suPHP is a combination of an Apache module (mod_suphp) and an
executable which provides a wrapper for PHP. With both
together, it is possible to execute PHP scripts with the
permissions of their owner without having to place a PHP
binary in each user's cgi-bin directory. suPHP doesn't need
Apache's suExec, provides a logging function and support for
different php.ini's.
===> The following configuration options are available for suphp-php81-0.7.2_2:
DOCS=on: Build and/or install documentation
===> Use 'make config' to modify these settings
SuPHP has no upstream maintainer and thus is not actively having
bugs and security issues addressed.
Its security track record is pretty good. The worst so far has been
privilege escalation to the httpd user, which is no worse than not
using SuPHP.
It is advisable to convert your system to PHP-FPM if possible.
The port maintainer's thoughts on sandboxing PHP are here:
http://blog.shatow.net/post/2013-07-17-sandboxing-php-part1.markdown
An overview of using PHP-FPM for application sandboxing is here:
http://blog.shatow.net/post/2013-11-27-sandboxing-php-part2.markdown
Mk/Uses/apache.mk: Refactor after removal of older versions
apache22 and apache25 had been removed a long time ago however the
apache.mk file has never been refactored and is out of sync from the
file Mk/bsd.default-versions.mk. These changes refactors the removals of
the older versions. In addition:
- Move some keywords like USE_APACHE, USE_APACHE_BUILD, USE_APACHE_RUN
from SANITY_DEPRECATED to SANITY_UNSUPPORTED
- Remove apache versions from ports Makefiles as currently there is only
one available version in the tree. However the version checks are
still valid and should work flawlessly whenever a new version is
added. For example USES=apache:2.2+ are simply replaced with
USES=apache. As currently there are no other versions available for
test this could not be checked on it's own ground.
- Update FOO_USE=APACHE=yes to FOO_USES=apache
- Remove trailing whitespaces
Approved by: portmgr
Differential Revision: https://reviews.freebsd.org/D38113
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
(Only the first 15 lines of the commit message are shown above )
- Switch to options helpers
- Unsilence install commands
- Fix build from plain user by creating a directory with correct permissions
Approved by: portmgr blanket
Bring back SuPHP.
Quite a few users still depend on this and are getting it from untrusted
sources. Its security track record is actually pretty good still.
SuPHP is still the simplest solution for shared hosting.
Other vendors still provide this as well.
- Add a pkg-message explaining the situation and advising users to move
away from this if possible.
- Stage
- Take maintainership
- Mark DEPRECATED as upstream is dead and has marked this EOL [1],
which is not good for a port that is supposed to improve security.
Suggest using nginx+php-fpm with a separate user for each site.
[1] https://lists.marsching.com/pipermail/suphp/2013-May/002554.html
- USE_APACHE= s/22+/22/
- adopt new Makefile header
Port build fails on local exp-run with apache24 with
error: 'conn_rec' has no member named 'remote_ip'
or various other apache22 specific functions/parameters
with hat apache@
- Unbroke with clang/gcc47+ by use restrictive C++ construction
- Declare that code use gnu89 style
- No PORTREVISION bump, users with base gcc not affected
PR: 168579
Submitted by: myself
Approved by: maintainer timeout (> 2 weeks)
Obtained from: PkgSrc repo
- fix pkg-plist if installed from port (leftover in httpd.conf)
- remove MD5 from distfile
PR: ports/154754
Submitted by: myself
Approved by: maintainer timeout
-Repocopy devel/libtool15 -> libtool22 and libltdl15 -> libltdl22.
-Update libtool and libltdl to 2.2.6a.
-Remove devel/libtool15 and devel/libltdl15.
-Fix ports build with libtool22/libltdl22.
-Bump ports that depend on libltdl22 due to shared library version change.
-Explain what to do update in the UPDATING.
It has been tested with GNOME2, XFCE4, KDE3, KDE4 and other many wm/desktop
and applications in the runtime.
With help: marcus and kwm
Pointyhat-exp: a few times by pav
Tested by: pgollucci, "Romain Tartière" <romain@blogreen.org>, and
a few MarcusCom CVS users. Also, I might have missed a few.
Repocopy by: marcus
Approved by: portmgr
Fix for previous commit; user reported privately that Apache would print
"Cannot get media type from 'x-httpd-php'" as a warning in the ErrorLog. Issue
caused by incorrect AddType syntax.
This commit fixes the pkg-message syntax described, as well as the example
suphp.conf to reflect the proper type (value "application/x-httpd-php", not
"x-httpd-php").
Submitted by: <dark@aspu.ru>
Upgrade to suPHP 0.6.2. This upgrade is quite major; it introduces
numerous features necessary for hosting, adds the use of a configuration
file (vs. compile-time settings) for configuration details, and is
presently supported by the software author.
Changes to httpd.conf are required for this to work, otherwise PHP
content is offered for download and not parsed. pkg-message contains
full migration details, but here's the simple version:
suPHP 0.5.2 suPHP 0.6.2
=========== ===========
AddType application/x-httpd-php .php AddType x-httpd-php .php
AddHandler x-httpd-php .php suPHP_AddHandler x-httpd-php
Tested on RELENG_6 and RELENG_7, using Apache 2.0 and 2.2, with the
help of the PR submitter.
Testing for Apache 1.3 was not performed, thus the port requires the
use of 2.0 or later. suPHP 0.6.2 does support Apache 1.3, but I'll
need someone running 1.3 to work with me on fixing the port to support
it, if desired.
PR: ports/116281
Submitted by: Vladimir Korkodinov <viper@perm.raid.ru>
- prepare removal of www/apache2 in favor of www/apache20 for naming
consistency
- add entries in UPDATING (for apache22 too)
PR: ports/78119
Repocopied by: marcus
Change logic of the LOGFILE path:
Assuming the user DOES NOT specify the
LOG_PATH variable upon build (by default, it's empty).
The logfile will end up in / (a.k.a. /suphp.log)
PR: 69334
Submitted by: Jeremy Chadwick <freebsd@jdc.parodius.com>
- Update to 0.5.2
Add a workaroung to make it work with apache 2 (due to an apr bug)
(so be careful)
- Pass maintainership to submitter
PR: ports/69048
Submitted by: Jeremy Chadwick <freebsd@jdc.parodius.com>
- Add WITH_LOGNAME and WITH_LOGPATH knobs.
I kept LOG_NAME to not break POLA (Will be removed for next release).
Requested by: Dennis Koster <dennis@phlex.net>
- Update to 0.5.1
This version is mainly a bugfix release, fixing a bug causing a
segmentation fault in the Apache 2 module and improving the handling
of environment variables. Instead of setting unneeded / unwanted
environment variables to an empty string, they are now completely
removed from the environment.
[update] www/suphp: update to 0.3 and fix a security leak introduced with
previous patch
- update to 0.3
- add a workaround to don't use getpwuid to performs check for apache
user (since 4.x
doesn't support getpwuid_r).
- use %%DOCSDIR%%
PR: ports/55952
Submitted by: Clement Laforet <sheepkiller@cultdeadsheep.org>
