www/dotproject out of date and vulnerable

[Fred Cox]

--- Kris Kennaway <kris at obsecurity.org> wrote:

> On Tue, Sep 19, 2006 at 04:00:14PM -0700, Fred Cox
> wrote:
> > --- Kris Kennaway <kris at obsecurity.org> wrote:
> > 
> > > On Tue, Sep 19, 2006 at 03:25:45PM -0700, Fred
> Cox
> > > wrote:
> > > > 
> > > > 
> > > > --- Kris Kennaway <kris at obsecurity.org> wrote:
> > > > 
> > > > > "Will fail to package" is pretty far from
> > > perfection
> > > > > in my book :)
> > > > > 
> > > > 
> > > > I don't believe I ever said that.  It builds
> fine
> > > and
> > > > even runs, it just has lots of bugs.
> > > > 
> > > > Can you let me know what I said that gave you
> that
> > > > impression?
> > > 
> > > Based on what we've discussed, the proposed
> changes
> > > to the port will
> > > make it fail to build with default settings
> (since
> > > mysql 4 will be
> > > installed), for example on the package build
> > > cluster.
> > > 
> > 
> > I missed that requirement.
> > 
> > So basically, until it can run with PHP 5 and
> MySQL 5,
> > it's not good enough to be a port.  Restricting it
> to
> > run with PHP 4 will mean that it will be rejected?
> 
> No, I guess you've still misunderstood.  I don't
> know how many times I
> can say this, but let me try to explain once more:
> your port should be
> buildable with the default settings of all ports
> involved.
> 
> This means that you can't place special requirements
> like "you have to
> first install mysql 3.x, then install the php4-mysql
> port, then
> install this port", because that is too non-generic
> and will not be
> true on systems that already have php4-mysql
> installed with the
> default mysql client.
> 
> The solution, which I explained several messages
> ago, is to make an
> alternative php4-mysql3 port, which always depends
> on mysql 3.x, and
> use that instead of php4-mysql (it may need to
> conflict with
> php4-mysql, I don't know).  This really isn't very
> hard and you
> perhaps could have done it already by now :)
> 

When I was trying to install this in first place, I
couldn't install mysql323-client when mysql5-client
was already installed.  It refused to install.  I had
to install it into a jail by itself with msyql323 and
php4.

I assume that will break the requirement that it be
buildable with defaults, assuming that some other port
that requires mysql has already been built.  Is that a
bad assumption?

Thanks for the education,

Fred

> Kris


__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com