Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=frugalware-0.7.git;a=commitdiff;h=e6ba19592cda6d912d8f6b75f03d6c8b899886e8
commit e6ba19592cda6d912d8f6b75f03d6c8b899886e8 Author: voroskoi <[EMAIL PROTECTED]> Date: Sun Jan 20 16:00:22 2008 +0100 horde-webmail-1.0.1-4sayshell1-i686 added xss.php.diff, closes #2693 diff --git a/source/network-extra/horde-webmail/FrugalBuild b/source/network-extra/horde-webmail/FrugalBuild index a2cb7c6..1bae0a7 100644 --- a/source/network-extra/horde-webmail/FrugalBuild +++ b/source/network-extra/horde-webmail/FrugalBuild @@ -3,14 +3,15 @@ pkgname=horde-webmail pkgver=1.0.1 -pkgrel=3 +pkgrel=4sayshell1 pkgdesc="a free, enterprise ready, browser based communication suite" url="http://horde.org/webmail/"; rodepends=('php>=4.3.0') +depends=() groups=('network-extra') archs=('i686') up2date="lynx -dump http://www.horde.org/download/app/?app=webmail | grep \.tar\.gz | sed 's/.*-\(.*\)\.t.*/\1/'" -source=(ftp://ftp.horde.org/pub/$pkgname/$pkgname-$pkgver.tar.gz README.Frugalware) +source=(ftp://ftp.horde.org/pub/$pkgname/$pkgname-$pkgver.tar.gz README.Frugalware xss.php.diff) backup=(var/www/$pkgname/config/{conf,hooks,mime_drivers,motd,nls,prefs,registry}.php \ var/www/$pkgname/imp/config/{{conf,header,menu,mime_drivers,motd,prefs,servers,}.php,trailer.txt} \ var/www/$pkgname/ingo/config/{backends,conf,fields,prefs}.php \ @@ -22,11 +23,13 @@ options=('stick') build() { + Fpatchall Fmkdir /{var/www,usr/share/doc} Fmv ../src/$pkgname-$pkgver/docs /usr/share/doc/$pkgname-$pkgver Fmv ../src/$pkgname-$pkgver /var/www/$pkgname Fdoc README.Frugalware } # optimization OK - noarch -sha1sums=('501b939d4ac17a062244d78be0acaa2919e239db'\ - 'b539999b809904f06b3783af8ae93b7b656420da') +sha1sums=('501b939d4ac17a062244d78be0acaa2919e239db' \ + 'b539999b809904f06b3783af8ae93b7b656420da' \ + '3e40044f49fd0913764df44f04af5e6911d67f60') diff --git a/source/network-extra/horde-webmail/xss.php.diff b/source/network-extra/horde-webmail/xss.php.diff new file mode 100644 index 0000000..9309d9a --- /dev/null +++ b/source/network-extra/horde-webmail/xss.php.diff @@ -0,0 +1,137 @@ +--- orig/lib/Horde/Text/Filter/xss.php ++++ mod/lib/Horde/Text/Filter/xss.php +@@ -37,6 +37,10 @@ + { + $patterns = array(); + ++ // backport security patch from Horde 3.1.4 for etch ++ /* Remove all control characters. */ ++ $patterns['/[\x00-\x08\x0e-\x1f]/'] = ''; ++ + /* Removes HTML comments (including some scripts & styles). */ + if ($this->_params['strip_styles']) { + $patterns['/<!--.*?-->/s'] = ''; +@@ -72,34 +76,54 @@ + + /* Remove everything outside of and including the <body> tag. */ + if ($this->_params['body_only']) { +- $patterns['/.*<body[^>]*>/si'] = ''; +- $patterns['/<\/body>.*/si'] = ''; ++ // backport security patch from Horde 3.1.6 for etch ++ //$patterns['/.*<body[^>]*>/si'] = ''; ++ //$patterns['/<\/body>.*/si'] = ''; ++ $patterns['/.*<(body|html)[^>]*>/si'] = ''; ++ $patterns['/<\/(body|html)>.*/si'] = ''; + } + + /* Get all attribute="javascript:foo()" tags. This is essentially the + * regex /(=|url\()("?)[^>]*script:/ but expanded to catch camouflage + * with spaces and entities. */ +- $preg = '/((�*61;?|�*3D;?|=)|' . +- '((u|�*85;?|�*55;?|�*117;?|�*75;?)\s*' . +- '(r|�*82;?|�*52;?|�*114;?|�*72;?)\s*' . +- '(l|�*76;?|�*4c;?|�*108;?|�*6c;?)\s*' . +- '(\()))\s*' . +- '(�*34;?|�*22;?|"|�*39;?|�*27;?|\')?' . ++ // backport security patch from Horde 3.1.6 for etch ++ //$preg = '/((�*61;?|�*3D;?|=)|' . ++ // '((u|�*85;?|�*55;?|�*117;?|�*75;?)\s*' . ++ // '(r|�*82;?|�*52;?|�*114;?|�*72;?)\s*' . ++ // '(l|�*76;?|�*4c;?|�*108;?|�*6c;?)\s*' . ++ // '(\()))\s*' . ++ // '(�*34;?|�*22;?|"|�*39;?|�*27;?|\')?' . ++ // '[^>]*\s*' . ++ // '(s|�*83;?|�*53;?|�*115;?|�*73;?)\s*' . ++ // '(c|�*67;?|�*43;?|�*99;?|�*63;?)\s*' . ++ // '(r|�*82;?|�*52;?|�*114;?|�*72;?)\s*' . ++ // '(i|�*73;?|�*49;?|�*105;?|�*69;?)\s*' . ++ // '(p|�*80;?|�*50;?|�*112;?|�*70;?)\s*' . ++ // '(t|�*84;?|�*54;?|�*116;?|�*74;?)\s*' . ++ // '(:|�*58;?|�*3a;?)/i'; ++ $preg = '/((=|�*61;?|�*3D;?)|' . ++ '((u|�*85;?|�*55;?|�*117;?|�*75;?|\\\\0*75)\s*' . ++ '(r|�*82;?|�*52;?|�*114;?|�*72;?|\\\\0*72)\s*' . ++ '(l|�*76;?|�*4c;?|�*108;?|�*6c;?|\\\\0*6c)\s*' . ++ '(\(|\\\\0*28)))\s*' . ++ '(\'|�*34;?|�*22;?|"|�*39;?|�*27;?)?' . + '[^>]*\s*' . +- '(s|�*83;?|�*53;?|�*115;?|�*73;?)\s*' . +- '(c|�*67;?|�*43;?|�*99;?|�*63;?)\s*' . +- '(r|�*82;?|�*52;?|�*114;?|�*72;?)\s*' . +- '(i|�*73;?|�*49;?|�*105;?|�*69;?)\s*' . +- '(p|�*80;?|�*50;?|�*112;?|�*70;?)\s*' . +- '(t|�*84;?|�*54;?|�*116;?|�*74;?)\s*' . +- '(:|�*58;?|�*3a;?)/i'; ++ '(s|�*83;?|�*53;?|�*115;?|�*73;?|\\\\0*73)\s*' . ++ '(c|�*67;?|�*43;?|�*99;?|�*63;?|\\\\0*63)\s*' . ++ '(r|�*82;?|�*52;?|�*114;?|�*72;?|\\\\0*72)\s*' . ++ '(i|�*73;?|�*49;?|�*105;?|�*69;?|\\\\0*69)\s*' . ++ '(p|�*80;?|�*50;?|�*112;?|�*70;?|\\\\0*70)\s*' . ++ '(t|�*84;?|�*54;?|�*116;?|�*74;?|\\\\0*74)\s*' . ++ '(:|�*58;?|�*3a;?|\\\\0*3a)/i'; + $patterns[$preg] = '\1\8' . $this->_params['replace']; + + /* Get all on<foo>="bar()". NEVER allow these. */ + $patterns['/([\s"\']+' . + '(o|�*79;?|�*4f;?|�*111;?|�*6f;?)' . + '(n|�*78;?|�*4e;?|�*110;?|�*6e;?)' . +- '\w+)\s*=/i'] = '\1' . $this->_params['replace'] . '='; ++ // backport security patch from Horde 3.1.6 for etch ++ //'\w+)\s*=/i'] = '\1' . $this->_params['replace'] . '='; ++ '\w+)[^=a-z0-9"\'>]*=/i'] = '\1' . $this->_params['replace'] . '='; + + /* Remove all scripts since they might introduce garbage if they are + * not quoted properly. */ +@@ -128,6 +152,15 @@ + '(m|�*77;?|�*4d;?|�*109;?|�*6d;?)\s*' . + '(l|�*76;?|�*4c;?|�*108;?|�*6c;?)\s*/i', + ++ // backport security patch from Horde 3.1.6 for etch ++ '/<([^>a-z]*)\?([^>a-z]*)' . ++ '(i|�*73;?|�*49;?|�*105;?|�*69;?)\s*' . ++ '(m|�*77;?|�*4d;?|�*109;?|�*6d;?)\s*' . ++ '(p|�*80;?|�*50;?|�*112;?|�*70;?)\s*' . ++ '(o|�*79;?|�*4f;?|�*111;?|�*6f;?)\s*' . ++ '(r|�*82;?|�*52;?|�*114;?|�*72;?)\s*' . ++ '(t|�*84;?|�*54;?|�*116;?|�*74;?)\s*/i', ++ + '/<([^>a-z]*)' . + '(b|�*66;?|�*42;?|�*98;?|�*62;?)\s*' . + '(a|�*65;?|�*41;?|�*97;?|�*61;?)\s*' . +@@ -155,8 +188,19 @@ + '(c|�*67;?|�*43;?|�*99;?|�*63;?)\s*' . + '(t|�*84;?|�*54;?|�*116;?|�*74;?)\s*/i', + ++ ++ // backport security patch from Horde 3.1.6 for etch + '/<([^>a-z]*)' . +- '(i|�*73;?|�*49;?|�*105;?|�*69;?)\s*' . ++ '(l|�*76;?|�*4c;?|�*108;?|�*6c;?)\s*' . ++ '(a|�*65;?|�*41;?|�*97;?|�*61;?)\s*' . ++ '(y|�*89;?|�*59;?|�*121;?|�*79;?)\s*' . ++ '(e|�*69;?|�*45;?|�*101;?|�*65;?)\s*' . ++ '(r|�*82;?|�*52;?|�*114;?|�*72;?)\s*/i', ++ ++ '/<([^>a-z]*)' . ++ // backport security patch from Horde 3.1.6 for etch ++ //'(i|�*73;?|�*49;?|�*105;?|�*69;?)\s*' . ++ '(i|�*73;?|�*49;?|�*105;?|�*69;?)?\s*' . + '(f|�*70;?|�*46;?|�*102;?|�*66;?)\s*' . + '(r|�*82;?|�*52;?|�*114;?|�*72;?)\s*' . + '(a|�*65;?|�*41;?|�*97;?|�*61;?)\s*' . +@@ -176,9 +220,13 @@ + } + + /* A few other matches. */ +- $patterns['|<([^>]*)&{.*}([^>]*)>|'] = '<&{;}\3>'; ++ // backport security patch from Horde 3.1.6 for etch ++ //$patterns['|<([^>]*)&{.*}([^>]*)>|'] = '<&{;}\3>'; ++ $patterns['|<([^>]*)&{.*}([^>]*)>|'] = '<\1&{;}\2>'; + $patterns['|<([^>]*)mocha:([^>]*)>|i'] = '<\1' . $this->_params['replace'] . ':\2>'; +- $patterns['|<([^>]*)binding:([^>]*)>|i'] = '<\1' . $this->_params['replace'] . ':\2>'; ++ // backport security patch from Horde 3.1.6 for etch ++ //$patterns['|<([^>]*)binding:([^>]*)>|i'] = '<\1' . $this->_params['replace'] . ':\2>'; ++ $patterns['/<(([^>]*)|(style[^>]*>[^<]*))binding:((?(3)[^<]*<\/style)[^>]*)>/i'] = '<\1' . $this->_params['replace'] . ':\4>'; + + return array('regexp' => $patterns); + } _______________________________________________ Frugalware-git mailing list [email protected] http://frugalware.org/mailman/listinfo/frugalware-git
