security/vuxml: Fix firefox-esr PORTEPOCH in two Mozilla entries
www/firefox-esr has PORTEPOCH=2, but the firefox-esr ranges in these
two do not have it so they cannot match any installed package.
Sponsored by: The FreeBSD Foundation
www/bunkerweb: Update to 1.6.13
This covers the 1.6.12 and 1.6.13 releases.
Security: session fixation on login and an open redirect via the
post-login "next" parameter in the web UI, a second open redirect in
the antibot post-challenge flow, and cache deletion routes that
bypassed authorization. Biscuit token generation now binds the Host
header, client IP and username as typed terms, and adds an optional
API_ALLOWED_HOSTS allowlist. Reverse DNS results are forward-confirmed
before an IGNORE_RDNS or GREYLIST_RDNS suffix match is honored, so a
self-configured PTR record no longer bypasses blocking. ACME challenge
tokens are validated against the base64url character set, closing a
path traversal through the internal API. TOTP verification is enforced
on the exact validation endpoint instead of any path containing /totp.
New settings: REVERSE_PROXY_SSL_VERIFY and friends for upstream HTTPS
certificate verification, USE_LIMIT_REQ_GLOBAL and
LIMIT_REQ_GLOBAL_RATE for an aggregate per-service request rate,
[19 lines not shown]
