Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=frugalware-1.9.git;a=commitdiff;h=144d59190d3ff84935c1b9cde0d0157615c8168f
commit 144d59190d3ff84935c1b9cde0d0157615c8168f Author: kikadf <[email protected]> Date: Tue Aug 26 08:39:27 2014 +0200 django-1.5.9-1arcturus1-x86_64 * Fix CVE-2014-0480, CVE-2014-0481, CVE-2014-0482, CVE-2014-0483 diff --git a/source/devel-extra/django/CVE-2014-0472.patch b/source/devel-extra/django/CVE-2014-0472.patch deleted file mode 100644 index a967ad2..0000000 --- a/source/devel-extra/django/CVE-2014-0472.patch +++ /dev/null @@ -1,148 +0,0 @@ -Description: fix unexpected code execution using reverse() -Origin: provided by upstream -Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/python-django/+bug/1309779 - -Index: python-django-1.5.4/django/core/urlresolvers.py -=================================================================== ---- python-django-1.5.4.orig/django/core/urlresolvers.py 2013-09-15 02:28:02.000000000 -0400 -+++ python-django-1.5.4/django/core/urlresolvers.py 2014-04-19 09:04:48.762171513 -0400 -@@ -244,6 +244,10 @@ - self._reverse_dict = {} - self._namespace_dict = {} - self._app_dict = {} -+ # set of dotted paths to all functions and classes that are used in -+ # urlpatterns -+ self._callback_strs = set() -+ self._populated = False - - def __repr__(self): - if isinstance(self.urlconf_name, list) and len(self.urlconf_name): -@@ -261,6 +265,15 @@ - apps = {} - language_code = get_language() - for pattern in reversed(self.url_patterns): -+ if hasattr(pattern, '_callback_str'): -+ self._callback_strs.add(pattern._callback_str) -+ elif hasattr(pattern, '_callback'): -+ callback = pattern._callback -+ if not hasattr(callback, '__name__'): -+ lookup_str = callback.__module__ + "." + callback.__class__.__name__ -+ else: -+ lookup_str = callback.__module__ + "." + callback.__name__ -+ self._callback_strs.add(lookup_str) - p_pattern = pattern.regex.pattern - if p_pattern.startswith('^'): - p_pattern = p_pattern[1:] -@@ -281,6 +294,7 @@ - namespaces[namespace] = (p_pattern + prefix, sub_pattern) - for app_name, namespace_list in pattern.app_dict.items(): - apps.setdefault(app_name, []).extend(namespace_list) -+ self._callback_strs.update(pattern._callback_strs) - else: - bits = normalize(p_pattern) - lookups.appendlist(pattern.callback, (bits, p_pattern, pattern.default_args)) -@@ -289,6 +303,7 @@ - self._reverse_dict[language_code] = lookups - self._namespace_dict[language_code] = namespaces - self._app_dict[language_code] = apps -+ self._populated = True - - @property - def reverse_dict(self): -@@ -375,8 +390,13 @@ - def _reverse_with_prefix(self, lookup_view, _prefix, *args, **kwargs): - if args and kwargs: - raise ValueError("Don't mix *args and **kwargs in call to reverse()!") -+ -+ if not self._populated: -+ self._populate() -+ - try: -- lookup_view = get_callable(lookup_view, True) -+ if lookup_view in self._callback_strs: -+ lookup_view = get_callable(lookup_view, True) - except (ImportError, AttributeError) as e: - raise NoReverseMatch("Error importing '%s': %s." % (lookup_view, e)) - possibilities = self.reverse_dict.getlist(lookup_view) -Index: python-django-1.5.4/tests/regressiontests/urlpatterns_reverse/nonimported_module.py -=================================================================== ---- /dev/null 1970-01-01 00:00:00.000000000 +0000 -+++ python-django-1.5.4/tests/regressiontests/urlpatterns_reverse/nonimported_module.py 2014-04-19 09:04:48.762171513 -0400 -@@ -0,0 +1,3 @@ -+def view(request): -+ """Stub view""" -+ pass -Index: python-django-1.5.4/tests/regressiontests/urlpatterns_reverse/tests.py -=================================================================== ---- python-django-1.5.4.orig/tests/regressiontests/urlpatterns_reverse/tests.py 2013-09-15 02:28:02.000000000 -0400 -+++ python-django-1.5.4/tests/regressiontests/urlpatterns_reverse/tests.py 2014-04-19 09:04:48.762171513 -0400 -@@ -1,8 +1,11 @@ -+# -*- coding: utf-8 -*- - """ - Unit tests for reverse URL lookups. - """ - from __future__ import absolute_import, unicode_literals - -+import sys -+ - from django.conf import settings - from django.contrib.auth.models import User - from django.core.exceptions import ImproperlyConfigured, ViewDoesNotExist -@@ -290,6 +293,25 @@ - self.assertEqual(res['Location'], '/foo/') - res = redirect('http://example.com/') - self.assertEqual(res['Location'], 'http://example.com/') -+ # Assert that we can redirect using UTF-8 strings -+ res = redirect('/æøå/abc/') -+ self.assertEqual(res['Location'], '/%C3%A6%C3%B8%C3%A5/abc/') -+ # Assert that no imports are attempted when dealing with a relative path -+ # (previously, the below would resolve in a UnicodeEncodeError from __import__ ) -+ res = redirect('/æøå.abc/') -+ self.assertEqual(res['Location'], '/%C3%A6%C3%B8%C3%A5.abc/') -+ res = redirect('os.path') -+ self.assertEqual(res['Location'], 'os.path') -+ -+ def test_no_illegal_imports(self): -+ # modules that are not listed in urlpatterns should not be importable -+ redirect("urlpatterns_reverse.nonimported_module.view") -+ self.assertNotIn("urlpatterns_reverse.nonimported_module", sys.modules) -+ -+ def test_reverse_by_path_nested(self): -+ # Views that are added to urlpatterns using include() should be -+ # reversable by doted path. -+ self.assertEqual(reverse('regressiontests.urlpatterns_reverse.views.nested_view'), '/includes/nested_path/') - - def test_redirect_view_object(self): - from .views import absolute_kwargs_view -@@ -559,4 +581,3 @@ - # swallow it. - self.assertRaises(AttributeError, get_callable, - 'regressiontests.urlpatterns_reverse.views_broken.i_am_broken') -- -Index: python-django-1.5.4/tests/regressiontests/urlpatterns_reverse/urls.py -=================================================================== ---- python-django-1.5.4.orig/tests/regressiontests/urlpatterns_reverse/urls.py 2013-09-15 02:21:17.000000000 -0400 -+++ python-django-1.5.4/tests/regressiontests/urlpatterns_reverse/urls.py 2014-04-19 09:04:48.762171513 -0400 -@@ -7,6 +7,7 @@ - - other_patterns = patterns('', - url(r'non_path_include/$', empty_view, name='non_path_include'), -+ url(r'nested_path/$', 'regressiontests.urlpatterns_reverse.views.nested_view'), - ) - - urlpatterns = patterns('', -Index: python-django-1.5.4/tests/regressiontests/urlpatterns_reverse/views.py -=================================================================== ---- python-django-1.5.4.orig/tests/regressiontests/urlpatterns_reverse/views.py 2013-09-15 02:28:02.000000000 -0400 -+++ python-django-1.5.4/tests/regressiontests/urlpatterns_reverse/views.py 2014-04-19 09:04:48.762171513 -0400 -@@ -16,6 +16,10 @@ - def defaults_view(request, arg1, arg2): - pass - -+def nested_view(request): -+ pass -+ -+ - def erroneous_view(request): - import non_existent - diff --git a/source/devel-extra/django/CVE-2014-0473.patch b/source/devel-extra/django/CVE-2014-0473.patch deleted file mode 100644 index 6c5fa99..0000000 --- a/source/devel-extra/django/CVE-2014-0473.patch +++ /dev/null @@ -1,92 +0,0 @@ -Description: fix caching of anonymous pages could reveal CSRF token -Origin: commit d96e13553a37843a58be7440f159258c2a57094f -Author: Aymeric Augustin <[email protected]> -Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/python-django/+bug/1309782 - -Index: python-django-1.5.4/django/middleware/cache.py -=================================================================== ---- python-django-1.5.4.orig/django/middleware/cache.py 2013-09-15 02:28:02.000000000 -0400 -+++ python-django-1.5.4/django/middleware/cache.py 2014-04-19 09:06:07.254172785 -0400 -@@ -50,7 +50,8 @@ - - from django.conf import settings - from django.core.cache import get_cache, DEFAULT_CACHE_ALIAS --from django.utils.cache import get_cache_key, learn_cache_key, patch_response_headers, get_max_age -+from django.utils.cache import (get_cache_key, get_max_age, has_vary_header, -+ learn_cache_key, patch_response_headers) - - - class UpdateCacheMiddleware(object): -@@ -93,8 +94,15 @@ - if not self._should_update_cache(request, response): - # We don't need to update the cache, just return. - return response -+ - if response.streaming or response.status_code != 200: - return response -+ -+ # Don't cache responses that set a user-specific (and maybe security -+ # sensitive) cookie in response to a cookie-less request. -+ if not request.COOKIES and response.cookies and has_vary_header(response, 'Cookie'): -+ return response -+ - # Try to get the timeout from the "max-age" section of the "Cache- - # Control" header before reverting to using the default cache_timeout - # length. -Index: python-django-1.5.4/tests/regressiontests/cache/tests.py -=================================================================== ---- python-django-1.5.4.orig/tests/regressiontests/cache/tests.py 2013-09-15 02:28:02.000000000 -0400 -+++ python-django-1.5.4/tests/regressiontests/cache/tests.py 2014-04-19 09:06:07.258172785 -0400 -@@ -18,11 +18,13 @@ - from django.core.cache import get_cache - from django.core.cache.backends.base import (CacheKeyWarning, - InvalidCacheBackendError) -+from django.core.context_processors import csrf - from django.db import router - from django.http import (HttpResponse, HttpRequest, StreamingHttpResponse, - QueryDict) - from django.middleware.cache import (FetchFromCacheMiddleware, - UpdateCacheMiddleware, CacheMiddleware) -+from django.middleware.csrf import CsrfViewMiddleware - from django.template import Template - from django.template.response import TemplateResponse - from django.test import TestCase, TransactionTestCase, RequestFactory -@@ -1456,6 +1458,10 @@ - return HttpResponse('Hello World %s' % value) - - -+def csrf_view(request): -+ return HttpResponse(csrf(request)['csrf_token']) -+ -+ - @override_settings( - CACHE_MIDDLEWARE_ALIAS='other', - CACHE_MIDDLEWARE_KEY_PREFIX='middlewareprefix', -@@ -1696,6 +1702,27 @@ - response = other_with_timeout_view(request, '18') - self.assertEqual(response.content, b'Hello World 18') - -+ def test_sensitive_cookie_not_cached(self): -+ """ -+ Django must prevent caching of responses that set a user-specific (and -+ maybe security sensitive) cookie in response to a cookie-less request. -+ """ -+ csrf_middleware = CsrfViewMiddleware() -+ cache_middleware = CacheMiddleware() -+ -+ request = self.factory.get('/view/') -+ self.assertIsNone(cache_middleware.process_request(request)) -+ -+ csrf_middleware.process_view(request, csrf_view, (), {}) -+ -+ response = csrf_view(request) -+ -+ response = csrf_middleware.process_response(request, response) -+ response = cache_middleware.process_response(request, response) -+ -+ # Inserting a CSRF cookie in a cookie-less request prevented caching. -+ self.assertIsNone(cache_middleware.process_request(request)) -+ - - @override_settings( - CACHE_MIDDLEWARE_KEY_PREFIX='settingsprefix', diff --git a/source/devel-extra/django/CVE-2014-0474.patch b/source/devel-extra/django/CVE-2014-0474.patch deleted file mode 100644 index db53b21..0000000 --- a/source/devel-extra/django/CVE-2014-0474.patch +++ /dev/null @@ -1,251 +0,0 @@ -Description: fix MySQL typecasting issue -Origin: provided by upstream -Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/python-django/+bug/1309784 - -Index: python-django-1.5.4/django/db/models/fields/__init__.py -=================================================================== ---- python-django-1.5.4.orig/django/db/models/fields/__init__.py 2013-09-15 02:28:02.000000000 -0400 -+++ python-django-1.5.4/django/db/models/fields/__init__.py 2014-04-19 09:06:37.378173274 -0400 -@@ -934,6 +934,12 @@ - kwargs['max_length'] = kwargs.get('max_length', 100) - Field.__init__(self, verbose_name, name, **kwargs) - -+ def get_prep_value(self, value): -+ value = super(FilePathField, self).get_prep_value(value) -+ if value is None: -+ return None -+ return six.text_type(value) -+ - def formfield(self, **kwargs): - defaults = { - 'path': self.path, -@@ -1035,6 +1041,12 @@ - kwargs['max_length'] = 15 - Field.__init__(self, *args, **kwargs) - -+ def get_prep_value(self, value): -+ value = super(IPAddressField, self).get_prep_value(value) -+ if value is None: -+ return None -+ return six.text_type(value) -+ - def get_internal_type(self): - return "IPAddressField" - -@@ -1072,12 +1084,14 @@ - return value or None - - def get_prep_value(self, value): -+ if value is None: -+ return value - if value and ':' in value: - try: - return clean_ipv6_address(value, self.unpack_ipv4) - except exceptions.ValidationError: - pass -- return value -+ return six.text_type(value) - - def formfield(self, **kwargs): - defaults = {'form_class': forms.GenericIPAddressField} -Index: python-django-1.5.4/docs/howto/custom-model-fields.txt -=================================================================== ---- python-django-1.5.4.orig/docs/howto/custom-model-fields.txt 2013-09-15 02:28:02.000000000 -0400 -+++ python-django-1.5.4/docs/howto/custom-model-fields.txt 2014-04-19 09:06:37.378173274 -0400 -@@ -501,6 +501,16 @@ - return ''.join([''.join(l) for l in (value.north, - value.east, value.south, value.west)]) - -+.. warning:: -+ -+ If your custom field uses the ``CHAR``, ``VARCHAR`` or ``TEXT`` -+ types for MySQL, you must make sure that :meth:`.get_prep_value` -+ always returns a string type. MySQL performs flexible and unexpected -+ matching when a query is performed on these types and the provided -+ value is an integer, which can cause queries to include unexpected -+ objects in their results. This problem cannot occur if you always -+ return a string type from :meth:`.get_prep_value`. -+ - Converting query values to database values - ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -Index: python-django-1.5.4/docs/ref/databases.txt -=================================================================== ---- python-django-1.5.4.orig/docs/ref/databases.txt 2013-09-15 02:28:02.000000000 -0400 -+++ python-django-1.5.4/docs/ref/databases.txt 2014-04-19 09:06:37.378173274 -0400 -@@ -429,6 +429,22 @@ - statement. If ``select_for_update()`` is used with ``nowait=True`` then a - ``DatabaseError`` will be raised. - -+Automatic typecasting can cause unexpected results -+-------------------------------------------------- -+ -+When performing a query on a string type, but with an integer value, MySQL will -+coerce the types of all values in the table to an integer before performing the -+comparison. If your table contains the values ``'abc'``, ``'def'`` and you -+query for ``WHERE mycolumn=0``, both rows will match. Similarly, ``WHERE mycolumn=1`` -+will match the value ``'abc1'``. Therefore, string type fields included in Django -+will always cast the value to a string before using it in a query. -+ -+If you implement custom model fields that inherit from :class:`~django.db.models.Field` -+directly, are overriding :meth:`~django.db.models.Field.get_prep_value`, or use -+:meth:`extra() <django.db.models.query.QuerySet.extra>` or -+:meth:`raw() <django.db.models.Manager.raw>`, you should ensure that you -+perform the appropriate typecasting. -+ - .. _sqlite-notes: - - SQLite notes -Index: python-django-1.5.4/docs/ref/models/querysets.txt -=================================================================== ---- python-django-1.5.4.orig/docs/ref/models/querysets.txt 2013-09-15 02:28:02.000000000 -0400 -+++ python-django-1.5.4/docs/ref/models/querysets.txt 2014-04-19 09:06:37.378173274 -0400 -@@ -1068,6 +1068,16 @@ - - Entry.objects.extra(where=['headline=%s'], params=['Lennon']) - -+.. warning:: -+ -+ If you are performing queries on MySQL, note that MySQL's silent type coercion -+ may cause unexpected results when mixing types. If you query on a string -+ type column, but with an integer value, MySQL will coerce the types of all values -+ in the table to an integer before performing the comparison. For example, if your -+ table contains the values ``'abc'``, ``'def'`` and you query for ``WHERE mycolumn=0``, -+ both rows will match. To prevent this, perform the correct typecasting -+ before using the value in a query. -+ - defer - ~~~~~ - -Index: python-django-1.5.4/docs/topics/db/sql.txt -=================================================================== ---- python-django-1.5.4.orig/docs/topics/db/sql.txt 2013-09-15 02:28:02.000000000 -0400 -+++ python-django-1.5.4/docs/topics/db/sql.txt 2014-04-19 09:06:37.378173274 -0400 -@@ -66,6 +66,16 @@ - database, but does nothing to enforce that. If the query does not - return rows, a (possibly cryptic) error will result. - -+.. warning:: -+ -+ If you are performing queries on MySQL, note that MySQL's silent type coercion -+ may cause unexpected results when mixing types. If you query on a string -+ type column, but with an integer value, MySQL will coerce the types of all values -+ in the table to an integer before performing the comparison. For example, if your -+ table contains the values ``'abc'``, ``'def'`` and you query for ``WHERE mycolumn=0``, -+ both rows will match. To prevent this, perform the correct typecasting -+ before using the value in a query. -+ - Mapping query fields to model fields - ------------------------------------ - -Index: python-django-1.5.4/tests/regressiontests/model_fields/tests.py -=================================================================== ---- python-django-1.5.4.orig/tests/regressiontests/model_fields/tests.py 2013-09-15 02:28:02.000000000 -0400 -+++ python-django-1.5.4/tests/regressiontests/model_fields/tests.py 2014-04-19 09:06:37.378173274 -0400 -@@ -6,8 +6,15 @@ - from django import test - from django import forms - from django.core.exceptions import ValidationError -+from django.db.models.fields import ( -+ AutoField, BigIntegerField, BooleanField, CharField, -+ CommaSeparatedIntegerField, DateField, DateTimeField, DecimalField, -+ EmailField, FilePathField, FloatField, IntegerField, IPAddressField, -+ GenericIPAddressField, NullBooleanField, PositiveIntegerField, -+ PositiveSmallIntegerField, SlugField, SmallIntegerField, TextField, -+ TimeField, URLField) - from django.db import models --from django.db.models.fields.files import FieldFile -+from django.db.models.fields.files import FileField, ImageField, FieldFile - from django.utils import six - from django.utils import unittest - -@@ -414,3 +421,89 @@ - field = d._meta.get_field('myfile') - field.save_form_data(d, 'else.txt') - self.assertEqual(d.myfile, 'else.txt') -+ -+ -+class PrepValueTest(test.TestCase): -+ def test_AutoField(self): -+ self.assertIsInstance(AutoField(primary_key=True).get_prep_value(1), int) -+ -+ @unittest.skipIf(six.PY3, "Python 3 has no `long` type.") -+ def test_BigIntegerField(self): -+ self.assertIsInstance(BigIntegerField().get_prep_value(long(9999999999999999999)), long) -+ -+ def test_BooleanField(self): -+ self.assertIsInstance(BooleanField().get_prep_value(True), bool) -+ -+ def test_CharField(self): -+ self.assertIsInstance(CharField().get_prep_value(''), six.text_type) -+ self.assertIsInstance(CharField().get_prep_value(0), six.text_type) -+ -+ def test_CommaSeparatedIntegerField(self): -+ self.assertIsInstance(CommaSeparatedIntegerField().get_prep_value('1,2'), six.text_type) -+ self.assertIsInstance(CommaSeparatedIntegerField().get_prep_value(0), six.text_type) -+ -+ def test_DateField(self): -+ self.assertIsInstance(DateField().get_prep_value(datetime.date.today()), datetime.date) -+ -+ def test_DateTimeField(self): -+ self.assertIsInstance(DateTimeField().get_prep_value(datetime.datetime.now()), datetime.datetime) -+ -+ def test_DecimalField(self): -+ self.assertIsInstance(DecimalField().get_prep_value(Decimal('1.2')), Decimal) -+ -+ def test_EmailField(self): -+ self.assertIsInstance(EmailField().get_prep_value('[email protected]'), six.text_type) -+ -+ def test_FileField(self): -+ self.assertIsInstance(FileField().get_prep_value('filename.ext'), six.text_type) -+ self.assertIsInstance(FileField().get_prep_value(0), six.text_type) -+ -+ def test_FilePathField(self): -+ self.assertIsInstance(FilePathField().get_prep_value('tests.py'), six.text_type) -+ self.assertIsInstance(FilePathField().get_prep_value(0), six.text_type) -+ -+ def test_FloatField(self): -+ self.assertIsInstance(FloatField().get_prep_value(1.2), float) -+ -+ def test_ImageField(self): -+ self.assertIsInstance(ImageField().get_prep_value('filename.ext'), six.text_type) -+ -+ def test_IntegerField(self): -+ self.assertIsInstance(IntegerField().get_prep_value(1), int) -+ -+ def test_IPAddressField(self): -+ self.assertIsInstance(IPAddressField().get_prep_value('127.0.0.1'), six.text_type) -+ self.assertIsInstance(IPAddressField().get_prep_value(0), six.text_type) -+ -+ def test_GenericIPAddressField(self): -+ self.assertIsInstance(GenericIPAddressField().get_prep_value('127.0.0.1'), six.text_type) -+ self.assertIsInstance(GenericIPAddressField().get_prep_value(0), six.text_type) -+ -+ def test_NullBooleanField(self): -+ self.assertIsInstance(NullBooleanField().get_prep_value(True), bool) -+ -+ def test_PositiveIntegerField(self): -+ self.assertIsInstance(PositiveIntegerField().get_prep_value(1), int) -+ -+ def test_PositiveSmallIntegerField(self): -+ self.assertIsInstance(PositiveSmallIntegerField().get_prep_value(1), int) -+ -+ def test_SlugField(self): -+ self.assertIsInstance(SlugField().get_prep_value('slug'), six.text_type) -+ self.assertIsInstance(SlugField().get_prep_value(0), six.text_type) -+ -+ def test_SmallIntegerField(self): -+ self.assertIsInstance(SmallIntegerField().get_prep_value(1), int) -+ -+ def test_TextField(self): -+ self.assertIsInstance(TextField().get_prep_value('Abc'), six.text_type) -+ self.assertIsInstance(TextField().get_prep_value(0), six.text_type) -+ -+ def test_TimeField(self): -+ self.assertIsInstance( -+ TimeField().get_prep_value(datetime.datetime.now().time()), -+ datetime.time) -+ -+ def test_URLField(self): -+ self.assertIsInstance(URLField().get_prep_value('http://domain.com'), six.text_type) -+ diff --git a/source/devel-extra/django/CVE-2014-1418.patch b/source/devel-extra/django/CVE-2014-1418.patch deleted file mode 100644 index a27bd2c..0000000 --- a/source/devel-extra/django/CVE-2014-1418.patch +++ /dev/null @@ -1,147 +0,0 @@ -Description: Drop IE6/IE7 compatability functions that introduced cache - coherency errors. Fixes CVE-2014-1418. - -Origin: Original patch from upstream - -diff --git a/django/core/handlers/base.py b/django/core/handlers/base.py -index 7fff71a..4819ad3 100644 ---- a/django/core/handlers/base.py -+++ b/django/core/handlers/base.py -@@ -22,8 +22,6 @@ class BaseHandler(object): - response_fixes = [ - http.fix_location_header, - http.conditional_content_removal, -- http.fix_IE_for_attach, -- http.fix_IE_for_vary, - ] - - def __init__(self): -diff --git a/django/http/__init__.py b/django/http/__init__.py -index 46afa34..08d9d23 100644 ---- a/django/http/__init__.py -+++ b/django/http/__init__.py -@@ -6,5 +6,4 @@ from django.http.response import (HttpResponse, StreamingHttpResponse, - HttpResponseRedirect, HttpResponseNotModified, HttpResponseBadRequest, - HttpResponseForbidden, HttpResponseNotFound, HttpResponseNotAllowed, - HttpResponseGone, HttpResponseServerError, Http404, BadHeaderError) --from django.http.utils import (fix_location_header, conditional_content_removal, -- fix_IE_for_attach, fix_IE_for_vary) -+from django.http.utils import fix_location_header, conditional_content_removal -diff --git a/django/http/utils.py b/django/http/utils.py -index fcb3fec..ace35eb 100644 ---- a/django/http/utils.py -+++ b/django/http/utils.py -@@ -39,58 +39,3 @@ def conditional_content_removal(request, response): - else: - response.content = '' - return response -- -- --def fix_IE_for_attach(request, response): -- """ -- This function will prevent Django from serving a Content-Disposition header -- while expecting the browser to cache it (only when the browser is IE). This -- leads to IE not allowing the client to download. -- """ -- useragent = request.META.get('HTTP_USER_AGENT', '').upper() -- if 'MSIE' not in useragent and 'CHROMEFRAME' not in useragent: -- return response -- -- offending_headers = ('no-cache', 'no-store') -- if response.has_header('Content-Disposition'): -- try: -- del response['Pragma'] -- except KeyError: -- pass -- if response.has_header('Cache-Control'): -- cache_control_values = [value.strip() for value in -- response['Cache-Control'].split(',') -- if value.strip().lower() not in offending_headers] -- -- if not len(cache_control_values): -- del response['Cache-Control'] -- else: -- response['Cache-Control'] = ', '.join(cache_control_values) -- -- return response -- -- --def fix_IE_for_vary(request, response): -- """ -- This function will fix the bug reported at -- http://support.microsoft.com/kb/824847/en-us?spid=8722&sid=global -- by clearing the Vary header whenever the mime-type is not safe -- enough for Internet Explorer to handle. Poor thing. -- """ -- useragent = request.META.get('HTTP_USER_AGENT', '').upper() -- if 'MSIE' not in useragent and 'CHROMEFRAME' not in useragent: -- return response -- -- # These mime-types that are decreed "Vary-safe" for IE: -- safe_mime_types = ('text/html', 'text/plain', 'text/sgml') -- -- # The first part of the Content-Type field will be the MIME type, -- # everything after ';', such as character-set, can be ignored. -- mime_type = response.get('Content-Type', '').partition(';')[0] -- if mime_type not in safe_mime_types: -- try: -- del response['Vary'] -- except KeyError: -- pass -- -- return response -diff --git a/tests/regressiontests/utils/http.py b/tests/regressiontests/utils/http.py -index 6d3bc02..03706ca 100644 ---- a/tests/regressiontests/utils/http.py -+++ b/tests/regressiontests/utils/http.py -@@ -67,50 +67,6 @@ class TestUtilsHttp(unittest.TestCase): - ] - self.assertTrue(result in acceptable_results) - -- def test_fix_IE_for_vary(self): -- """ -- Regression for #16632. -- -- `fix_IE_for_vary` shouldn't crash when there's no Content-Type header. -- """ -- -- # functions to generate responses -- def response_with_unsafe_content_type(): -- r = HttpResponse(content_type="text/unsafe") -- r['Vary'] = 'Cookie' -- return r -- -- def no_content_response_with_unsafe_content_type(): -- # 'Content-Type' always defaulted, so delete it -- r = response_with_unsafe_content_type() -- del r['Content-Type'] -- return r -- -- # request with & without IE user agent -- rf = RequestFactory() -- request = rf.get('/') -- ie_request = rf.get('/', HTTP_USER_AGENT='MSIE') -- -- # not IE, unsafe_content_type -- response = response_with_unsafe_content_type() -- utils.fix_IE_for_vary(request, response) -- self.assertTrue('Vary' in response) -- -- # IE, unsafe_content_type -- response = response_with_unsafe_content_type() -- utils.fix_IE_for_vary(ie_request, response) -- self.assertFalse('Vary' in response) -- -- # not IE, no_content -- response = no_content_response_with_unsafe_content_type() -- utils.fix_IE_for_vary(request, response) -- self.assertTrue('Vary' in response) -- -- # IE, no_content -- response = no_content_response_with_unsafe_content_type() -- utils.fix_IE_for_vary(ie_request, response) -- self.assertFalse('Vary' in response) -- - def test_base36(self): - # reciprocity works - for n in [0, 1, 1000, 1000000]: diff --git a/source/devel-extra/django/FrugalBuild b/source/devel-extra/django/FrugalBuild index 5ccf433..3512b50 100644 --- a/source/devel-extra/django/FrugalBuild +++ b/source/devel-extra/django/FrugalBuild @@ -5,9 +5,9 @@ pkgname=django _F_archive_name=Django -pkgver=1.5.2 +pkgver=1.5.9 _branch=1.5 -pkgrel=2arcturus2 +pkgrel=1arcturus1 pkgdesc="Django is a Python web framework" url="https://www.djangoproject.com"; depends=('python') @@ -16,17 +16,7 @@ groups=('devel-extra') archs=('i686' 'x86_64') up2date="Fwcat $url/download|lynx -dump -stdin|grep -m1 .tar.gz|sed 's/.*Django-\(.*\).tar.gz.*/\1/'" source=($url/m/releases/$_branch/$_F_archive_name-$pkgver.tar.gz) -sha1sums=('7137d32505727b057c77b025c3a0355c131de1af') +sha1sums=('ea77ddb72d935b2c36ed2ea4dac73dd7dc985080') -# FSA fix *** -source=(${source[@]} CVE-2014-0472.patch CVE-2014-0473.patch CVE-2014-0474.patch - is_safe_url_1_5.diff CVE-2014-1418.patch) -sha1sums=(${sha1sums[@]} '5ef94b51e0d3bf4ed93411266a738ea99fca7eb8' \ - '47d506fa7cddd4994ea47652e9fda7d35de882d4' \ - '1a5b72cb58fdae94132403f53c7a15e210826c59' \ - '0097ec2fd08eb0c7ee93b638da6d7a2c47067f17' \ - '6173fe9fdc3099aaf5e6afe184bb88434576cb41') -# *********** - diff --git a/source/devel-extra/django/is_safe_url_1_5.diff b/source/devel-extra/django/is_safe_url_1_5.diff deleted file mode 100644 index 199569f..0000000 --- a/source/devel-extra/django/is_safe_url_1_5.diff +++ /dev/null @@ -1,122 +0,0 @@ -Description: Blacklist several more URL patterns that can cause Chrome to - access unexpected resources. - -Origin: Original patch from upstream - ---- - django/contrib/auth/tests/views.py | 12 ++++++++---- - django/utils/http.py | 12 ++++++++++++ - tests/regressiontests/utils/http.py | 29 +++++++++++++++++++++++++++++ - 3 files changed, 49 insertions(+), 4 deletions(-) - -Index: b/django/contrib/auth/tests/views.py -=================================================================== ---- a/django/contrib/auth/tests/views.py -+++ b/django/contrib/auth/tests/views.py -@@ -326,8 +326,10 @@ - - # Those URLs should not pass the security check - for bad_url in ('http://example.com', -+ 'http:///example.com', - 'https://example.com', - 'ftp://exampel.com', -+ '///example.com', - '//example.com', - 'javascript:alert("XSS")'): - -@@ -349,8 +351,8 @@ - '/view/?param=https://example.com', - '/view?param=ftp://exampel.com', - 'view/?param=//example.com', -- 'https:///', -- 'HTTPS:///', -+ 'https://testserver/', -+ 'HTTPS://testserver/', - '//testserver/', - '/url%20with%20spaces/'): # see ticket #12534 - safe_url = '%(url)s?%(next)s=%(good_url)s' % { -@@ -522,8 +524,10 @@ - - # Those URLs should not pass the security check - for bad_url in ('http://example.com', -+ 'http:///example.com', - 'https://example.com', - 'ftp://exampel.com', -+ '///example.com', - '//example.com', - 'javascript:alert("XSS")'): - nasty_url = '%(url)s?%(next)s=%(bad_url)s' % { -@@ -543,8 +547,8 @@ - '/view/?param=https://example.com', - '/view?param=ftp://exampel.com', - 'view/?param=//example.com', -- 'https:///', -- 'HTTPS:///', -+ 'https://testserver/', -+ 'HTTPS://testserver/', - '//testserver/', - '/url%20with%20spaces/'): # see ticket #12534 - safe_url = '%(url)s?%(next)s=%(good_url)s' % { -Index: b/django/utils/http.py -=================================================================== ---- a/django/utils/http.py -+++ b/django/utils/http.py -@@ -237,6 +237,18 @@ - """ - if not url: - return False -+ # Chrome treats \ completely as / -+ url = url.replace('\\', '/') -+ # Chrome considers any URL with more than two slashes to be absolute, but -+ # urlaprse is not so flexible. Treat any url with three slashes as unsafe. -+ if url.startswith('///'): -+ return False - url_info = urllib_parse.urlparse(url) -+ # Forbid URLs like http:///example.com - with a scheme, but without a hostname. -+ # In that URL, example.com is not the hostname but, a path component. However, -+ # Chrome will still consider example.com to be the hostname, so we must not -+ # allow this syntax. -+ if not url_info.netloc and url_info.scheme: -+ return False - return (not url_info.netloc or url_info.netloc == host) and \ - (not url_info.scheme or url_info.scheme in ['http', 'https']) -Index: b/tests/regressiontests/utils/http.py -=================================================================== ---- a/tests/regressiontests/utils/http.py -+++ b/tests/regressiontests/utils/http.py -@@ -91,6 +91,35 @@ - self.assertEqual(http.int_to_base36(n), b36) - self.assertEqual(http.base36_to_int(b36), n) - -+ def test_is_safe_url(self): -+ for bad_url in ('http://example.com', -+ 'http:///example.com', -+ 'https://example.com', -+ 'ftp://exampel.com', -+ r'\\example.com', -+ r'\\\example.com', -+ r'/\\/example.com', -+ r'\\\example.com', -+ r'\\example.com', -+ r'\\//example.com', -+ r'/\/example.com', -+ r'\/example.com', -+ r'/\example.com', -+ 'http:///example.com', -+ 'http:/\//example.com', -+ 'http:\/example.com', -+ 'http:/\example.com', -+ 'javascript:alert("XSS")'): -+ self.assertFalse(http.is_safe_url(bad_url, host='testserver'), "%s should be blocked" % bad_url) -+ for good_url in ('/view/?param=http://example.com', -+ '/view/?param=https://example.com', -+ '/view?param=ftp://exampel.com', -+ 'view/?param=//example.com', -+ 'https://testserver/', -+ 'HTTPS://testserver/', -+ '//testserver/', -+ '/url%20with%20spaces/'): -+ self.assertTrue(http.is_safe_url(good_url, host='testserver'), "%s should be allowed" % good_url) - - class ETagProcessingTests(unittest.TestCase): - def testParsing(self):
_______________________________________________ Frugalware-git mailing list [email protected] http://frugalware.org/mailman/listinfo/frugalware-git
