to dynamically register content scripts Improved Real-Time Communications (RTC) capabilities. - Implemented RTP Transceiver to give pages more fine grained control over calls - Implemented features to support large scale conferences Added support for W3C specs for pointer events and improved platform integration with added device support for mouse, pen, and touch screen pointer input Added the Ecosia search engine as an option for German Firefox Added the Qwant search engine as an option for French Firefox Added settings in about:preferences to stop websites from asking to send notifications or access your device's camera, microphone, and location, while still allowing trusted websites to use these features Fixed Various security fixes Changed Firefox Private Browsing Mode will remove path information from referrers to prevent cross-site tracking Security fixes: #CVE-2018-5127: Buffer overflow manipulating SVG animatedPathSegList #CVE-2018-5128: Use-after-free manipulating editor selection ranges #CVE-2018-5129: Out-of-bounds write with malformed IPC messages #CVE-2018-5130: Mismatched RTP payload type can trigger memory corruption #CVE-2018-5131: Fetch API improperly returns cached copies of no-store/no-cache resources #CVE-2018-5132: WebExtension Find API can search privileged pages #CVE-2018-5133: Value of the app.support.baseURL preference is not properly sanitized #CVE-2018-5134: WebExtensions may use view-source: URLs to bypass content restrictions #CVE-2018-5135: WebExtension browserAction can inject scripts into unintended contexts #CVE-2018-5136: Same-origin policy violation with data: URL shared workers #CVE-2018-5137: Script content can access legacy extension non-contentaccessible resources #CVE-2018-5138: Android Custom Tab address spoofing through long domain names #CVE-2018-5140: Moz-icon images accessible to web content through moz-icon: protocol #CVE-2018-5141: DOS attack through notifications Push API #CVE-2018-5142: Media Capture and Streams API permissions display incorrect origin with data: and blob: URLs #CVE-2018-5143: Self-XSS pasting javascript: URL with embedded tab into addressbar #CVE-2018-5126: Memory safety bugs fixed in Firefox 59 #CVE-2018-5125: Memory safety bugs fixed in Firefox 59 and Firefox ESR 52.7
2018-03-17 01:59:02 +01:00
#BUILDLINK_API_DEPENDS.cairo+= cairo>=1.10.2nb4
#.include "../../graphics/cairo/buildlink3.mk"
BUILDLINK_API_DEPENDS.libwebp+= libwebp>=1.0.2
.include "../../graphics/libwebp/buildlink3.mk"
# Force the use of clang from pkgsrc, regardless of the setting of
# PKGSRC_COMPILER.
# \todo This breaks the use of ccache, which should be fixed, probably
# by adding support for this kind of forcing to pkgsrc infrastructure.
PKG_CC= ${PREFIX}/bin/clang
PKG_CXX= ${PREFIX}/bin/clang++
BUILDLINK_DEPMETHOD.clang= build
.include "../../lang/clang/buildlink3.mk"
.if !empty(MACHINE_PLATFORM:MNetBSD-8.*-*)
BUILDLINK_DEPMETHOD.gcc8= full
.include "../../lang/gcc8/buildlink3.mk"
CWRAPPERS_PREPEND.cxx+= \
-L${BUILDLINK_PREFIX.gcc8}/gcc8/lib \
${COMPILER_RPATH_FLAG}${BUILDLINK_PREFIX.gcc8}/gcc8/lib \
-stdlib++-isystem \
${BUILDLINK_PREFIX.gcc8}/gcc8/include/c++ \
-stdlib++-isystem \
${BUILDLINK_PREFIX.gcc8}/gcc8/include/c++/${MACHINE_GNU_PLATFORM} \
-stdlib++-isystem \
${BUILDLINK_PREFIX.gcc8}/gcc8/include/c++/backward
.endif
RUST_REQ= 1.43.0
.include "../../lang/rust/rust.mk"
# webrtc option requires internal libvpx
#BUILDLINK_API_DEPENDS.libvpx+= libvpx>=1.3.0
#.include "../../multimedia/libvpx/buildlink3.mk"
.include "../../net/libIDL/buildlink3.mk"
Update to 53.0 Changelog: New Improved graphics stability for Windows users with the addition of compositor process separation (Quantum Compositor) Two new 'compact' themes available in Firefox, dark and light, based on the Firefox Developer Edition theme Lightweight themes are now applied in private browsing windows Reader Mode now displays estimated reading time for the page Windows 7+ users on 64-bit OS can select 32-bit or 64-bit versions in the stub installer Fixed Various security fixes Changed Updated the design of site permission requests to make them harder to miss and easier to understand Windows XP and Vista are no longer supported. XP and Vista users running Firefox 52 will continue to receive security updates on Firefox ESR 52. 32-bit Mac OS X is no longer supported. 32-bit Mac OS X users can switch to Firefox ESR 52 to continue receiving security updates. Updates for Mac OS X are smaller in size compared to updates for Firefox 52 New visual design for audio and video controls Ended Firefox Linux support for processors older than Pentium 4 and AMD Opteron The last few characters of shortened tab titles fade out instead of being replaced by ellipses to keep more of the title visible Security fixes: #CVE-2017-5433: Use-after-free in SMIL animation functions #CVE-2017-5435: Use-after-free during transaction processing in the editor #CVE-2017-5436: Out-of-bounds write with malicious font in Graphite 2 #CVE-2017-5461: Out-of-bounds write in Base64 encoding in NSS #CVE-2017-5459: Buffer overflow in WebGL #CVE-2017-5466: Origin confusion when reloading isolated data:text/html URL #CVE-2017-5434: Use-after-free during focus handling #CVE-2017-5432: Use-after-free in text input selection #CVE-2017-5460: Use-after-free in frame selection #CVE-2017-5438: Use-after-free in nsAutoPtr during XSLT processing #CVE-2017-5439: Use-after-free in nsTArray Length() during XSLT processing #CVE-2017-5440: Use-after-free in txExecutionState destructor during XSLT processing #CVE-2017-5441: Use-after-free with selection during scroll events #CVE-2017-5442: Use-after-free during style changes #CVE-2017-5464: Memory corruption with accessibility and DOM manipulation #CVE-2017-5443: Out-of-bounds write during BinHex decoding #CVE-2017-5444: Buffer overflow while parsing application/http-index-format content #CVE-2017-5446: Out-of-bounds read when HTTP/2 DATA frames are sent with incorrect data #CVE-2017-5447: Out-of-bounds read during glyph processing #CVE-2017-5465: Out-of-bounds read in ConvolvePixel #CVE-2017-5448: Out-of-bounds write in ClearKeyDecryptor #CVE-2017-5437: Vulnerabilities in Libevent library #CVE-2017-5454: Sandbox escape allowing file system read access through file picker #CVE-2017-5455: Sandbox escape through internal feed reader APIs #CVE-2017-5456: Sandbox escape allowing local file system access #CVE-2017-5469: Potential Buffer overflow in flex-generated code #CVE-2017-5445: Uninitialized values used while parsing application/http-index-format content #CVE-2017-5449: Crash during bidirectional unicode manipulation with animation #CVE-2017-5450: Addressbar spoofing using javascript: URI on Firefox for Android #CVE-2017-5451: Addressbar spoofing with onblur event #CVE-2017-5462: DRBG flaw in NSS #CVE-2017-5463: Addressbar spoofing through reader view on Firefox for Android #CVE-2017-5467: Memory corruption when drawing Skia content #CVE-2017-5452: Addressbar spoofing during scrolling with editable content on Firefox for Android #CVE-2017-5453: HTML injection into RSS Reader feed preview page through TITLE element #CVE-2017-5458: Drag and drop of javascript: URLs can allow for self-XSS #CVE-2017-5468: Incorrect ownership model for Private Browsing information #CVE-2017-5430: Memory safety bugs fixed in Firefox 53 and Firefox ESR 52.1 #CVE-2017-5429: Memory safety bugs fixed in Firefox 53, Firefox ESR 45.9, and Firefox ESR 52.1
2017-04-27 03:49:47 +02:00
# textproc/hunspell 1.3 is too old
#.include "../../textproc/hunspell/buildlink3.mk"
.include "../../multimedia/ffmpeg4/buildlink3.mk"
.include "../../x11/libXt/buildlink3.mk"
BUILDLINK_API_DEPENDS.pixman+= pixman>=0.25.2
.include "../../x11/pixman/buildlink3.mk"
.include "../../x11/gtk2/buildlink3.mk"
.include "../../x11/gtk3/buildlink3.mk"
PLIST_VARS+= wayland
.if ${PKG_BUILD_OPTIONS.gtk3:Mwayland}
PLIST.wayland= yes
.endif
.include "../../lang/python/pyversion.mk"