# changelog

author: Sergey Fokin <sfokin@cloudlinux.com> - 1-43.1
changelog:
  - fix version compare in multiphp_reconfigure script
  - exec /multiphp_reconfigure after installation for cPanel > 100.0


author: S. Kurt Newman <kurt.newman@cpanel.net> - 2.4.23-7
changelog:
  - Update apachectl with ulimit calls modifying the open file
    descriptor limit so that Apache will start up (EA-5662)


author: Dan Muey <dan@cpanel.net> - 2.4.23-9
changelog:
  - EA-5557: turn off icon directives by default since the icons are broken under symlink protect
  -          and are used by HTMLTable even when fancy indexinf is off


author: Vasiliy Kleschov <vkleschov@cloudlinux.com> - 2.4.33-5.cloudlinux.3
changelog:
  - EA4D-66: Remove %triggerin for ea-apache24-mod_security2 package to avoid apache
    downtime during the update


author: Oleksiy Shchukin <oshchukin@cloudlinux.com> 5.0.26-21
changelog:
  - Rebase upon passenger-5.0.26
  - Added support for DirectAdmin
  - More robust alt-mod-passenger installation routine for CPanel servers
  - Deploy pre-built binaries for non CPanel servers
    (thus no custom httpd-devel, alt-mod-passenger depends on)
  - Use pre-built ruby native support library for all CloudLinux alt-ruby versions,
    so that the library is not built on-fly per user app first invokation


author: Oleksiy Shchukin <oshchukin@cloudlinux.com> 5.0.29-22
changelog:
  - Rebase upon passenger-5.0.29
  - Return back to Passenger 4.0 tmp/restart.txt behavour (minimal lag
    between touching app/tmp/restart.txt and app restart)
  - Fixup installation script for non-panel server


author: Vladimir Prokofev <vprokofev@cloudlinux.com> 5.0.29-26
changelog:
  - Support httpd, httpd24 and EA4 apache with same passenger
  - New passenger version 5.0.29
  - Small bug fixes


author: Vladimir Prokofev <vprokofev@cloudlinux.com> 5.0.29-27
changelog:
  - Improve checking of the building passenger native libs.
  - Bug fix usage of have_ functions to build native libs


author: Vladimir Prokofev <vprokofev@cloudlinux.com> - 5.0.29-27.2
changelog:
  - Improve checking of the building passenger native libs.
  - Bug fix usage of have_ functions to build native libs
  - Provides ea-apache24-alt_mod_passenger package name


author: Sergey Kokhan <skokhan@cloudlinux.com> - 5.3.7-2
changelog:
  - ALMODP-112: disable nodejs handler by default
  - ALMODP-111: allow PassengerFriendlyErrorPages PassengerAppEnv passenger directives in htaccess


author: Sergey Kokhan <skokhan@cloudlinux.com> - 5.3.7-4
changelog:
  - ALMODP-121: Removed files with 1667 uid
  - ALMODP-120: fix httpd24-alt-mod-passenger spec for new httpd24-httpd


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 5.3.7-6
changelog:
  - ALMODP-134: Fix write application custom passenger log to user's tmp under cagefs
  - ALMODP-135: Deleted writing warning to main apache log when using user's custom log


author: Sergey Kokhan <skokhan@cloudlinux.com> - 5.3.7-14
changelog:
  - ALMODP-143: httpd24-alt-mod-passenger installation paths for mod_passenger.so and mod_passenger.conf changed


author: Serhii Kokhan <skokhan@cloudlinux.com> - 5.1.11-1
changelog:
  - ALMODP-91: Arbitrary file read vulnerability in passenger
  - ALMODP-89: Made graceful reload Apache instead of restart when alt-mod-passenger install/update
  - Remove dependency from old package which obsoletes ea-apache24-alt_mod_passenger
  - ALMODP-86: Add Node.js language support for alt-mod-passenger


author: Rishwanth Yeddula <rish@cpanel.net> - 1.0-133
changelog:
  - EA-7777: Ensure that log entries for the hostname, and the shared IPs are
    logged in the main access_log instead of individual domlogs.


author: Daniel Muey <dan@cpanel.net> - 1.0-175
changelog:
  - ZC-9061: Detect and inform admin of non-existent home directory
  - ZC-9058: Have nobody check set primary group to nobody


author: S. Kurt Newman <kurt.newman@cpanel.net> - 1.0.42
changelog:
  - Fixed virtual host definition ordering httpd.conf so users
    can override cpanel & whm proxy subdomains (EA-3865)


author: Darren Mobley <darren@cpanel.net> - 1.0-68
changelog:
  - HB-1952: Add posttrans script to clean upand reset to default the PHP
    configurations for users using FPM when the packages are removed.


author: Vladimir Prokofev <vprokofev@cloudlinux.com> 5.0.30-3
changelog:
  - Check configs to migrate from 4.x to 5.x Passenger
  - Restart Passenger (via httpd) to reload fresh liblve


author: S. Kurt Newman <kurt.newman@cpanel.net> - 1.4-4
changelog:
  - Change bwlimited.conf to 0644 so that normal users can load modules
    the same as Apache while testing their configuration with 'httpd -t'
  - Also renamed configuration to 490_mod_bwlimited.conf to match the
    naming scheme of our other files.


author: S. Kurt Newman <kurt.newman@cpanel.net> - 2.3.9-7
changelog:
  - General cleanup (EA-5395)
  - Cleans up run/mod_fcgid directory when package is uninstalled (EA-5594)
  - Switch to rpm macros


author: Stefan Mortensen <stefan.mortensen@atomia.com>, Mikhail Zhbankov <mzhbankov@cloudlinux.com> 1.0-26
changelog:
  - Fixed issue where cfg->path_regex was never being set when setting a custom path with LVEPathRegexp causing the default to always be used
  - AAP-57: mod_hostinglimits not increases EP in cgi mode (but process is in LVE)


author: Eugen Vodilov <evodilov@cloudlinux.com> - 1.0-30
changelog:
  - AAP-142: avoid lve_leave using filters
  - AAP-151: add EP limit hiting when EP is reached max value


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-29
changelog:
  - MODLS-538: Alignment issue fixed
  - MODLS-531: Added check if criu images exist on restore request
  - MODLS-532: lsapi_disable_reject_mode option is added
  - MODLS-528: reopen sulsphp_log to exclude too big FD number for criu
  - MODLS-520: Added new lsapi_avoid_zombies config
  - MODLS-491: Avoid worker's child to accept the connection
  - MODLS-491: Avoid reading/writing stale data from/to the lsphp socket
  - MODLS-527: starter logic is improved
  - MODLS-525: httpd criu dumper permissions changed
  - MODLS-519: Option to disable PWD var added


author:
  Alexandr Demeshko <ademeshko@cloudlinux.com> Daria Kavchuk <dkavchuk@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-30

changelog:
  - MODLS-551: statistics for Plesk via API only; structure reinvented for EA4
  - MODLS-549: Added dump configs lsapi_criu, lsapi_with_connection_pool, lsapi_per_user
  - MODLS-549: mod_lsapi stat for EA4 (v.1)
  - MODLS-441: http_keep_http200 option added
  - MODLS-533: Hook for Plesk update added
  - MODLS-548: Suppress unrelevant warning messages on Apache restart


changelog:
  - switch_mod_lsapi --stat option added
  - MODLS-560: Installation of mod_lsapi package on DA added

author:
  Alexandr Demeshko <ademeshko@cloudlinux.com> Daria Kavchuk <dkavchuk@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-31


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> 1.1-32
changelog:
  - MODLS-574: Started logics improvement
  - MODLS-573: add support alt-php7.3 for mod_lsapi (plesk) and ea-apache24-mod_lsapi
  - MODLS-565: lsapi_poll_timeout default-value 300


author:
  Sergey Kokhan <skokhan@cloudlinux.com> Daria Kavchuk <dkavchuk@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> 1.1-33

changelog:
  - MODLS-590: Fixed stack overflow lscapi_do_request
  - MODLS-582: Update Copyright for mod_lsapi project
  - MODLS-589: fix lsapi_terminate_backends_on_exit and lsapi_reset_criu_on_apache_restart directives
  - MODLS-584: semtimedwait improvement
  - MODLS-580: stat support added for DA without mod_lsapi rpm
  - MODLS-481: fix stuck when bodyLen is wrong
  - MODLS-579: Remove LVE support from cpanel mod_lsapi
  - Fix exception in case if there are no liblsapi installed
  - MODLS-576: added absolute path for service util


author:
  Daria Kavchuk <dkavchuk@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> 1.1-34

changelog:
  - MODLS-608: removed non-ascii symbol in copyright
  - MODLS-606: Fix lsapi_poll_timeout functionality
  - MODLS-600: fix mod_lsapi removal sets handler to none
  - MODLS-571: add support for httpd24-mod_lsapi usage statistics
  - MODLS-598: Fix permissions on config files
  - MODLS-587, MODLS-594: selector usage statistics added
  - MODLS-588: cpanel_mod_lsapi: put all of liblsapi's files into /opt/cpanel/ea-liblsapi/


author: Daria Kavchuk <dkavchuk@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-35
changelog:
  - Fixed statistics exceptions flow
  - MODLS-615: ea-apache24-mod_lsapi epoch bumped
  - MODLS-615: liblsapi confilct with ea-liblsapi added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-36
changelog:
  - MODLS-618: liblsapi vs ea-liblsapi conflict fixed
  - MODLS-619: Requires tag added for python related pkgs


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> 1.1-37
changelog:
  - MODLS-616: Ensure existence of directory for lsapi sockets in /var/run
  - MODLS-621: Add a configuration option (lsapi_use_req_hostname) that controls how virtualhost name is picked
  - AAP-253: spec and cmake files redesigned for new httpd24 build


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Sergey Kokhan <skokhan@cloudlinux.com> 1.1-38
changelog:
  - MODLS-577: Log changed for errors produced by http filter
  - AAP-243: Sentry: create a mechanism to save errors from mod_lsapi
  - MODLS-644: added ea-php73 lsapi handler
  - Added troubleshooting link into log for rejected request


author:
  Alexandr Demeshko <ademeshko@cloudlinux.com> Sergey Kokhan <skokhan@cloudlinux.com> Daria Kavchuk <dkavchuk@cloudlinux.com> 1.1-39

changelog:
  - MODLS-638: Clearing of systemd cgroup for lsphp added
  - MODLS-638: MODLS-481 reverted
  - MODLS-641: Build scripts redesigned
  - MODLS-654: CMakeCache deleted on make clean
  - AAP-243: Disable lsapi_sentry by default
  - MODLS-653: DA spec file added
  - MODLS-655: fix unexpected statistics output


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Sergey Kokhan <skokhan@cloudlinux.com> 1.1-40
changelog:
  - MODLS-661: Make possibility criu work on CL7h
  - MODLS-638: During graceful restart lsphp process are killed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> 1.1-42
changelog:
  - MODLS-679: fixed race condition is dump req info
  - MODLS-674: liblsapi receive response header interface redesigned
  - MODLS-670: ElasticAPM support redesigned
  - MODLS-665: added sulsphp_log logfile location directive
  - MODLS-656: unifying form of errors for sentry


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Sergey Kozhekin <skozhekin@cloudlinux.com> 1.1-44
changelog:
  - MODLS-691: Elastic APM dump request info fixed
  - MODLS-689: Support for lsapi_backend_pgrp_max_reqs and lsapi_backend_pgrp_max_crashes added
  - MODLS-530: benchmark script added
  - MODLS-684: Fix Plesk tests (issue with handlers on both platforms)


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Daria Kavchuk <dkavchuk@cloudlinux.com> 1.1-45
changelog:
  - MODLS-692: connection pool mode updated
  - MODLS-702: Apache restart added to mod_lsapi update
  - MODLS-703: rpm -q from mod_lsapi_stat removed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-46
changelog:
  - MODLS-723: proper request body length for 2G+ files
  - MODLS-722: clean shutdown support for LSAPI 7.6 added
  - MODLS-708: da_mod_lsapi installation added into da_cb_install script


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Sergey Kokhan <skokhan@cloudlinux.com> 1.1-47
changelog:
  - MODLS-727: Removed /var/cpanel/conf/apache/main usage as it was removed in cPanel
  - alt-php74 support added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-50
changelog:
  - MODLS-745: 1 second Apache restart condition detection added to starter
  - MODLS-746: Fix yum command string for CL8 stable in da_cb_install
  - MODLS-735: lsphp patch updated to to delete criu imgs when lsapi_backend_pgrp_max_crashes triggered
  - MODLS-737: DA hook script modified for CL8 and py3


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-51
changelog:
  - MODLS-789: rpm file integrity check added into da_cb_install
  - MODLS-760: Plesk removing hook fixed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-52
changelog:
  - MODLS-794: added no strict mode for configparser in stat utils
  - MODLS-800: Log level for backend PHP Notices changed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-53
changelog:
  - mod_lsapi changed for Litespeed SAPI 7.7
  - MODLS-811: Apache version detection fixed on update mod_lsapi


author:
  Sergey Kozhekin <skozhekin@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> Sergey Kokhan <skokhan@cloudlinux.com> 1.1-56

changelog:
  - MODLS-806: Dynamic lsapi_set_env added
  - MODLS-859: Added CRIU support to httpd24-mod_lsapi
  - MODLS-851: CL license updated


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-57
changelog:
  - MODLS-878: Custom control panel integration improved for src.rpm
  - MODLS-877: Added support of alt-php81


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Hasan Aliev <haliev@cloudlinux.com> 1.1-60
changelog:
  - MODLS-905: Add possibility to work with switch_mod_lsapi to control panel integration
  - MODLS-916: Trigger scriptlet creates /usr/local/bin/lsphp as symlink


author: Nikolay Petukhov <npetukhov@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-62
changelog:
  - MODLS-935: Fixed malformed http response caused by wrong http header
  - MODLS-940: Added oom score adjustment for lsphp processes


author: Nikolay Petukhov <npetukhov@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-63
changelog:
  - MODLS-952: Fixed the bug added when solving MODLS-935
  - CRIU support disabled on CL9 due to MODLS-955


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-64
changelog:
  - MODLS-946: lsapi_backend_use_own_log option context fixed
  - MODLS-956: liblsapi dependency made strict for mod_lsapi packages
  - MODLS-959: HTTP output filter error processing changed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-65
changelog:
  - MODLS-963: ea-php82 handler added
  - MODLS-962: DA installation script modified to be called without parameters


author: Kees Monshouwer <km|monshouwer_com> 0.9.8-1
changelog:
  - Address reported security bug in chroot mode. Thanks to the
    "cPanel Security Team" for the discovery of this bug.
  - Improve chroot behavior in drop capability mode.


author: Darren Mobley <darren@cpanel.net> - 2.8.0-1
changelog:
  - Changed name of ea-httpd rpm dependancy to ea-apache2-config
  - Fixed previous changelog entry claiming version was updated to 2.9.0


author: S. Kurt Newman <kurt.newman@cpanel.net> - 2.9.0-6
changelog:
  - Added explicit lua and xml2 Requires statements (EA-4433)
  - Remove mpm_itk and mod_ruid2 conflicts (EA-4433)
  - Added more comments to explain portions of spec file (EA-4433)
  - Arrest control of modsec2.conf so we can ensure proper Apache logging type (EA-4433)
  - Arrest control of conf.modules.d/800-mod_security2.conf (EA-4433)
  - RPM now creates logs/modsec_audit dir for concurrent logging (EA-4433)
  - Added comments to configuration files to help guide administrator (EA-4433)
  - Use module name, not file name in configuration file (EA-4654)


author: Eugene Zamriy <ezamriy@cloudlinux.com> - 1:0.7.2-12.3.cloudlinux
changelog:
  - suphp-0.7.1-cagefs.patch replaced with suphp-0.7.2-cagefs.am.patch
  - Dependencies adjusted to use ea-* packages from CloudLinux OS
  - Epoch bumped to 1
  - Vendor removed
  - dist macro added to Release


author: Tim Mullin <tim@cpanel.net> - 0.7.2-25
changelog:
  - EA-7525: Fixed 0008-Support-phprc_paths-section-in-suphp.conf.patch, targetMode used before initialized


author: Vasiliy Kleschov <vkleschov@cloudlinux.com> - 0.7.2-25.cloudlinux.1
changelog:
  - EA4D-97: Reverted changes in 0008-Support-phprc_paths-section-in-suphp.conf.patch due to conflict with CL versions of ea- and alt-php


author: Eugene Zamriy <ezamriy@cloudlinux.com> - 1:1.5.2-1.1.cloudlinux
changelog:
  - apr-1.4.2.1_cloudlinux_apr.patch was replaced with apr-1.4.2.2.lve.patch
  - Epoch bumped to 1
  - dist macro added to Release


author: Dan Muey <dan@cpanel.net> - 1.0-17
changelog:
  - EA-6344: ea_convert_php_ini fixups: add missing require, allow it to parse suphp conf handlers, add usage comment to package


author: Tim Mullin <tim@cpanel.net> - 1.0-19
changelog:
  - EA-7549: If the php config file is a symlink, and the force option is used, remove the symlink so the file can be written.


author: Eugene Zamriy <ezamriy@cloudlinux.com> - 1:1.0-3.1.cloudlinux
changelog:
  - Epoch bumped to 1
  - ea_current_to_profile and ea_install_profile sources added
  - dist macro added to Release


author: S. Kurt Newman <kurt.newman@cpanel.net> - 1.0-6
changelog:
  - Added ea_convert_php_ini script (EA-4772)
  - Updated rpm spec file to conform to standard macros
  - Fixed several rpmlint errors


author: Eugene Zamriy <ezamriy@cloudlinux.com> - 7.53.1-1.cloudlinux
changelog:
  - Removed unnecessary ea-libcurl and ea-libcurl-devel Provides
  - Removed wrong valgrind and perl* Provides
  - Epoch bumped to 1
  - Vendor tag removed


author: Eugene Zamriy <ezamriy@cloudlinux.com> - 7.53.1-1.cloudlinux.2
changelog:
  - Disable automatic Requires generation to avoid broken dependencies
  - Added libssh2, openldap, krb5-libs requirements
  - Added krb5-devel build requirement


author: Rishwanth Yeddula <rish@cpanel.net> - 7.58.0-2
changelog:
  - EA-7219: Build curl against the ea-nghttp2 that is installed
    in /opt/cpanel/nghttp2 to ensure that http2 can still be utilized.


author: Rishwanth Yeddula <rish@cpanel.net> - 7.58.0-3
changelog:
  - EA-7233: Require the newer version of ea-nghttp2 to ensure that
    the packages are updated as a set.


author: Rishwanth Yeddula <rish@cpanel.net> - 7.58.0-5
changelog:
  - ZC-3552: Ensure curl is linked again ea-openssl, and ea-nghttp2
    Additionally, added support for brotli.
    Added versioning to ea-openssl and nghttp2 requirements for easier
    maintenance.


author: Rishwanth Yeddula <rish@cpanel.net> - 7.59.0-2
changelog:
  - EA-7382: Update dependency on ea-openssl to require the latest version with versioned symbols.
  - ZC-3626: Re-enable SFTP support via libssh2.


author: Cory McIntire <cory@cpanel.net> - 7.60.0-1
changelog:
  - ZC-3769: Update cURL from 7.59.0 to 7.60.0
  - CVE-2018-1000300 https://curl.haxx.se/docs/adv_2018-82c2.html


author: Rishwanth Yeddula <rish@cpanel.net> - 7.61.0-1
changelog:
  - EA-7654: Update cURL from 7.60.0 to 7.61.0
  - CVE-2018-0500 https://curl.haxx.se/docs/adv_2018-70a2.html


author: Cory McIntire <cory@cpanel.net> - 7.61.1-1
changelog:
  - EA-7819: Update cURL from 7.61.0 to 7.61.1
  - CVE-2018-14618 https://curl.haxx.se/docs/CVE-2018-14618.html
  - Low priority CVE, 32 bit systems only


author: Cory McIntire <cory@cpanel.net> - 7.62.0-1
changelog:
  - EA-7978: Update cURL from 7.61.1 to 7.62.0 for CVEs
    https://curl.haxx.se/docs/CVE-2018-16839.html
    https://curl.haxx.se/docs/CVE-2018-16840.html
    https://curl.haxx.se/docs/CVE-2018-16842.html


author: Alexey Berezhok <aberezhok@cloudlinux.com> - 1:0.2.0-1.cloudlinux.2
changelog:
  - Make lsphp empty for backward compatibility
  - Added fix to cPanel's tests. It is incorrect to use local structures uninitialized


author: Dan Muey <dan@cpanel.net> - 0.2.0-5
changelog:
  - EA-6569: fix `-ea_php NN` handling to set package name
  - EA-6542: Ignore commented out MIME Types
  - EA-6543: ignore .htaccess 'mime type packages' that does not contain '-php'


author: Daniel Muey <dan@cpanel.net> - 1.0.0-1
changelog:
  - ZC-4400: rewrite to make it easier to work with and fix all the bugs
  - ZC-4425: deprecate -ea_php flag


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1:5.1.6-3
changelog:
  - EA-6958: Ensure ownership of _licensedir if it is set
  - ZC-3247: Add support for the allowed-php list to WHM’s Feature Lists


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 5.1.6-19.cloudlinux
changelog:
  - ZC-3551: Added versioning to ea-openssl and libcurl requirements.
  - ZC-3475: Update for ea-openssl shared object


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1:5.1.6-2
changelog:
  - add HaredenedPHP patches:
  -   bug 73825: Heap out of bounds read on unserialize in finish_nested_data() (CVE-2016-10161)
  -   bug 73737: FPE when parsing a tag format (CVE-2016-10158)
  -   bug 73868: Fix DOS vulnerability in gdImageCreateFromGd2Ctx()
  -   bug 73869: Signed Integer Overflow gd_io.c


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1:5.1.6-4
changelog:
  - add HaredenedPHP patches:
  -   Added check that soap.wsdl_cache_dir conforms to open_basedir (CVE-2013-1635)
  -   bug 70081: SoapClient info leak / null pointer dereference via multiple type confusions (CVE-2015-8835)
  -   Improve check for :memory: pseudo-filename in SQlite (CVE-2012-3365)
  -   bug 72627: Memory Leakage In exif_process_IFD_in_TIFF (CVE-2016-7128)
  - EA-5807: enable php-tidy on rhel 6 and above
  - EA-5946: force requirement of ea-libtidy instead of .so from BuildRequires ea-libtidy-devel


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1:5.1.6-5
changelog:
  - EA-2422: use ea-libcurl instead of system curl package
  - Disabled automatic Requires generation for curl subpackage


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 5.2.17-22.cloudlinux
changelog:
  - ZC-3552: Added versioning to ea-openssl and libcurl requirements.
  - ZC-3475: Update for ea-openssl shared object


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 1:5.2.17-2
changelog:
  - add HardenedPHP patches:
  -   security bug 73452: Segfault (Regression for #69152)
  -   security bug 73631: Invalid read when wddx decodes empty boolean element
  - ALTPHP-271: Fixed bug 71465: PHAR doesn't know about litespeed


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 1:5.2.17-6
changelog:
  - add HaredenedPHP patches:
  -   bug 73764: Crash while loading hostile phar archive (CVE-2016-10159)
  -   bug 73768: Memory corruption when loading hostile phar (CVE-2016-10160)
  -   bug 73825: Heap out of bounds read on unserialize in finish_nested_data() (CVE-2016-10161)
  -   bug 68447: grapheme_extract take an extra trailing character
  -   bug 73737: FPE when parsing a tag format (CVE-2016-10158)
  -   bug 73773: Seg fault when loading hostile phar
  -   bug 73868: Fix DOS vulnerability in gdImageCreateFromGd2Ctx()
  -   bug 73869: Signed Integer Overflow gd_io.c


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 1:5.2.17-8
changelog:
  - add HaredenedPHP patches:
  -   Improve check for :memory: pseudo-filename in SQlite (CVE-2012-3365)
  -   bug 70081: SoapClient info leak / null pointer dereference via multiple type confusions (CVE-2015-8835)
  -   Added check that soap.wsdl_cache_dir conforms to open_basedir (CVE-2013-1635)
  -   bug 70350: ZipArchive::extractTo allows for directory traversal when creating directories (CVE-2014-9767)
  -   Disabled external entities loading (CVE-2013-1643, CVE-2013-1824)
  -   bug 72627: Memory Leakage In exif_process_IFD_in_TIFF (CVE-2016-7128)
  - EA-5807: enable php-tidy on rhel 6 and above
  - EA-5946: force requirement of ea-libtidy instead of .so from BuildRequires ea-libtidy-devel


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1:5.3.29-3
changelog:
  - add HardenedPHP patches:
  -   CVE-2016-7412: Heap overflow in mysqlnd related to BIT fields
  -   CVE-2016-7413: wddx_deserialize use-after-free
  -   CVE-2016-7414: Out of bound when verify signature of zip phar in phar_parse_zipfile
  -   CVE-2016-7416: SEH buffer overflow msgfmt_format_message
  -   CVE-2016-7417: Missing type check when unserializing SplArray
  -   CVE-2016-7418: Out-Of-Bounds Read in php_wddx_push_element of wddx.c


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1:5.3.29-4
changelog:
  - add HardenedPHP patches
  -   security bug 73189: Memcpy negative size parameter php_resolve_path
  -   security bug 73150: missing NULL check in dom_document_save_html
  -   security bug 73284: heap overflow in php_ereg_replace function
  -   security bug 73218: stack-buffer-overflow through "ResourceBundle" methods
  -   security bug 73208: integer overflow in imap_8bit caused heap corruption
  -   security bug 73082: string length overflow in mb_encode_* function
  -   security bug 73174: heap overflow in php_pcre_replace_impl
  -   security bug 73276: crash in openssl_random_pseudo_bytes function
  -   security bug 73275: crash in openssl_encrypt function
  -   security bug 73017: memory corruption in wordwrap function
  -   security bug 73240: Write out of bounds at number_format
  -   security bug 73073: CachingIterator null dereference when convert to string
  -   security bug 73293: NULL pointer dereference in SimpleXMLElement::asXML()
  - Force users on jailshell and noshell to be chrooted when using php-fpm
  - remove Type=notify from ea-php53-php-frm.service file


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1:5.3.29-5
changelog:
  - ALTPHP-238: litespeed-php updated to 6.10
  - AL-1865: Back to ea-php "Ensure that php.d is not scanned when PHPRC is set" patch with mod_lsapi mode support


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1:5.3.29-6
changelog:
  - add HardenedPHP patches:
  -   security bug 73356: crash in bzcompress function
  -   CVE-2016-8670: Stack Buffer Overflow in GD dynamicGetbuf
  -   security bug 72482: Illegal write/read access caused by gdImageAALine overflow
  -   security bug 72696: imagefilltoborder stackoverflow on truecolor images
  -   security bug 73418: Integer Overflow in "_php_imap_mail" leads Heap Overflow
  -   security bug 73144: Use-after-free in ArrayObject Deserialization
  -   security bug 73192: parse_url return wrong hostname
  -   security bug 73331: NULL Pointer Dereference in WDDX Packet Deserialization with PDORow


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1:5.3.29-7
changelog:
  - add HardenedPHP patches:
  -   security bug 73452: Segfault (Regression for #69152)
  -   security bug 73631: Invalid read when wddx decodes empty boolean element
  - ALTPHP-271: Fixed bug 71465: PHAR doesn't know about litespeed
  - Fixed bug 67587: Redirection loop on nginx with FPM


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1:5.3.29-10
changelog:
  - add HaredenedPHP patches:
  -   bug 70014: openssl_random_pseudo_bytes() is not cryptographically secure (CVE-2015-8867)
  -   bug 70081: SoapClient info leak / null pointer dereference via multiple type confusions (CVE-2015-8835)
  -   bug 70121: unserialize() could lead to unexpected methods execution / NULL pointer deref (CVE-2015-8876)
  -   bug 70350: ZipArchive::extractTo allows for directory traversal when creating directories (CVE-2014-9767)
  -   bug 71906: AddressSanitizer: negative-size-param (-1) in mbfl_strcut (CVE-2016-4073)
  -   bug 72627: Memory Leakage In exif_process_IFD_in_TIFF (CVE-2016-7128)
  - ALTPHP-313: Add to lsphp support for custom php.ini defined via .htaccess
  - EA-5807: enable php-tidy on rhel 6 and above


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1:5.3.29-14.cloudlinux
changelog:
  - add require for ea-libnghttp2
  - EA-6484: Clarify Summary and Description for DSO
  - EA-6232: Build -curl with HTTP/2 support
  - Added ea-php53 symlinks to /usr/bin and /usr/local/bin
  - EA-3685: do not create apache user/group since we use nobody


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1:5.3.29-15.cloudlinux
changelog:
  - add HardenedPHP patches:
  - CVE-2017-11143: wddx parsing empty boolean tag leads to SIGSEGV
  - CVE-2017-11144: negative-size-param (-1) in memcpy in zif_openssl_seal()
  - CVE-2017-11145: wddx_deserialize() heap out-of-bound read via php_parse_date()
  - CVE-2017-11146: wddx_deserialize() heap out-of-bound read via php_parse_date() (caused by CVE-2017-11145)
  - CVE-2017-7890: Buffer over-read into uninitialized memory
  - CVE-2017-9224: Buffer Overflow in match_at() (Oniguruma issue)
  - CVE-2017-9226: Heap corruption in next_state_val() in 15 encodings (Oniguruma issue)
  - CVE-2017-9227: Bug in mbc_enc_len() (Oniguruma issue)
  - CVE-2017-9228: Heap corruption in next_state_val() due to uninitialized local variable (Oniguruma issue)
  - CVE-2017-9229: SIGSEGV in left_adjust_char_head() due to bad dereference (Oniguruma issue)
  - bug70436: Use After Free Vulnerability in unserialize()
  - bug74603: PHP INI Parsing Stack Buffer Overflow Vulnerability
  -
  - add LSAPI patches:
  - update Litespeed SAPI to 6.11
  - ALTPHP-351: make lsphp error messaqges more informative
  - ALTPHP-354: SIGCHILD handler fix after CRIU restoring


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1:5.3.29-16.cloudlinux
changelog:
  - ALTPHP-364: Added сorrect exit from lve if the nproc limit is reached
  - EA-6574: Make permissions on FPM socket dir more secure


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1:5.3.29-18.cloudlinux
changelog:
  - HB-2873: Added network-online.target to "After" in the service file
  - EA-6819: Patch to support libtidy 5.4.0


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 5.3.29-19.cloudlinux
changelog:
  - bug 75055 Out-Of-Bounds Read in timelib_meridian()
  - bug 72535 arcfour encryption stream filter crashes php


author: Ivan Danilov <idanilov@cloudlinux.com> 5.3.29-23.cloudlinux.3
changelog:
  - ALTPHP-482: Fix for bug 75605 Dumpable FPM child processes allow bypassing opcache access controls


author: Remi Collet <rcollet@redhat.com> 1.1-4
changelog:
  - avoid empty debuginfo subpackage
  - add LICENSE, README and php54.7 man page #1061454
  - add scldevel subpackage #1063356


author: Rex Dieter <rdieter@fedoraproject.org> 2007e-13
changelog:
  - _with_system_libc_client option (el6+)
  - tight deps via %?_isa
  - drop extraneous Requires(post,postun): xinetd


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 5.4.45-25.cloudlinux.1
changelog:
  - add HardenedPHP patches:
  -   security bug 73452: Segfault (Regression for #69152)
  -   security bug 73631: Invalid read when wddx decodes empty boolean element
  - ALTPHP-271: bug 71465: PHAR doesn't know about litespeed


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 5.4.45-25.cloudlinux.2
changelog:
  - add HaredenedPHP patches:
  -   bug 73764: Crash while loading hostile phar archive (CVE-2016-10159)
  -   bug 73768: Memory corruption when loading hostile phar (CVE-2016-10160)
  -   bug 73825: Heap out of bounds read on unserialize in finish_nested_data() (CVE-2016-10161)
  -   bug 68447: grapheme_extract take an extra trailing character
  -   bug 70213: Unserialize context shared on double class lookup
  -   bug 73549: Use after free when stream is passed to imagepng
  -   bug 73737: FPE when parsing a tag format (CVE-2016-10158)
  -   bug 73773: Seg fault when loading hostile phar
  -   bug 73868: Fix DOS vulnerability in gdImageCreateFromGd2Ctx()
  -   bug 73869: Signed Integer Overflow gd_io.c


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 5.4.45-28.cloudlinux.1
changelog:
  - add HaredenedPHP patches:
  -   bug 71906: AddressSanitizer: negative-size-param (-1) in mbfl_strcut (CVE-2016-4073)
  -   bug 72627: Memory Leakage In exif_process_IFD_in_TIFF (CVE-2016-7128)
  - ALTPHP-313: Add to lsphp support for custom php.ini defined via .htaccess


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 5.4.45-38.cloudlinux.1
changelog:
  - add HardenedPHP patches:
  - CVE-2017-11143: wddx parsing empty boolean tag leads to SIGSEGV
  - CVE-2017-11144: negative-size-param (-1) in memcpy in zif_openssl_seal()
  - CVE-2017-11145: wddx_deserialize() heap out-of-bound read via php_parse_date()
  - CVE-2017-11146: wddx_deserialize() heap out-of-bound read via php_parse_date() (caused by CVE-2017-11145)
  - CVE-2017-7890: Buffer over-read into uninitialized memory
  - CVE-2017-9224: Buffer Overflow in match_at() (Oniguruma issue)
  - CVE-2017-9226: Heap corruption in next_state_val() in 15 encodings (Oniguruma issue)
  - CVE-2017-9227: Bug in mbc_enc_len() (Oniguruma issue)
  - CVE-2017-9228: Heap corruption in next_state_val() due to uninitialized local variable (Oniguruma issue)
  - CVE-2017-9229: SIGSEGV in left_adjust_char_head() due to bad dereference (Oniguruma issue)
  - bug70436: Use After Free Vulnerability in unserialize()
  - bug74087: Segmentation fault in PHP7.1.1(compiled using the bundled PCRE library)
  - bug74603: PHP INI Parsing Stack Buffer Overflow Vulnerability
  -
  - add LSAPI patches:
  - update Litespeed SAPI to 6.11
  - ALTPHP-351: make lsphp error messaqges more informative
  - ALTPHP-354: SIGCHILD handler fix after CRIU restoring


author: S. Kurt Newman <kurt.newman@cpanel.net> - 4.7.5-5
changelog:
  - Added scl_package_override macro to regain access to global
    PHP macros that contain location and verison information.


author: Remi Collet <rcollet@redhat.com> 1.1-5
changelog:
  - avoid empty debuginfo subpackage
  - add LICENSE, README and php55.7 man page #1061455
  - add scldevel subpackage #1063357


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 5.5.38-11.cloudlinux.1
changelog:
  - add HaredenedPHP patches:
  -   bug 72627: Memory Leakage In exif_process_IFD_in_TIFF (CVE-2016-7128)
  - ALTPHP-313: Add to lsphp support for custom php.ini defined via .htaccess


author: Dmtriy Kasyanov <dkasyanov@cloudlinux.com> - 5.5.38-11.cloudlinux.3
changelog:
  - ALTPHP-318: bug 69090: opcache: add prefix/xor to cache keys/check permissions or separate caches
  - ALTPHP-323: LSPHP: CRIU support added


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 5.5.38-22.cloudlinux.1
changelog:
  - add HardenedPHP patches:
  - CVE-2017-11143: wddx parsing empty boolean tag leads to SIGSEGV
  - CVE-2017-11144: negative-size-param (-1) in memcpy in zif_openssl_seal()
  - CVE-2017-11145: wddx_deserialize() heap out-of-bound read via php_parse_date()
  - CVE-2017-11146: wddx_deserialize() heap out-of-bound read via php_parse_date() (caused by CVE-2017-11145)
  - CVE-2017-7890: Buffer over-read into uninitialized memory
  - CVE-2017-9224: Buffer Overflow in match_at() (Oniguruma issue)
  - CVE-2017-9226: Heap corruption in next_state_val() in 15 encodings (Oniguruma issue)
  - CVE-2017-9227: Bug in mbc_enc_len() (Oniguruma issue)
  - CVE-2017-9228: Heap corruption in next_state_val() due to uninitialized local variable (Oniguruma issue)
  - CVE-2017-9229: SIGSEGV in left_adjust_char_head() due to bad dereference (Oniguruma issue)
  - bug74087: Segmentation fault in PHP7.1.1(compiled using the bundled PCRE library)
  - bug74603: PHP INI Parsing Stack Buffer Overflow Vulnerability
  -
  - add LSAPI patches:
  - update Litespeed SAPI to 6.11
  - ALTPHP-351: make lsphp error messaqges more informative
  - ALTPHP-354: SIGCHILD handler fix after CRIU restoring


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 5.6.31-1.cloudlinux.1
changelog:
  - ALTPHP-351: make lsphp error messaqges more informative
  - ALTPHP-354: SIGCHILD handler fix after CRIU restoring


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1:7.0.15-1.cloudlinux.2
changelog:
  - ALTPHP-306: LSPHP: Return response code and response status line in cgi/fcgi manner
  - Update CRIU patch to version 7


author: <dan@cpanel.net> - 7.2.0-3.RC1
changelog:
  - EA-6757: Update 7.2.0 from beta3 to RC1
  - fix version specific symlinks
  - remove TZ patch for now (EA-6764 may re-add a version of it)
  - Add patch to fix RC1 bug  https://bugs.php.net/bug.php?id=75149 until the next version


author: Daniel Muey <dan@cpanel.net> - 8.5.32-8
changelog:
  - ZC-4142: Change RPM to not run tomcat by default
  - ZC-3874: avoid spurious `cat: /var/run/catalina.pid: No such file or directory`
  - ZC-4081: do not remove tomcat user
  - ZC-4082: change %files so tomcat does not have write access to things it shouldn't


author: Daniel Muey <dan@cpanel.net> - 8.5.32-9
changelog:
  - ZC-4252: Adjust for private instance in jailshell
  - ZC-4198: stop/restart private instances on update/uninstall as appropriate (ZC-4202/ZC-4203)
  - ZC-4198: Make private instance default configuration more secure (ZC-4205)


author: Daniel Muey <dan@cpanel.net> - 8.5.32-10
changelog:
  - ZC-4319: Minor security improvements
  - ZC-4318: do not suppress errors from code run under dropped privileges
  - ZC-4303: do not load external DTDs or external entities in tomcat’s XML files
  - ZC-4299: set umask when doing things as the user for better permissions
  - ZC-4300: remove pointless redirectPort that is in the default setup


author: Daniel Muey <dan@cpanel.net> - 8.5.32-13
changelog:
  - ZC-4427: Fix cosmetic USER issue caused by Cpanel::AccessIds lack of setting ENV
  - Fix stop/restart scriptlet ordering


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> - 1.0-37
changelog:
  - AAP-273: expand the range of LVEErrorCodes
  - AAP-253: spec and cmake redesigned for new httpd24 build
  - AAP-241: Update Copyright for mod_hostinglimits project
  - AAP-244: Fix cmakefiles for httpd24-mod_hostinglimits


