CVS commit: pkgsrc/chat/ejabberd

["Greg Troxel" <gdt%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   gdt
Date:           Thu Aug  6 16:22:59 UTC 2026

Modified Files:
        pkgsrc/chat/ejabberd: Makefile PLIST distinfo

Log Message:
chat/ejabberd: Update to 26.07

## Version 26.07

#### Security fixes

This release contains fixes for those issues:

- It's possible to craft PLAIN auth request and authenticate as one user, but then open
  session for different one.
- mod_caps persistent cache can be poisoned by using legacy version requests.
  This cache was only used to determine list of nodes that should trigger notifications
  in PubSub presence-based delivery.
- SQL injection in mod_pubsub handling of paging requests.
- Possible atom exhaustion that can be triggered by issuing REST requests to mod_http_api
- It was possible to make ejabberd send redirect response for OAuth requests to unvetted url.
  This required enabling ejabberd to act as OAuth provider (by adding request handler for
  ejabberd_oauth in http listener). As part of this fix we changed `oauth_client_id_check`
  default value to `db` - using ejabberd as OAuth provider will be only allowed by clients
  that were previously registered with `oauth_add_client_password` or `oauth_add_client_implicit`
  commands.
- Tokens generated by mod_bosh, captcha, mod_auth_fast, mod_http_upload and mod_invites
  used not cryptographically strong random number generators.
- Files server by mod_http_upload didn't have XSS prevention headers.
- Issues in authentication of SIP requests.
- Request to web_admin were lacking CSRF protection.
- It was possible to skip captcha verification in mod_register_web.
- mod_conversejs allowed putting unescaped value from url in page content.

#### Core

- Adds `export_db_ext` which allows exporting db content to json files
- Use constant time functions when doing password checks
- We no longer add flag requesting client certificate for tls connections
  where certificate authentication is not enabled

#### Modules

- `mod_invites`: Add page for creating invites.


To generate a diff of this commit:
cvs rdiff -u -r1.118 -r1.119 pkgsrc/chat/ejabberd/Makefile
cvs rdiff -u -r1.68 -r1.69 pkgsrc/chat/ejabberd/PLIST
cvs rdiff -u -r1.79 -r1.80 pkgsrc/chat/ejabberd/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/chat/ejabberd/Makefile
diff -u pkgsrc/chat/ejabberd/Makefile:1.118 pkgsrc/chat/ejabberd/Makefile:1.119
--- pkgsrc/chat/ejabberd/Makefile:1.118 Thu Aug  6 16:01:10 2026
+++ pkgsrc/chat/ejabberd/Makefile       Thu Aug  6 16:22:59 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.118 2026/08/06 16:01:10 gdt Exp $
+# $NetBSD: Makefile,v 1.119 2026/08/06 16:22:59 gdt Exp $
 
-DISTNAME=      ejabberd-26.04
+DISTNAME=      ejabberd-26.07
 CATEGORIES=    chat
 MASTER_SITES=  ${MASTER_SITE_GITHUB:=processone/}
 
@@ -77,7 +77,7 @@ DEPENDS+=     erlang-pkix>=1.0.10:../../secu
 # sqlite3: options.mk
 DEPENDS+=      erlang-stringprep>=1.0.33:../../textproc/erlang-stringprep
 DEPENDS+=      erlang-stun>=1.2.21:../../net/erlang-stun
-DEPENDS+=      erlang-xmpp>=1.13.1:../../net/erlang-xmpp
+DEPENDS+=      erlang-xmpp>=1.13.4:../../net/erlang-xmpp
 DEPENDS+=      erlang-yconf>=1.0.22:../../textproc/erlang-yconf
 
 # dl_invites_page_deps.sh uses sha256sum which is a linuxism; patch it

Index: pkgsrc/chat/ejabberd/PLIST
diff -u pkgsrc/chat/ejabberd/PLIST:1.68 pkgsrc/chat/ejabberd/PLIST:1.69
--- pkgsrc/chat/ejabberd/PLIST:1.68     Thu Aug  6 14:35:50 2026
+++ pkgsrc/chat/ejabberd/PLIST  Thu Aug  6 16:22:59 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.68 2026/08/06 14:35:50 gdt Exp $
+@comment $NetBSD: PLIST,v 1.69 2026/08/06 16:22:59 gdt Exp $
 lib/${PKGNAME}/COPYING
 lib/${PKGNAME}/ebin/ELDAPv3.beam
 lib/${PKGNAME}/ebin/acl.beam
@@ -118,6 +118,7 @@ lib/${PKGNAME}/ebin/mod_antispam_rtbl.be
 lib/${PKGNAME}/ebin/mod_auth_fast.beam
 lib/${PKGNAME}/ebin/mod_auth_fast_mnesia.beam
 lib/${PKGNAME}/ebin/mod_auth_fast_opt.beam
+lib/${PKGNAME}/ebin/mod_auth_fast_sql.beam
 lib/${PKGNAME}/ebin/mod_avatar.beam
 lib/${PKGNAME}/ebin/mod_avatar_opt.beam
 lib/${PKGNAME}/ebin/mod_block_strangers.beam
@@ -374,11 +375,15 @@ lib/${PKGNAME}/priv/mod_invites/base.htm
 lib/${PKGNAME}/priv/mod_invites/base_min.html
 lib/${PKGNAME}/priv/mod_invites/client.html
 lib/${PKGNAME}/priv/mod_invites/copyright
+lib/${PKGNAME}/priv/mod_invites/index.html
 lib/${PKGNAME}/priv/mod_invites/invite.html
 lib/${PKGNAME}/priv/mod_invites/invite_invalid.html
 lib/${PKGNAME}/priv/mod_invites/register.html
 lib/${PKGNAME}/priv/mod_invites/register_error.html
 lib/${PKGNAME}/priv/mod_invites/register_success.html
+lib/${PKGNAME}/priv/mod_invites/reset_error.html
+lib/${PKGNAME}/priv/mod_invites/reset_success.html
+lib/${PKGNAME}/priv/mod_invites/reset_token.html
 lib/${PKGNAME}/priv/mod_invites/roster.html
 lib/${PKGNAME}/priv/mod_invites/static/bootstrap/css/bootstrap.min.css
 lib/${PKGNAME}/priv/mod_invites/static/bootstrap/js/bootstrap.min.js

Index: pkgsrc/chat/ejabberd/distinfo
diff -u pkgsrc/chat/ejabberd/distinfo:1.79 pkgsrc/chat/ejabberd/distinfo:1.80
--- pkgsrc/chat/ejabberd/distinfo:1.79  Thu Aug  6 14:35:50 2026
+++ pkgsrc/chat/ejabberd/distinfo       Thu Aug  6 16:22:59 2026
@@ -1,7 +1,7 @@
-$NetBSD: distinfo,v 1.79 2026/08/06 14:35:50 gdt Exp $
+$NetBSD: distinfo,v 1.80 2026/08/06 16:22:59 gdt Exp $
 
-BLAKE2s (ejabberd-26.04.tar.gz) = f1d0bc01fa6d4c04616e22a123da46b00d9f7a574d30f6c3162b8e75588ca524
-SHA512 (ejabberd-26.04.tar.gz) = c3477aa0bfaa4439c51a91b1fb2a9f051abe1bd6446a07b3785bf88720353c712ca281161c48a2a66212a708dada52f25de2c34913393e6cf28c6ed644845f28
-Size (ejabberd-26.04.tar.gz) = 2936092 bytes
+BLAKE2s (ejabberd-26.07.tar.gz) = 8db6c69d15c1754e61fb2bb60deaba5895f09ddf66978b12b6d2e4465c588793
+SHA512 (ejabberd-26.07.tar.gz) = 81fb35faa9dffaf5b8d4d8cca1d8e1ae6dcae744b96194b9c83250a95dada795db6d255349f14fbe4935a831dcd5857bad448146b466131b92d1cf20ffe98031
+Size (ejabberd-26.07.tar.gz) = 3008136 bytes
 SHA1 (patch-aa) = a0a21134adae1f2bbad58a001fb527ea18b70c99
 SHA1 (patch-src_mod__mam__sql.erl) = 54bc142dc4daa09da576a3f818e427f40d8b671b