Update contao211 to 2.11.17.

Version 2.11.17 (2014-04-07)
----------------------------

### Fixed
Fixed a critical vulnerability of the install tool (see #6855).
Note update of www/contao211 package to 2.11.17.
Update contao32 to 3.2.9.

Version 3.2.9 (2014-04-07)
--------------------------

### Fixed
Fixed a critical vulnerability of the install tool (see #6855).

### Fixed
Filter disabled groups in the registration module in the front end (see #6757).

### Fixed
Work around a bug in SimplePie with the "skip items" option (see #6107).

### Fixed
Fix the Swipe "continuous" option if there are exactly two slides (see #6812).

### Fixed
Apply `addslashes()` to strings in the `Config` class (see #6808).

### Fixed
Do not empty all fallback fields in sorting mode 4 (see #6498).

### Fixed
Do not allow template names to be longer than the DB fields (see #6819).

### Fixed
Correctly set the start time of a multi-day event (see #6802).

### Fixed
Correctly handle OR queries in the listing module (see #6344).

### Fixed
Use a monospaced font for the plain text newsletter preview (see #6790).

### Fixed
Adjust the `vScrollTo()` offset if the paste hint is visible (see #6478).
Note update of www/contao32 package to 3.2.9.
Use recent help2man `--no-discard-stderr' to build util/texi2dvi manpage.
Updated databases/apache-cassandra to 1.2.16
Changes 1.5.2:
Bug fixes.
Updated graphics/openjpeg15 to 1.5.2
Changes 2.06:
* In main(), when parsing form input fails, the CGI script exits without
  producing any output whatsoever.  Wouldn't it be better to actually
  emit an error status, instead of expecting the server to do something
  sane with a script that produces no output?

* In mpRead(), a check is done to insure the requested length is not
  greater than the amount of data still available, and to adjust it
  if necessary.  However, this check is currently done _after_ reading
  data from the putback buffer, in which process len is decremented by
  the amount of putback data read, but mpp->offset is not correspondingly
  incremented (this happens later).  As a result, the check uses too
  small a value for len, and so fails to stop reading soon enough if
  the requested length is greater than what is available _and_ there
  was any data in the putback buffer.
  The fix is to move the check to the beginning of mpRead()

* Further, if a read request is satisfied _entirely_ from the putback
  buffer, mpp->offset is not updated at all, resulting in a similar
  problem.  The solution is to update mpp->offset in the "else if (got)"
  case.

* In cgiParsePostMultipartInput(), if the Content-Disposition of a part
  is not "form-data", afterNextBoundary() is not called before beginning
  to process the next part.  As a result, parsing of the next part headers
  begins with the body of the unwanted part.  It is necessary in this case
  to call afterNextBoundary() before continuing with the next cycle.

* In handling out-of-memory conditions in afterNextBoundary(), *outP is
  set to '\0'.  While this is technically legal ('\0' is "an integral
  constant expression with the value 0"), it looks funny.

* In cgiCookieString(), a change was introduced in v2.02 which purports
  to prevent an overrun in cases where cgiCookie is exactly equal to
  the requested cookie name.  In fact, the problem can also occur if
  the requested name occurs with no values at the end of cgiCookie.
  Further, the change from v2.02 does not fix the problem, because it
  compares the _pointers_ p and n to NULL, which they will never equal,
  rather than comparing the pointers they point at to NUL.

* Also in cgiCookieString(), there is a comment suggesting that the main
  loop never terminates except with a return.  This is not the case.
  For example, it will terminate if the requested cookie is not found
  and the cgiCookie string ends in a semicolon.

* Why did days[] (formerly daysOfWeek[]) and months[] become non-static?
  This pollutes the namespace of programs using CGIC.

* In cgiReadEnvironment(), when reading in the contents of an uploaded
  file, it is possible that a temporary file is successfully created
  but then cannot be opened.  In this case, no attempt is made to remove
  the tempoary file.

* Further, when a form entry does _not_ include an uploaded file,
  e->tfileName is set to malloc'd but uninitialized memory.  It should
  be set to an empty string, by setting e->tfileName[0] to zero after
  the 1-byte buffer is allocated.
Updated www/cgic to 2.06
Define OBJECT_FMT for FreeBSD.
Ignore long time obsolete FreeBSD 1-3 and consider FreeBSD ELF-only.
Non-void function must return a value
Update to 4.46.0. From the changelog:

- fix --idle checking Python version incorrectly, resulting in
  incorrect warning about running with Python < 2.5. Thanks: "Voytek",
  Krzysztof Warzecha.
- add missing support for SSL certificate checking in POP3 which
  broke POP retrieval in v4.45.0. Requires Python 2.6 or newer.
  Thanks: "mancha".
Updated mail/getmail to 4.46.0
Changes 1.36.3:
- Fix builddir != srdir builds
- Avoid a crash when FT_Face is NULL
- Win32 build fixes
- Update pango_color_parse docs
Changes 3.2.5:
Bug fixes.
Updated devel/pango to 1.36.3; www/py-cherrypy to 3.2.5
Update to 2.12. From the changelog:

[SECURITY FIXES]
This version of ack prevents the --pager, --regex and --output
options from being used from project-level ackrc files. It is
possible to execute malicious code with these options, and we want
to prevent the security risk of acking through a potentially malicious
codebase, such as one downloaded from an Internet site or checked
out from a code repository.

The --pager, --regex and --output options may still be used from
the global /etc/ackrc, your own private ~/.ackrc, the ACK_OPTIONS
environment variable, and of course from the command line.

[ENHANCEMENTS]
Now ignores Eclipse .metadata directory. Thanks, Steffen Jaeckel.

Add --perltest for *.t files.

Added Matlab support. Thanks, Zertrin.

[FIXES]
Fixed a race condition in t/file-permission.t that was causing
failures if tests were run in parallel.

Fix the test suite for Win32. Many thanks to Christian Walde for
bringing the severity of this issue to our attention, as well as
providing a Win32 development environment for us to work with.

Fixed Win32-detection in the Makefile.PL. Thanks, Michael Beijen
and Alexandr Ciornii.

More compatibility fixes for Perl 5.8.8.

[INTERNALS]
Removed the Git revision tracking in the --version.
Updated textproc/p5-ack to 2.12
Update lua-expat to 1.3.0.

- Lua 5.2 support (thanks Tomás Guisasola Gorham)
- support for the XmlDecl handler
- add parser:getcurrentbytecount() (XML_GetCurrentByteCount)
- ability to disable CharacterData merging
- Makefile improvements (thanks Vadim Misbakh-Soloviov)