Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=frugalware-current.git;a=commitdiff;h=ad53ff7be905390ef9018fb10fe1dd6f980d1707
commit ad53ff7be905390ef9018fb10fe1dd6f980d1707 Author: kikadf <[email protected]> Date: Tue Oct 7 16:29:04 2014 +0200 mantis-1.2.17-2-x86_64 * Fix CVE-2014-6387 diff --git a/source/network-extra/mantis/CVE-2014-6387.patch b/source/network-extra/mantis/CVE-2014-6387.patch new file mode 100644 index 0000000..d67c100 --- /dev/null +++ b/source/network-extra/mantis/CVE-2014-6387.patch @@ -0,0 +1,37 @@ +commit 215968fa8ff33e327f0600765a5caa24de392cbc +Author: Paul Richards <[email protected]> +Date: Sat Oct 12 22:58:43 2013 +0100 + + Strip null bytes out of GPC input strings + + Backporting commit fc02c46eea9d9e7cc472a7fc1801ea65d467db76 from master + branch to fix issue #17640 + + Signed-off-by: Damien Regad <[email protected]> + +diff --git a/core/gpc_api.php b/core/gpc_api.php +index 2daad98..58e0827 100644 +--- a/core/gpc_api.php ++++ b/core/gpc_api.php +@@ -110,7 +110,7 @@ function gpc_get_string( $p_var_name, $p_default = null ) { + trigger_error( ERROR_GPC_ARRAY_UNEXPECTED, ERROR ); + } + +- return $t_result; ++ return str_replace( "\0","",$t_result ); + } + + /** +@@ -255,7 +255,11 @@ function gpc_get_string_array( $p_var_name, $p_default = null ) { + trigger_error( ERROR_GPC_ARRAY_EXPECTED, ERROR ); + } + +- return $t_result; ++ $t_array = array(); ++ foreach( $t_result as $key => $val ) { ++ $t_array[$key] = str_replace( "\0", "", $val ); ++ } ++ return $t_array; + } + + /** diff --git a/source/network-extra/mantis/FrugalBuild b/source/network-extra/mantis/FrugalBuild index 8de0b27..8498bd0 100644 --- a/source/network-extra/mantis/FrugalBuild +++ b/source/network-extra/mantis/FrugalBuild @@ -3,7 +3,7 @@ pkgname=mantis pkgver=1.2.17 -pkgrel=1 +pkgrel=2 pkgdesc="a free popular web-based bugtracking system" rodepends=('php>=4.0.6' 'mysql>=3.23.2') groups=('network-extra') @@ -16,6 +16,16 @@ url="http://www.mantisbt.org/"; source=($source strings_hungarian.txt email_padding.patch README.Frugalware) options=('stick') backup=('var/www/mantis/config_inc.php') +sha1sums=('7cfa03ca674eb6727ed6d9c3f79266a12c0a669c' \ + 'e316589c6f369eeeb8a937f4b849aed3c9c73fee' \ + 'c8a65e327a828a702623ea917277ef55c92cdaa8' \ + 'd62d9493d254e33f8ec793a50ed3d3742e7b8110') + + +# FSA fix *** +source=(${source[@]} CVE-2014-6387.patch) +sha1sums=(${sha1sums[@]} 'd4e3bd72f44794ecf34e59267cbd9394698c60ed') +# *********** build() { @@ -35,7 +45,4 @@ build() chown nobody:nobody $Fdestdir/var/www/$pkgname -R } -sha1sums=('7cfa03ca674eb6727ed6d9c3f79266a12c0a669c' \ - 'e316589c6f369eeeb8a937f4b849aed3c9c73fee' \ - 'c8a65e327a828a702623ea917277ef55c92cdaa8' \ - 'd62d9493d254e33f8ec793a50ed3d3742e7b8110') + _______________________________________________ Frugalware-git mailing list [email protected] http://frugalware.org/mailman/listinfo/frugalware-git
