Commit graph

17072 commits

Author SHA1 Message Date
adam
c19ab1b1d6 py-django: updated to 1.11.8
Django 1.11.8 fixes several bugs in 1.11.7:
* Reallowed, following a regression in Django 1.10, AuthenticationForm to raise the inactive user error when using ModelBackend.
* Added support for QuerySet.values() and values_list() for union(), difference(), and intersection() queries.
* Fixed incorrect index name truncation when using a namespaced db_table.
* Made QuerySet.iterator() use server-side cursors on PostgreSQL after values() and values_list().
* Fixed crash on SQLite and MySQL when ordering by a filtered subquery that uses nulls_first or nulls_last.
* Made query lookups for CICharField, CIEmailField, and CITextField use a citext cast.
* Fixed a regression in caching of a GenericForeignKey when the referenced model instance uses multi-table inheritance.
* Fixed “Cannot change column ‘x’: used in a foreign key constraint” crash on MySQL with a sequence of AlterField and/or RenameField operations in a migration
2017-12-04 14:23:00 +00:00
morr
87b522fb40 Update to newest version, 4.9.1
This version fixes 4 security bugs from earlier versions.

For details, head to https://codex.wordpress.org/Version_4.9.1
For 4.9 changes, head to https://codex.wordpress.org/Version_4.9
2017-12-03 17:06:37 +00:00
wiz
42112bfdbc grafana: fix SITES.*, using variables doesn't seem to work 2017-12-03 11:06:24 +00:00
wiz
6e99b5c4e2 p5-CGI: update to 4.38.
4.38 2017-12-01

    [ TESTING ]
    - command_line.t: Avoid -I for libs (GH #224, thanks to cpansprout)
2017-12-03 08:49:53 +00:00
adam
e4cbe66351 py-selenium: updated to 3.8.0
Selenium 3.8.0
* Firefox options can now be imported from selenium.webdriver as FirefoxOptions
* Headless mode can now be set in Chrome Options using `set_headless`
* Headless mode can now be set in Firefox Options using `set_headless`
* Add the WebKitGTK WebDriver and options class
* Browser options can now be passed to remote WebDriver via the `options` parameter
* Browser option parameters are now standardized across drivers as `options`. `firefox_options`,
  `chrome_options`, and `ie_options` are now deprecated
* Added missing W3C Error Codes
* Support has been removed for Python versions 2.6 and 3.3
2017-12-01 10:02:29 +00:00
adam
6d894c17f8 py-terminado: updated to 0.8.1
0.8.1:
Bug fixes.
2017-12-01 08:56:12 +00:00
adam
8977d31a36 Revbump after textproc/icu update 2017-11-30 16:45:00 +00:00
adam
8d887cf3b1 Added ALTERNATIVES 2017-11-30 15:51:20 +00:00
adam
644ad5aaf0 py-asgiref: updated to 2.0.1
2.0.1:
* Bugfix release to have HTTP response content message as the correct
  "http.response.content" not the older "http.response.chunk".

2.0.0:
* Complete rewrite for new async-based ASGI mechanisms and removal of
  channel layers.
2017-11-30 08:01:48 +00:00
adam
9d76314e4d py-aiohttp: updated to 2.3.5
2.3.5:
Fix compatibility with pytest 3.3+

2.3.4:
Make request.app point to proper application instance when using nested applications (with middlewares).
Change base class of ClientConnectorSSLError to ClientSSLError from ClientConnectorError.
Return client connection back to free pool on error in connector.connect().
2017-11-30 07:57:59 +00:00
adam
d47547433d py-cherrypy: updated to 12.0.1
v12.0.1
* Fixed issues importing cherrypy.test.webtest (by creating
  a module and importing classes from cheroot) and added a
  corresponding DeprecationWarning.
2017-11-29 14:09:55 +00:00
adam
500f1f8867 py-cheroot: updated to 5.9.2
v5.9.2
- Re-release without spurious files in the distribution.
2017-11-29 14:07:50 +00:00
wiz
721d3964a8 libmicrohttpd: update to 0.9.57.
Mon Nov 27 22:24:00 MSK 2017
	Releasing GNU libmicrohttpd 0.9.57. -EG

Mon Nov 27 21:36:00 MSK 2017
	Updated README. -EG

Mon Nov 27 18:37:00 MSK 2017
	Corrected names in W32 DLL resources.
	Reordered and clarified configure summary message.
	Additional compiler warning mutes for builds with various configure
	parameters.
	Fixed tests on Cygwin.
	Used larger SETSIZE for Cygwin (same value as for native W32).
	Minor fixes for Cygwin.
	Added configure parameter to force disable usage of sendfile().
	Minor testsuite fixes.
	Really fixed builds with optimisation for size. -EG

Sat Nov 25 18:37:00 MSK 2017
	Fixed build with optimisation for size. -EG

Fri Nov 24 20:14:02 CET 2017
	Releasing GNU libmicrohttpd 0.9.56. -CG

Thu Nov 23 17:40:00 MSK 2017
	Added MHD_FEATURE_SENDFILE enum value and report. -EG

Thu Nov 23 08:56:00 MSK 2017
	Fixed receiving large requests in TLS mode with epoll.
	Improved GnuTLS and libgcrypt detection in configure, do not ignore
	flags in GNUTLS_{CFLAGS,LIBS} variables.
	Added special trick for Solaris/Openindiana to find GnuTLS-3 with
	right bitness.
	Added support for Solaris sendfile(3) function.
	Fixed dataraces with thread ID on W32 and pthread. Now check for
	correct thread in MHD_queue_response() works correctly.
	Fixed and silenced compiler warnings in tests and examples.
	Removed usage of TLS flags in examples where TLS is not required.
	Added support for MultiSSL in https tests with libcurl >= 7.56.0.
	Improved detection of OFF_T_MAX, SIZE_MAX. Added macros for
	SSIZE_MAX in mhd_limits.h. There are some platforms that really
	require those macros.
	Added support for Darwin's sendfile() function.
	Updated .gitignore files.
	Reworked mhd_sys_extentions.m4 with better support of modern
	platforms, more reliable detection of required macros, and
	detection of disabling of system-specific features by
	_XOPEN_SOURCE macro. -EG

Wed Nov  1 20:43:00 MSK 2017
	Mixed and muted many compiler warnings. Now GCC's flags
	-Wall -Wextra could be used for building.
	Fixed compilation of examples without libmagic.
	Better detection of libgnutls in configure.
	Reworked launch of nested configure in "po" directory to
	prevent useless reconfiguration.
	Fixed some wrong asserts.
	Enabled "test_options" test.
	Use "test_start_stop" without libcurl.
	Use chunks with sendfile() to prevent locking thread for
	single connection with large file.
	Added support for FreeBSD's sendfile with additional
	optimisations for FreeBSD 11.
	Refactoring and improvements for MHD_start_daemon_va() and
	MHD_stop_daemon().
	Fixed testing with GnuTLS >= 3.6.0. -EG

Mon Oct  9 22:38:07 CEST 2017
	Add MHD_free() to allow proper free()-ing of username/password
	data returned via MHD_digest_auth_get_username() or
	MHD_basic_auth_get_username_password() on Windows. -CG

Tue Sep 26 14:00:58 CEST 2017
	Fixing race involving setting "at_limit" flag. -CG

Tue Sep 08 21:39:00 MSK 2017
	Fixed build of examples when MHD build with non-pthread lib.
	MHD_queue_response(): added check for using in correct thread.
	Fixed sending responses larger 16 KiB in TLS mode with epoll.
	Improved doxy for MHD_get_timeout() and related functions.
	Minor internal refactoring. -EG

Tue Jul 23 11:32:00 MSK 2017
	Updated chunked_example.c to provide real illustration of usage of
	chunked encoding. -EG

Thu Jul 13 21:41:00 MSK 2017
	Restored SIGPIPE suppression in TLS mode.
	Added new value MHD_FEATURE_AUTOSUPPRESS_SIGPIPE so application could
	check whether SIGPIPE handling is required.
	Used GNUTLS_NONBLOCK for TLS sessions. -EG

Tue Jun 20 23:52:00 MSK 2017
	Libgcrypt is now optional and required only for old GnuTLS versions. -EG

Wed Jun 14 21:42:00 MSK 2017
	Added support for debug assert() and new configure parameter
	--enable-asserts for debug builds.
	Removed non-functional Symbian support. -EG

Mon Jun 05 23:34:00 MSK 2017
	More internal refactoring:
	merged MHD_tls_connection_handle_read/write() with non-TLS version,
	reduced and unified number of layers for network processing (before
	refactoring MHD_tls_connection_handle_read->MHD_connection_handle_read->
	do_read->recv_tls_adapter->GnuTLS->recv_param_adapter - 5 MHD layers;
	after refactoring MHD_connection_handle_read->recv_tls_adapter->GnuTLS -
	2 MHD layers),
	simplified and removed dead code from
	MHD_connection_handle_read/write() without functional change. -EG

Mon Jun 05 22:20:00 MSK 2017
	Internal refactoring:
	used TCP sockets directly with GnuTLS (performance improvement),
	moved some connection-related code from daemon.c to
	connection.c/connection_https.c,
	removed hacks around sendfile() and implemented correct support of
	sendfile(),
	removed do_read() and do_write() to reduce number of layer around send()
	and recv() and to improve readability and maintainability of code,
	implemented separate tracking of TLS layer state, independent of HTTP
	connection stage. -EG

Sun Jun 04 15:02:00 MSK 2017
	Improved thread-safety of MHD_add_connection() and
	internal_add_connection(), minor optimisations. -EG
2017-11-29 14:05:44 +00:00
wiz
68a44ee35b curl: update to 7.57.0.
Curl and libcurl 7.57.0

 o auth: add support for RFC7616 - HTTP Digest access authentication [12]
 o share: add support for sharing the connection cache [31]
 o HTTP: implement Brotli content encoding [28]

This release includes the following bugfixes:

 o CVE-2017-8816: NTLM buffer overflow via integer overflow [47]
 o CVE-2017-8817: FTP wildcard out of bounds read [48]
 o CVE-2017-8818: SSL out of buffer access [49]
 o curl_mime_filedata.3: fix typos [1]
 o libtest: Add required test libraries for lib1552 and lib1553 [2]
 o fix time diffs for systems using unsigned time_t [3]
 o ftplistparser: memory leak fix: free temporary memory always [4]
 o multi: allow table handle sizes to be overridden [5]
 o wildcards: don't use with non-supported protocols [6]
 o curl_fnmatch: return error on illegal wildcard pattern [7]
 o transfer: Fix chunked-encoding upload too early exit [8]
 o curl_setup: Improve detection of CURL_WINDOWS_APP [9]
 o resolvers: only include anything if needed [10]
 o setopt: fix CURLOPT_SSH_AUTH_TYPES option read
 o appveyor: add a win32 build
 o Curl_timeleft: change return type to timediff_t [11]
 o cmake: Export libcurl and curl targets to use by other cmake projects [13]
 o curl: in -F option arg, comma is a delimiter for files only [14]
 o curl: improved ";type=" handling in -F option arguments
 o timeval: use mach_absolute_time() on MacOS [15]
 o curlx: the timeval functions are no longer provided as curlx_* [16]
 o mkhelp.pl: do not generate comment with current date [17]
 o memdebug: use send/recv signature for curl_dosend/curl_dorecv [18]
 o cookie: avoid NULL dereference [19]
 o url: fix CURLOPT_POSTFIELDSIZE arg value check to allow -1 [20]
 o include: remove conncache.h inclusion from where its not needed
 o CURLOPT_MAXREDIRS: allow -1 as a value [21]
 o tests: Fixed torture tests on tests 556 and 650
 o http2: Fixed OOM handling in upgrade request
 o url: fix CURLOPT_DNS_CACHE_TIMEOUT arg value check to allow -1
 o CURLOPT_INFILESIZE: accept -1 [22]
 o curl: pass through [] in URLs instead of calling globbing error [23]
 o curl: speed up handling of many URLs [24]
 o ntlm: avoid malloc(0) for zero length passwords [25]
 o url: remove faulty arg value check from CURLOPT_SSH_AUTH_TYPES [26]
 o HTTP: support multiple Content-Encodings [27]
 o travis: add a job with brotli enabled
 o url: remove unncessary NULL-check
 o fnmatch: remove dead code
 o connect: store IPv6 connection status after valid connection [29]
 o imap: deal with commands case insensitively [30]
 o --interface: add support for Linux VRF [32]
 o content_encoding: fix inflate_stream for no bytes available [33]
 o cmake: Correctly include curl.rc in Windows builds [34]
 o cmake: Add missing setmode check [35]
 o connect.c: remove executable bit on file [36]
 o SMB: fix uninitialized local variable
 o zlib/brotli: only include header files in modules needing them [37]
 o URL: return error on malformed URLs with junk after IPv6 bracket [38]
 o openssl: fix too broad use of HAVE_OPAQUE_EVP_PKEY [39]
 o macOS: Fix missing connectx function with Xcode version older than 9.0 [40]
 o --resolve: allow IP address within [] brackets [41]
 o examples/curlx: Fix code style [42]
 o ntlm: remove unnecessary NULL-check to please scan-build [43]
 o Curl_llist_remove: fix potential NULL pointer deref [43]
 o mime: fix "Value stored to 'sz' is never read" scan-build error [43]
 o openssl: fix "Value stored to 'rc' is never read" scan-build error [43]
 o http2: fix "Value stored to 'hdbuf' is never read" scan-build error [43]
 o http2: fix "Value stored to 'end' is never read" scan-build error [43]
 o Curl_open: fix OOM return error correctly [43]
 o url: reject ASCII control characters and space in host names [44]
 o examples/rtsp: clear RANGE again after use [45]
 o connect: improve the bind error message [46]
 o make: fix "make distclean" [50]
 o connect: add support for new TCP Fast Open API on Linux [51]
 o metalink: fix memory-leak and NULL pointer dereference [52]
 o URL: update "file:" URL handling [53]
 o ssh: remove check for a NULL pointer [54]
 o global_init: ignore CURL_GLOBAL_SSL's absense [55]
2017-11-29 13:56:27 +00:00
adam
58d9405d20 py-notebook: updated to 5.2.2
5.2.2
- set cookie on base_urls
2017-11-29 09:14:22 +00:00
wiz
cc66ca963a py-meinheld: Add upstream pull request link to patches. 2017-11-28 12:47:28 +00:00
adam
6bf41c2af3 py-django-import-export: updated to 0.6.0
0.6.0:
Refactor import_row call by using keyword arguments
Added {{ block.super }} call in block bodyclass in admin/base_site.html
Add support for the Django DurationField with DurationWidget
GitHub bmihelac -> django-import-export Account Update
Add intersphinx links to documentation
Add Resource.get_import_fields()
Fixed readme mistake
Bugfix/fix m2m widget clean
Allow injection of context data for template rendered by import_action() and export_action()
Bugfix/fix exception in generate_log_entries()
Process import dataset and result in separate methods
Bugfix/fix error in converting exceptions to strings
Fix admin integration tests for the new "Import finished..." message, update Czech translations to 100% coverage.
Make import form type easier to override
Add saves_null_values attribute to Field to control whether null values are saved on the object
Add Bulgarian translations
Add django 1.11 to TravisCI
Make Signals code example format correctly in documentation
Add Django as requirement to setup.py
Update import of reverse for django 2.x
Add Django-version classifiers to setup.py’s CLASSIFIERS
Some fixes for Django 2.0
Strip whitespace when looking up ManyToMany fields
Fix all ResourceWarnings during tests in Python 3.x
Remove downloads count badge from README since shields.io no longer supports it for PyPi
Add coveralls support and README badge
2017-11-28 10:01:13 +00:00
adam
308be77eaa py-terminado: updated to 0.8
0.8:
Add support for Windows on Python 3
2017-11-28 09:49:12 +00:00
adam
896bf617a7 py-WebOb: updated to 1.7.4
1.7.4:
Feature
Add support for wsgi.input_terminated in the wsgi environ to allow for Chunked Encoding to be used with WebOb
2017-11-28 08:55:48 +00:00
tnn
f32ab2c6f1 grafana: update to 4.6.2
Highlights:
- The new Postgres Data Source
- Create your own Annotations for the Graph panel
- Cloudwatch Alerting Support
- Prometheus query editor enhancements
2017-11-27 16:04:54 +00:00
adam
6f738aaa7e tidy: updated to 5.6.0
5.6.0:
Bug fixes.
2017-11-27 13:01:37 +00:00
adam
280e4f7815 Really depend on www/py-raven 2017-11-26 17:44:09 +00:00
adam
d41749d5d7 Added ALTERNATIVES 2017-11-26 17:41:21 +00:00
adam
e58f24022d py-raven: added version 6.3.0
Raven is a Python client for Sentry (https://sentry.io/). It provides full
out-of-the-box support for many of the popular frameworks, including Django,
Flask, and Pylons. Raven also includes drop-in support for any WSGI-compatible
web application.
2017-11-26 17:40:05 +00:00
adam
c91a5b6f69 py-django-tastypie: updated to 0.14.0
v0.14.0
Django 1.11 support.
2017-11-26 17:36:00 +00:00
adam
5f6058f727 nginx-devel: updated to 1.13.7
Changes with nginx 1.13.7:
*) Bugfix: in the $upstream_status variable.
*) Bugfix: a segmentation fault might occur in a worker process if a
   backend returned a "101 Switching Protocols" response to a
   subrequest.
*) Bugfix: a segmentation fault occurred in a master process if a shared
   memory zone size was changed during a reconfiguration and the
   reconfiguration failed.
*) Bugfix: in the ngx_http_fastcgi_module.
*) Bugfix: nginx returned the 500 error if parameters without variables
   were specified in the "xslt_stylesheet" directive.
*) Workaround: "gzip filter failed to use preallocated memory" alerts
   appeared in logs when using a zlib library variant from Intel.
*) Bugfix: the "worker_shutdown_timeout" directive did not work when
   using mail proxy and when proxying WebSocket connections.
2017-11-26 16:48:37 +00:00
adam
5a37e01608 nghttp2: updated to 1.28.0
nghttp2 v1.28.0
lib: Add nghttp2_error_callback2
build: Add deprecation warning when spdylay support is enabled
Switch to clang-format-5.0
examples: Make client and server work with libevent-2.1.8
third-party: Update neverbleed
integration: Fix issues reported by the go vet tool.
nghttpx: Fix affinity retry
nghttpx: Fix stalled backend connection on retry
nghttpx: Cookie based session affinity
nghttpx: Expose additional TLS related variables to mruby and accesslog
2017-11-26 16:43:30 +00:00
wiz
a7613b7367 p5-HTTP-DAV: switch to metacpan
Homepage is dead
2017-11-26 10:52:54 +00:00
wiz
e7a01393f1 neon: comment out dead sites. 2017-11-26 10:50:17 +00:00
wiz
5a88910a22 litmus: comment out dead sites. 2017-11-26 10:50:00 +00:00
wiz
b8ad95886c cadaver: comment out dead sites 2017-11-26 10:41:01 +00:00
wiz
79c0091359 p5-Test-WWW-Mechanize-PSGI: update to 0.38.
0.38      2017-11-23 19:02:15Z
    - Make UA aware of base URLs which are defined in the <head> of an HTML
      document (Olaf Alders)
    - Ensure that handlers run in the expected order (Olaf Alders)
2017-11-26 10:06:25 +00:00
wen
0dd4d328e7 Update to 3.4
Update the minimum php version to 7.0.0
Update my email

Upstream changes:
Moodle 3.4:

Server requirements

These are just the minimum supported versions. We recommend keeping all of your software up-to-date.

    Moodle upgrade: Moodle 3.0 or later (if upgrading from earlier versions, you must upgrade to 3.0.10 as a first step)
    PHP version: minimum PHP 7.0.0 Note: minimum PHP version has increased since Moodle 3.3. PHP 7.1.x and 7.2.x are supported too. PHP 7.x could have some engine limitations.
    PHP extension intl is now required in Moodle 3.4 (it was recommended in 2.0 onwards)

Database requirements

Moodle supports the following database servers. Again, version numbers are just the minimum supported version. We recommend running the latest stable version of any software.
Database 	Minimum version 	Recommended
PostgreSQL 	9.3 	Latest
MySQL 	5.5.31 	Latest
MariaDB 	5.5.31 	Latest
Microsoft SQL Server 	2008 	Latest
Oracle Database 	10.2 	Latest
Client requirements
Browser support

Moodle is compatible with any standards compliant web browser. We regularly test Moodle with the following browsers:

Desktop:

    Chrome
    Firefox
    Safari
    Edge
    Internet Explorer

Mobile:

    MobileSafari
    Google Chrome

For the best experience and optimum security, we recommend that you keep your browser up to date. https://whatbrowser.org

Note: Legacy browsers with known compatibility issues with Moodle 3.4:

    Internet Explorer 10 and below
    Safari 7 and below

Major features
Calendar improvements

    MDL-59333 - Calendar Improvements
    MDL-1322 - Calendar entries in monthly view should include course shortname
    MDL-59382 - Create calendar event quick-add
    MDL-59390 - Add navigation of all calendar views without page reload
    MDL-59394 - Add support for drag and drop of calendar events
    MDL-59386 - Add support for creation and update of calendar events using a modal dialogue
    MDL-59890 - Add support for calendar events at the category level

Management of course participants

    MDL-59290 - Merge Course Participants and Enrolled Users pages
    MDL-59564 - Add bulk editing of enrolment status/dates for users in the course participants page
    MDL-59364 - Remove the "Brief / User Details" functionality from the participants page
    MDL-59365 - Enrol Users button on participants page
    MDL-59366 - Add filter controls to the participants page to allow custom filtering
    MDL-59367 - Add a roles column to participants page
    MDL-59368 - Add a groups column to the participants page
    MDL-59369 - Add a status column to the participants page
    MDL-59436 - Remove the columns from the participants page that are not in showuseridentity
    MDL-59821 - Add "Proceed to course content" to participants page

Other highlights

    MDL-57791 - Implement analytics engine in Moodle
    MDL-59313 - Add links and a drop down to navigate between activities
    MDL-37361 - Allow teachers to mark activities as completed

Backup, restore and import

    MDL-35429 - Correct the permissions required to download and restore course automated backups
    MDL-9367 - Restore with roll forward changes dates for user data
    MDL-59518 - Restore date should not roll for user created data - Core components

Global search

    MDL-55356 - Index contents of the restored courses
    MDL-59523 - Course reset doesn't always shift dates
    MDL-58957 - Global search: Make it possible to search blocks
    MDL-59039 - Global search: Allow partial indexing (in scheduled task)

Authentication

    MDL-30634 - Assign arbitrary system roles via LDAP sync
    MDL-58544 - Add option to trust email of an OAuth provider
    MDL-59844 - Enable OAuth 2 token-based authentication for requests in webdav_client
    MDL-59459 - Global Search: Increase file indexing coverage
    MDL-59913 - Global search: Allow search of non-enrolled courses

Functional changes

    MDL-55358 - LIS Group Variables support in LTI
    MDL-36501 - Should have checkbox for extra credit when you add a grade item
    MDL-28574 - Web services: Manage tokens page should show tokens for all users
    MDL-26976 - Display space used in My Private Files
    MDL-35668 - Performance improvement in Server files repository
    MDL-49398 - Performance improvement due to Role definition caching & accesslib refactoring
    MDL-60002 - Assignment grading: Adding back "Save and show next"
    MDL-58889 - Make section titles and course titles more accessible in Boost
    MDL-57455 - Allow to tag database entries
    MDL-36985 - Assignment: automatically remove embedded files that are no longer linked from submission text. Reduce the size of "Download all submissions"
    MDL-59702 - Lesson overview report does not respect value of showuseridentity setting
    MDL-59460 - Forum: make Subscription mode setting configurable

For administrators

Please read carefully: Possible issues that may affect you in Moodle 3.4

    MDL-42834 - Deprecate loginhttps. Sites that used to use this setting will now be served via https always
    MDL-46269 - Tool to convert http embedded content to https where available
    MDL-58388 - Let the admin control if the course end date form field in course settings is enabled by default
    MDL-60211 - New filters for User Tours
    MDL-59123 - Compile SCSS files on the command-line
    MDL-58567 - Upgrade: Show upgrade times
    MDL-55652 - Missing index on (timemodified) in grade_items_history table and several other grade history tables. This will increase performance of various reports but may also slow down Moodle upgrade
    MDL-60094 - Add CLI script to kill all sessions
    MDL-59495 - Register and publish courses with moodle.net only, remove support for alternative hubs
    MDL-59206 - Trigger an event in add_to_config_log function
    MDL-57115 - Move "Messages" block out from the standard Moodle distribution
    MDL-57734 - SEO - Create admin setting to be able to enable or disable search engine indexing for sites with forcelogin
    MDL-60309 - Boost: Add a setting for background image
    MDL-56751 - Create new security setting to configure the expiration time of tokens created via login/token.php or tool/mobile/launch.php

Security issues

    MSA-17-0021 Students can find out email addresses of other students in the same course

This list only includes security issues fixed after 3.3.2 release. Refer to other release notes for security issues fixed in earlier releases.
For developers

    MDL-60611 - Upgrade PHPUnit to 6.4 to ensure compatibility with PHP 7.2 - may require changes in unittests.
    MDL-58948 - Compatibility with chrome mink driver
    MDL-53169 - Provide a way to retrieve all courses a user can potentially access.
    MDL-59459 - Global Search: Increase file indexing coverage
    MDL-59277 - navigation_node doesn't support TYPE_CONTAINER in get_css_type()
    MDL-58957 - Global search: Make it possible to search blocks. See the new \core_search\base_block class.
    MDL-53240 - Form element and admin setting type to choose file types and type groups
    MDL-53848 - Formslib - add function to $mform that makes it possible to hide form elements dependent on selected values
    MDL-60234 - Add possibility to disable admin warning if a development libs directory exists
    MDL-57886 - Plagiarism: onlinetext submission should pass raw submissiontext to plagiarism get_links()
2017-11-25 13:27:10 +00:00
wiz
cd1c7812ed py-test-httpbin: update to 0.3.0.
Allow to run httpbin on fixed port using environment variables (thanks @hroncok)
    Allow server to be thread.join()ed (thanks @graingert)
    Add support for Python 3.6 (thanks @graingert)

Add comment about test failure.
2017-11-25 12:56:31 +00:00
wiz
99f5b8c188 py-httpbin: this package is missing a dependency, raven
However, that is currently only packaged in wip.
Add a comment about this for someone else to fix.

Add a comment about an upstream bug report for a test failure.
2017-11-25 12:54:37 +00:00
wiz
a9b8f9edf8 py-flask: add upstream bug report URL for test failures 2017-11-25 12:23:41 +00:00
wiz
37ff97a3da *: depend on py-cairo now it supports all python versions 2017-11-24 22:15:58 +00:00
wiz
429f7c56c2 p5-WWW-Mechanize-Cached: update to 1.51.
1.51      2017-11-15 21:43:33Z
    - Replace Class::Load with Module::Runtime (Yanick Champoux) (GH#12)
2017-11-24 14:50:52 +00:00
wiz
a80b0c3ae6 p5-Mojolicious: update to 7.57.
7.57  2017-11-18
  - Fixed installation problems with some versions of Perl on Windows.

7.56  2017-11-14
  - Added num check to Mojolicious::Validator.
  - Improved built-in templates with high resolution logos.
2017-11-24 14:42:14 +00:00
wiz
72d462340f p5-CGI-Fast: update to 2.13.
2.13 2017-11-17
    [TESTING]
    remove use of Test::Deep completely (GH #17)
2017-11-24 14:40:42 +00:00
adam
957faedcd6 py-yarl: updated to 0.15.0
0.15.0:
Add raw_path_qs attribute
2017-11-24 12:35:09 +00:00
wiz
20f7c989fe recursive bump for libxkbcommon removal from at-spi2-core 2017-11-23 17:19:40 +00:00
adam
c31b937fb2 py-mod_wsgi: updated to 4.5.22
4.5.22:
Bugs Fixed:
Change in version 4.5.21 caused Windows builds to break with undefined symbol wsgi_daemon_shutdown.
2017-11-23 10:35:43 +00:00
tsutsui
317a50741f ruby-gnome2: update to 3.2.1.
Upstream changes (from NEWS):

== Ruby-GNOME2 3.2.1: 2017-11-19

This is a memory related bug fix release.

=== Changes

==== Ruby/GLib2

  * Improvements

    * (({GLib::Bytes#initialize})): Stopped to copy data for frozen
      (({String})).

==== Ruby/GObjectIntrospection

  * Fixes

    * Fixed memory leaks for output parameters.
      [GitHub#1113][Reported by Will Bryant]

==== Ruby/GIO2

  * Improvements

    * (({Gio::InputStream#read_all})): Made workable.
      [GitHub#1110][Reported by Paul van Tilburg]

    * (({Gio::InputStream#read})): If the given size is (({nil})),
      read until EOF or error. It's compatible with Ruby's IO objects.

==== Ruby/GTK3

  * Improvements

    * Marked top-level windows automatically.
      [GitHub#1103][Reported by cedlemo]

=== Thanks

  * Paul van Tilburg

  * cedlemo

  * Will Bryant
2017-11-22 17:05:52 +00:00
adam
59f2c8742c py-aiohttp: updated to 2.3.3
2.3.3:
Having a ; in Response content type does not assume it contains a charset anymore.
Use getattr(asyncio, ‘async’) for keeping compatibility with Python 3.7.
Ignore NotImplementedError raised by set_child_watcher from uvloop.
Fix warning in ClientSession.__del__ by stopping to try to close it.
Fixed typo’s in Third-party libraries page. And added async-v20 to the list
2017-11-22 08:48:39 +00:00
taca
f3a4997ec5 www/contao44: Update due to repacakge.
Add DIST_SUBDIR due to repacakging.

Bump PKGREVISION.
2017-11-20 04:53:56 +00:00
tsutsui
44e0749c4f ruby-gnome2: update to 3.2.0.
Upstream changes (from NEWS):

== Ruby-GNOME2 3.2.0: 2017-11-07

This is a bug fix release for Ruby/Poppler.

=== Changes

==== Ruby/GLib

  * Improvements

    * (({GLib::IOChannel#create_watch})): Supported.
      [GitHub#1106][Reported by kspt-johs]

    * (({GLib::IOChannel#create_watch})): Supported.

==== Ruby/GTK3

  * Improvements

    * Added a sample.
      [GitHub#1109][Patch by cedlemo]

==== Ruby/Poppler

  * Improvements

    * (({Poppler#Document#size})): Added again.

    * (({Poppler#Document#pages})): Added again.

  * Fixes

    * Updated dependencies.
      [GitHub#1107][Reported by OBATA Akio]

    * (({Poppler#Document#initialize(:data => data)})): Added
      workaround. It should be fixed in upstream.

=== Thanks

  * kspt-johs

  * OBATA Akio

  * cedlemo
2017-11-19 10:38:38 +00:00
wen
f178820d13 Update to 1.29.2
Upstream changes:
MediaWiki 1.29.2

This is a security and maintenance release of the MediaWiki 1.29 branch.
Changes since 1.29.1

    (T166757) Avoid scoped lock errors in Category::refreshCounts() due to nesting.
    (T175439) Unbreak Postgres Updater when setting defaults for a column.
    (T160298) Remove use of implicitGroupBy() in ActiveUsersPager.
    Fixed login button label to accept RawMessage.
    Fixed case of SpecialRecentChanges class usage.
    (T174255) Declare uploadCount property in importDump.php.
    (T163646) Pass a string not an int to mysql_real_escape_string().
    (T180143) Bump justinrainbow/json-schema development dependency to ~5.2.
    Updated dev dependancy phpunit/phpunit from v4.8.35 to v4.8.36.
    (T178451) SECURITY: Potential XSS when $wgShowExceptionDetails = false and browser sends non-standard url escaping.
    (T165846) SECURITY: BotPassword login attempts weren't throttled.
    (T128209) SECURITY: Reflected File Download from api.php.
    (T134100) SECURITY: Do not reveal if user exists during login failure.
    (T176247) SECURITY: Ensure Message::rawParams can't lead to XSS.
    (T125163) SECURITY: Make anchor for headlines escape > and <.
    (T180237) SECURITY: Protect vendor folder with .htaccess.
    (T180231) SECURITY: Remove PHPUnit file with known RCE if exists in update.php.
    (T124404) SECURITY: XSS in langconverter when regex hits pcre.backtrack_limit.
    (T119158) SECURITY: Handle -{}- syntax in attributes safely.
    (T180488) (T125177) "api.log contains passwords in plaintext" wasn't correctly fixed in all branches in the previous security release.
2017-11-19 08:36:57 +00:00
adam
54b29a9f37 libsass/sassc: updated to 3.4.7
3.4.7:
Features
* Implement exponents for numbers
* Implement long file path support for Windows

Fixes
* Error on quoted string in simple selector parsing
* Do not compress colors in selectors
* Fix issue when passing restargs to call
* Fix issue with attribute selector unification
* Improve wrapped pseudo selector handling
* Improve extend of wrapped pseudo selectors
* Fix propagation of named rest arguments
* Do not output invisible support blocks
* Various build makefile and CI related fixes
2017-11-17 11:36:30 +00:00
hauke
9d00ed31e0 Update www/php-glpi to v9.2.1
Upstream says:

You'll find below the changes of this bugfixes version:

- Rework mail attachments for notifications (inline images are now handled, ...),
- Fix ticket reopening,
- Fix operating system update on sub-entities,
- Fix issues on knowledge base items removal and display,
- Unset autoclose delay on fresh install,
- Improve private saved searches (with entities),
- Fix carriage return issues on tickets,
- Fix massive actions on operating systems,
- Fix migration issues from 9.1 and 9.2,
- Add support for other cache methods than APCu,
- Fix linear amortize calculation,
- Fix mail collector attachments owner,
- And many more!

Full ChangeLog:
<https://github.com/glpi-project/glpi/milestone/21?closed=1>
2017-11-17 11:07:39 +00:00