CVS commit: pkgsrc/www/p5-CGI-Session

[Ulrich Habel <rhaen%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   rhaen
Date:           Fri Jul 18 09:43:35 UTC 2008

Modified Files:
        pkgsrc/www/p5-CGI-Session: Makefile distinfo

Log Message:
- updated to 4.35

ChangeLog:
4.34 - Sunday, July 13, 2008
    * SECURITY: Patch CGI::Session::Driver::file to stop \ and / characters 
being used in
           session ids and hence in file names. These characters, possibly 
combined with '..',
           could have been used to access files outside the designated session 
file directory.
           Reported by TAN Chew Keong of vuln.sg.
    * FIX: Patch CGI::Session to propagate error upwards when 
_load_pluggables() fails.
           See RT#37628 and 
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=490198.
    * INTERNAL: Ship a machine-readable version of this file under the name 
Changelog.ini.
           The latter file is generated by ini.report.pl, which is shipped with 
Module::Metadata::Changes.
           The reason Changelog.ini does not contain a separate section for 
each version in this file
           is that some of the versions documented below have no datestamp, and 
ini.report.pl does not create
           fake datestamps.

4.33 - Monday, July 7, 2008
    * FIX: Patch CGI::Session::Driver::mysql to replace 'REPLACE INTO ...' with
           'INSERT INTO ... ON DUPLICATE KEY UPDATE ...'. See RT#37069.
           Thanks to Steve Kirkup for the patch. I (Ron) installed MySQL V 
5.0.51a for testing.
           Note: 
http://dev.mysql.com/doc/refman/5.0/en/releasenotes-cs-5-0-45.html and similar 
docs
           list various MySQL errors fixed recently for the above new syntax. 
Also, the new version
           is now much more like the Postgres code, which is another reason it 
has been adopted.
    * FIX: t/mysql.t used to test setting the global variable 
$CGI::Session::MySQL::TABLE_NAME.
           The test for this (in t/mysql.t) was introduced in V 4.00_09.
           However, since V 4.29_1, changes to CGI::Session::Driver's new() 
method mean
           this way of setting the session table's name no longer works, and so 
the variable
           $CGI::Session::MySQL::TABLE_NAME is now not used. Hence it has been 
removed.
           Code in CGI::Session::Driver::DBI used to set $class::TABLE_NAME for 
all database drivers.
           This code has also been removed. Moral: Don't use global variables.
           Call $session = CGI::Session -> new(..., ..., (TableName => 
'new_name'}) or,
           after creating the object, call $session -> table_name('new_name').
           To retrieve the name, call $name = $session -> table_name().

4.32 - Tuesday, June 17, 2008
    * FIX: Packaging of 4.31 release was botched.

4.31 - Tuesday, June 10, 2008
    * FIX: Patch CGI::Session::Driver::DBI to check that the DBI handle still 
exists before trying
           to ping it. This handles the case where the DBI object is destroyed 
before the session object.
           See RT#35925.
    * FIX: Patch CGI::Session::Driver::DBI's remove() which still hard-coded 
the column name 'id' instead
           of using the new feature which allows the user to specify the name 
of the column. See RT#36235.
    * FIX: Patch POD yet again to emphasize that an explicit call to destroy() 
should be followed by
           explicit call to flush(), in particular in the case where the 
program is not exiting and
           hence auto-flushing is not activated. Sections patched are 'A 
Warning about Auto-flushing'
           and the docs for delete(). See RT#34668.

4.30 - Friday, April 25, 2008

    * FIX: Patch POD for CGI::Session in various places, to emphasize even more 
that auto-flushing is
           unreliable, and that flush() should always be called explicitly 
before the program exits.
           The changes are a new section just after SYNOPSIS and DESCRIPTION, 
and the PODs for flush(),
           and delete(). See RT#17299 and RT#34668
    * NEW: Add t/new_with_undef.t and t/load_with_undef.t to explicitly 
demonstrate the effects of
           calling new() and load() with various types of undefined or fake 
parameters. See RT#34668
    * FIX: Patch POD for new() and load() to clarify the result of calling 
these with undef, or with
           an initialized CGI object with an undefined or fake CGISESSID. See 
RT#34668.
           Specifically: You are strongly advised to run the old-fashioned
           'make test TEST_FILES=t/new_with_undef.t TEST_VERBOSE=1' or the 
new-fangled
           'prove -v t/new_with_undef.t', for both new*.t and load*.t, and 
examine the output
    * FIX: Patch POD in various tiny ways to improve the grammar

4.29_2 - Thursday, March 27, 2008

    * FIX: stop ExtUtils::MakeMaker trying to create Build.PL (Ron Savage)
    * FIX: Disable trying to use utf8 in tests. (Ron Savage) Ref RT#21981, 
RT#28516

4.29_1 - Saturday, March 15, 2008

    Special Thanks to Ron Savage who did the bulk of the work to put this 
release together.

    * FIX: Patch CGI::Session to fix RT#29138 (Patch by Barry Friedman)
    * NEW: Add a note to CGI::Session's POD referring to utf8 problems, and 
include references
           to RT#21981 (Reported by erwan) and RT#28516 (Reported by 
jasoncrowther)
    * FIX: Patch CGI::Session::Driver::DBI.pm to fix RT#24601 (Patch by 
latypoff)
    * FIX: Patch CGI::Session::Driver::DBI.pm to fix RT#24355 (Reported by 
fenlisesi, patch by Ron Savage)
        * NEW: Add t/bug24285.t to ensure session data files are created 
properly when the user specifies a
           directory other than /tmp (Reported by William Pearson RT#24285, 
patch by Ron Savage)
    * FIX: Patch t/ip_matches.t and t/bug21592.t to remove test files left in 
/tmp, to fix RT#29969
           (Reported by ANDK, patch by Ron Savage)
    * FIX: Patch POD for CGI::Session::Driver::file to clarify how to use the 
option to change the
           file name pattern used to created session files (Report by appleaday 
RT#33635,
           patch by Ron Savage)
    * FIX: Patch CGI::Session::Driver::sqlite to add sub DESTROY to fix RT#32932
           (Patch by Alexander Batyrshin, corrected by Ron Savage)
    * FIX: Remove CGI::Session::Seralize::json and t/g4_dbfile_json.t until 
such time as this code
           can be made to work reliably. Both JSON::Syck and JSON::XS have been 
tried, and in both
           cases t/g4_dbfile_json.t dies horribly (but differently). Patch POD 
for CGI::Session to
           remove references to JSON. RT#25325 (Reported by bkw, patch by Ron 
Savage)
    * NEW: Patch CGI::Session's POD and load() to allow the session/cookie name 
default of CGISESSID
           to be overridden. (Patch by Lee Carmichael RT#33437, reformatted by 
Ron Savage). Lee has
           also patched t/name.t to test the new functionality
    * NEW: Split CGI::Session::Serialize::yaml out into its own distro. Get it 
hot from CPAN!
    * NEW: Add Build.PL for Module::Build users. This also requires adding 
PL_FILES => {}
           to Makefile.PL to beat ExtUtils::MakeMaker over the head, otherwise 
it executes
           'perl Build.PL Build'
    * NEW: Support specification of both the id column name and the a_session 
column name in the
           sessions table, by extending the options acceptable in 
CGI::Session->new(..,..,{here}).
           Allow:   {TableName => 'session',  IdColName => 'my_id', DataColName 
=> 'my_data'}.
           Default: {TableName => 'sessions', IdColName => 'id',    DataColName 
=> 'a_session'}.
           Allow any 1, 2 or 3 of these options. Missing keys default as 
specified.
           (Patch by Chris RT#2224. Implemented differently by Ron Savage). 
Supported drivers:
           o MySQL (native to CGI::Session)
           o ODBC (separate distro, CGI::Session::Driver::odbc V 1.01)
           o Oracle (separate distro, CGI::Session::Driver::oracle V 1.01)
           o Postgres (native)
           o SQLite (native)


To generate a diff of this commit:
cvs rdiff -r1.9 -r1.10 pkgsrc/www/p5-CGI-Session/Makefile
cvs rdiff -r1.4 -r1.5 pkgsrc/www/p5-CGI-Session/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.