commit phoronix-test-suite for openSUSE:Factory

[Source-Sync]

Script 'mail_helper' called by obssrc
Hello community,

here is the log from the commit of package phoronix-test-suite for 
openSUSE:Factory checked in at 2022-12-08 16:52:18
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/phoronix-test-suite (Old)
 and      /work/SRC/openSUSE:Factory/.phoronix-test-suite.new.1835 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Package is "phoronix-test-suite"

Thu Dec  8 16:52:18 2022 rev:15 rq:1041351 version:10.8.4

Changes:
--------
--- /work/SRC/openSUSE:Factory/phoronix-test-suite/phoronix-test-suite.changes  
2022-11-30 15:01:18.777825857 +0100
+++ 
/work/SRC/openSUSE:Factory/.phoronix-test-suite.new.1835/phoronix-test-suite.changes
        2022-12-08 16:52:28.279878292 +0100
@@ -1,0 +2,5 @@
+Thu Dec  8 09:35:32 UTC 2022 - Martin Liška <mli...@suse.cz>
+
+- Add fix-CVE-2022-40704.patch that fixes boo#1206079.
+
+-------------------------------------------------------------------

New:
----
  fix-CVE-2022-40704.patch

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Other differences:
------------------
++++++ phoronix-test-suite.spec ++++++
--- /var/tmp/diff_new_pack.GwGN6W/_old  2022-12-08 16:52:28.847881205 +0100
+++ /var/tmp/diff_new_pack.GwGN6W/_new  2022-12-08 16:52:28.851881225 +0100
@@ -28,6 +28,7 @@
 Patch1:         harden_phoromatic-server.service.patch
 Patch2:         harden_phoronix-result-server.service.patch
 Patch3:         fix-shebang.patch
+Patch4:         fix-CVE-2022-40704.patch
 # https://github.com/phoronix-test-suite/phoronix-test-suite/issues/505 
[bsc#1175508]
 BuildRequires:  fdupes
 BuildRequires:  hicolor-icon-theme

++++++ fix-CVE-2022-40704.patch ++++++
>From d3880d9d3ba795138444da83f1153c3c3ac27640 Mon Sep 17 00:00:00 2001
From: Michael Larabel <mich...@phoronix.com>
Date: Sat, 23 Jul 2022 07:32:43 -0500
Subject: [PATCH] phoromatic: Explicitly check both $_GET abd $_POST in
 phoromatic_quit_if_invalid_input_found()

Fixes: 
https://github.com/phoronix-test-suite/phoronix-test-suite/issues/650#issuecomment-1193116678
---
 pts-core/phoromatic/phoromatic_functions.php | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/pts-core/phoromatic/phoromatic_functions.php 
b/pts-core/phoromatic/phoromatic_functions.php
index 74ccc5444c..c2313dcdea 100644
--- a/pts-core/phoromatic/phoromatic_functions.php
+++ b/pts-core/phoromatic/phoromatic_functions.php
@@ -37,9 +37,20 @@ function phoromatic_quit_if_invalid_input_found($input_keys 
= null)
        {
                foreach($input_keys as $key)
                {
-                       if(isset($_REQUEST[$key]) && !empty($_REQUEST[$key]))
+                       if(isset($_GET[$key]) && !empty($_GET[$key]))
                        {
-                               foreach(pts_arrays::to_array($_REQUEST[$key]) 
as $val_to_check)
+                               foreach(pts_arrays::to_array($_GET[$key]) as 
$val_to_check)
+                               {
+                                       if(stripos($val_to_check, 
$invalid_string) !== false)
+                                       {
+                                               echo '<strong>Exited due to 
invalid input ( ' . $invalid_string . ') attempted:</strong> ' . 
htmlspecialchars($val_to_check);
+                                               exit;
+                                       }
+                               }
+                       }
+                       if(isset($_POST[$key]) && !empty($_POST[$key]))
+                       {
+                               foreach(pts_arrays::to_array($_POST[$key]) as 
$val_to_check)
                                {
                                        if(stripos($val_to_check, 
$invalid_string) !== false)
                                        {