Pullup ticket #4576 - requested by taca
mail/roundcube: security update

Revisions pulled up:
- mail/roundcube/Makefile                                       1.64-1.65
- mail/roundcube/PLIST                                          1.33
- mail/roundcube/distinfo                                       1.37-1.38

---
   Module Name:	pkgsrc
   Committed By:	adam
   Date:		Tue Oct  7 10:22:49 UTC 2014

   Modified Files:
   	pkgsrc/mail/roundcube: Makefile distinfo

   Log Message:
   Changes 1.0.3:
   - Fix insert-signature command in external compose window if opened from inline compose screen
   - Initialize HTML editor before restoring a message from localStorage
   - Add 'sig_max_lines' config option to default config file
   - Add option to specify IMAP connection socket parameters - imap_conn_options
   - Add option to set default message list mode - default_list_mode
   - Enable contextmenu plugin for TinyMCE editor
   - Fix some mime-type to extension mapping checks in Installer
   - Fix errors when using localStorage in Safari's private browsing mode
   - Fix bug where $Forwarded flag was being set even if server didn't support it
   - Fix various iCloud vCard issues, added fallback for external photos
   - Fix invalid Content-Type header when send_format_flowed=false
   - Fix errors when adding/updating contacts in active search
   - Fix incorrect thumbnail rotation with GD and exif orientation data
   - Fix contacts list update after adding/deleting/moving a contact
   - Fix handling of email addresses with quoted domain part
   - Fix comm_path update on task switch
   - Fix error in MSSQL update script 2013061000.sql
   - Fix validation of email addresses with IDNA domains

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Fri Dec 19 03:32:00 UTC 2014

   Modified Files:
   	pkgsrc/mail/roundcube: Makefile PLIST distinfo

   Log Message:
   Update roundcube to 1.0.4, which contains fix for possible CSRF attack.

   RELEASE 1.0.4
   -------------
   - Disable TinyMCE contextmenu plugin as there are more cons than pros in using it (#1490118)
   - Fix bug where show_real_foldernames setting wasn't honored on compose page (#1490153)
   - Fix issue where Archive folder wasn't protected in Folder Manager (#1490154)
   - Fix compatibility with PHP 5.2. in rcube_imap_generic (#1490115)
   - Fix setting flags on servers with no PERMANENTFLAGS response (#1490087)
   - Fix regression in SHAA password generation in ldap driver of password plugin (#1490094)
   - Fix displaying of HTML messages with absolutely positioned elements in Larry skin (#1490103)
   - Fix font style display issue in HTML messages with styled <span> elements (#1490101)
   - Fix download of attachments that are part of TNEF message (#1490091)
   - Fix handling of uuencoded messages if messages_cache is enabled (#1490108)
   - Fix handling of base64-encoded attachments with extra spaces (#1490111)
   - Fix handling of UNKNOWN-CTE response, try do decode content client-side (#1490046)
   - Fix bug where creating subfolders in shared folders wasn't possible without ACL extension (#1490113)
   - Fix reply scrolling issue with text mode and start message below the quote (#1490114)
   - Fix possible issues in skin/skin_path config handling (#1490125)
   - Fix lack of delimiter for recipient addresses in smtp_log (#1490150)
   - Fix generation of Blowfish-based password hashes (#1490184)
   - Fix bugs where CSRF attacks were still possible on some requests
Pullup ticket #4575 - requested by taca
www/typo3_45: security update

Revisions pulled up:
- www/typo3_45/Makefile                                         1.33
- www/typo3_45/distinfo                                         1.28

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Sun Dec 14 11:58:29 UTC 2014

   Modified Files:
   	pkgsrc/www/typo3_45: Makefile distinfo

   Log Message:
   Update typo345 package to 4.5.39.

   2014-12-10  d72f00c                  [RELEASE] Release of TYPO3 4.5.39 (TYPO3 Release Team)
   2014-12-10  63ae7dd  #62723          [!!!][SECURITY] Fix link spoofing in prefixLocalAnchors (Helmut Hummel)
   2014-12-08  5c267d2  #62967          [BUGFIX] Exclude CDATA from t3lib_parsehtml->XHTML_clean (Nicole Cordes)

   2014-11-27  7d66912                  [RELEASE] Release of TYPO3 4.5.38 (TYPO3 Release Team)
   2014-11-19  61d8b25  #58053          [BUGFIX] Handle opacity for IE in prototype.js (Jigal van Hemert)
   2014-11-15  42de3e0  #62984          [BUGFIX] PHP warning on saving TypoScript with t3editor (Oliver Hader)
   2014-11-13  152b14b  #62032          [BUGFIX] Fix PHP warning with date function in FormEngine (Oliver Hader)
   2014-11-03  79ba882  #62391          [BUGFIX] Ensure PHP 5.2 compatibility in php-openid (Michael Stucki)
   2014-10-31  f56c52f  #62513          [BUGFIX] Too many tags by identifier in CacheBackends (Michael Stucki)
   2014-10-23  528429b  #57006          [BUGFIX] softrefproc typolink lacks support for separation by line feed (Marc Bastian Heinrichs)
   2014-10-22  a62c19e  #62391          [BUGFIX] Ensure PHP 5.2 compatibility in makeInstance (Helmut Hummel)
Pullup ticket #4577 - requested by taca
lang/php54: security update

Revisions pulled up:
- lang/php/phpversion.mk                                        1.79
- lang/php54/distinfo                                           1.50

---
   Module Name:    pkgsrc
   Committed By:   taca
   Date:           Fri Dec 19 16:08:35 UTC 2014

   Modified Files:
           pkgsrc/lang/php: phpversion.mk
           pkgsrc/lang/php54: distinfo

   Log Message:
   Update php54 to 5.4.36, including security fix.

   18 Dec 2014 PHP 5.4.36

   - Core:
     . Upgraded crypt_blowfish to version 1.3. (Leigh)
     . Fixed bug #68545 (NULL pointer dereference in unserialize.c). (Anatol)
     . Fixed bug #68594 (Use after free vulnerability in unserialize()).
       (CVE-2014-8142) (Stefan Esser)

   13 Nov 2014 PHP 5.4.35

   - Core:
     . Fixed bug #68365 (zend_mm_heap corrupted after memory overflow in
       zend_hash_copy). (Dmitry)

   - Fileinfo:
     . Fixed bug #68283 (fileinfo: out-of-bounds read in elf note headers).
       (CVE-2014-3710) (Remi)

   - GMP:
    . Fixed bug #63595 (GMP memory management conflicts with other libraries
      using GMP). (Remi)

   - PDO_pgsql:
     . Fixed bug #66584 (Segmentation fault on statement deallocation) (Matteo)
Pullup tickets #4575 and #4577.