• Files Changed
• Browse Source

• Files Changed
• Browse Source

• Files Changed
• Browse Source

- Portability: provide /etc/apache2/mod_security2.d/empty.conf
  to avoid a non-match of the file-glob in the Include statement
  from /etc/apache2/conf.d/mod_security2.conf . This restores
  the Include back from the IncludeOptional, which is not portable.

• Files Changed
• Browse Source

Added backward compatibility for SLE 11 (aclocal fails on older distributions than openSuSE 13.1). Please forward to updates.

• Files Changed
• Browse Source

- last changelog does not say that 
  apache2-mod_security2-libtool-fix.diff was obsoleted.

• Files Changed
• Browse Source

- BuildRequires: libtool missing

- apache2-mod_security2-libtool-fix.diff: initialize libtool.

• Files Changed
• Browse Source

- apache2-mod_security2-no_rpath.diff: avoid the usage of -rpath
  in autoconf m4 macros. Obsoletes patch
  modsecurity-apache_2.8.0-build_fix_pcre.diff
- use automake for build, add autoconf and automake to
  BuildRequires:. This fix is combined with [bnc#876878].
- turn on --enable-htaccess-config
- use %{?_smp_mflags} for build

- OWASP rule set. [bnc#876878]
  new in 2.8.0 (more complete changelog to add to last changelog):
  * Connection limits (SecConnReadStateLimit/SecConnWriteStateLimit)
    now support white and suspicious list
  * New variables: FULL_REQUEST and FULL_REQUEST_LENGTH
  * GPLv2 replaced by Apache License v2
  * rules are not part of the source tarball any longer, but
    maintaned upstream externally, and included in this package.
  * documentation was externalized to a wiki. Package contains
    the FAQ and the reference manual in html form.
  * renamed the term "Encryption" in directives that actually refer
    to hashes. See CHANGES file for more details.
  * byte conversion issues on s390x when logging fixed.
  * many small issues fixed that were discovered by a Coverity scanner
  * updated reference manual
  * wrong time calculation when logging for some timezones fixed.
  * replaced time-measuring mechanism with finer granularity for
    measured request/answer phases. (Stopwatch remains for compat.)
  * cookie parser memory leak fix
  * parsing of quoted strings in multipart Content-Disposition
    headers fixed.

• Files Changed
• Browse Source

- Raised to version 2.8.0.
- updated patches:
  * modsecurity-apache_2.8.0-build_fix_pcre.diff
    -> modsecurity-apache_2.7.7-build_fix_pcre.diff

• Files Changed
• Browse Source

 - Raised to version 2.7.7.
 - modified patches:
  * modsecurity-apache_2.7.5-build_fix_pcre.diff,
    renamed to modsecurity-apache_2.7.7-build_fix_pcre.diff.

• Files Changed
• Browse Source

Use correct source Url

• Files Changed
• Browse Source

- complete overhaul of this package, with update to 2.7.5.
- ruleset update to 2.2.8-0-g0f07cbb.
- new configuration framework private to mod_security2:
  /etc/apache2/conf.d/mod_security2.conf loads
  /usr/share/apache2-mod_security2/rules/modsecurity_crs_10_setup.conf,
  then /etc/apache2/mod_security2.d/*.conf , as set up based on
  advice in /etc/apache2/conf.d/mod_security2.conf
  Your configuration starting point is
  /etc/apache2/conf.d/mod_security2.conf
- !!! Please note that mod_unique_id is needed for mod_security2 to run!
- modsecurity-apache_2.7.5-build_fix_pcre.diff changes erroneaous
  linker parameter, preventing rpath in shared object.
- fixes contained for the following bugs:
  * CVE-2009-5031, CVE-2012-2751 [bnc#768293] request parameter handling
  * [bnc#768293] multi-part bypass, minor threat
  * CVE-2013-1915 [bnc#813190] XML external entity vulnerability
  * CVE-2012-4528 [bnc#789393] rule bypass
  * CVE-2013-2765 [bnc#822664] null pointer dereference crash
- new from 2.5.9 to 2.7.5, only major changes:
  * GPLv2 replaced by Apache License v2
  * rules are not part of the source tarball any longer, but
    maintaned upstream externally, and included in this package.
  * documentation was externalized to a wiki. Package contains
    the FAQ and the reference manual in html form.
  * renamed the term "Encryption" in directives that actually refer
    to hashes. See CHANGES file for more details.
  * new directive SecXmlExternalEntity, default off
  * byte conversion issues on s390x when logging fixed.
  * many small issues fixed that were discovered by a Coverity scanner
  * updated reference manual

• Files Changed
• Browse Source

baserev update by copy to link target

• Files Changed
• Browse Source

license update: Apache-2.0 and GPL-2.0
Many of the files in the rules/ subdirectory are GPL-2.0 licensed

• Files Changed
• Browse Source

- Update to version 2.6.7, fixes build in apache 2.4
- Update spec file macros.

• Files Changed
• Browse Source

- Remove redundant tags/sections from specfile
- Use %_smp_mflags for parallel build

• Files Changed
• Browse Source

- update to version 2.6.1-rc1 for submission to SLE11-SP2 (fate#309433):
  - SecUnicodeCodePage and SecUnicodeMapFile directives added
  - fixed bug: SecRequestBodyLimit was truncating the real request 
    body
  additional fixes from 2.6.0:
  - buffering filter problems fixed
  - memory leak fix when using MATCHED_VAR_NAMES
  - SecWriteStateLimit added against slow DoS
  additional fixes from 2.6.0 release candidates:
  - optimizations
  - bug in logging code fixed
  - cleanup
  - google safe browsing support

• Files Changed
• Browse Source

converted link to branch

• Files Changed
• Browse Source

sync with O:F

• Files Changed
• Browse Source

• Files Changed
• Browse Source