[packages/cacti] - up to 1.2.9; fixes CVE-2020-7106, CVE-2020-7237

[arekm]

commit 7a13808f24fa60940d143ee090ec615e50575b41
Author: Arkadiusz Miśkiewicz <ar...@maven.pl>
Date:   Wed Feb 12 11:22:56 2020 +0100

    - up to 1.2.9; fixes CVE-2020-7106, CVE-2020-7237

 cacti-config.patch | 9 ++++++---
 cacti.spec         | 6 ++++--
 2 files changed, 10 insertions(+), 5 deletions(-)
---
diff --git a/cacti.spec b/cacti.spec
index 6c1ef5c..ea84a15 100644
--- a/cacti.spec
+++ b/cacti.spec
@@ -3,12 +3,12 @@
 Summary:       Cacti is a PHP frontend for rrdtool
 Summary(pl.UTF-8):     Cacti - frontend w PHP do rrdtoola
 Name:          cacti
-Version:       1.2.8
+Version:       1.2.9
 Release:       1
 License:       GPL v2
 Group:         Applications/WWW
 Source0:       http://www.cacti.net/downloads/%{name}-%{version}.tar.gz
-# Source0-md5: 822e317918956246398cfc891dff66bc
+# Source0-md5: 1561dac3fddc4385389fe64b5a7c7067
 Source2:       %{name}.crontab
 Source3:       %{name}-apache.conf
 Source4:       %{name}-lighttpd.conf
@@ -171,6 +171,8 @@ cp -p %{SOURCE5} sql
     /bin.php/!i#!%{_bindir}/php
 }' scripts/*.php  cli/*.php
 
+%{__sed} -i -e 's,#!/usr/bin/env php,#!/usr/bin/php,' 
include/vendor/cldr-to-gettext-plural-rules/bin/export-plural-rules
+
 chmod a+rx scripts/*.php cli/*.php
 
 find '(' -name '*~' -o -name '*.orig' ')' -print0 | xargs -0 -r -l512 rm -f
diff --git a/cacti-config.patch b/cacti-config.patch
index 49feed2..791d897 100644
--- a/cacti-config.patch
+++ b/cacti-config.patch
@@ -1,17 +1,20 @@
 --- cacti-0.8.7b/include/global.php    2008-10-05 04:38:29.740276226 +0300
 +++ cacti-0.8.7g/include/global.php    2010-12-13 12:10:44.312310245 +0200
-@@ -64,10 +64,7 @@ $url_path = '/cacti/';
- /* allow upto 5000 items to be selected */
+@@ -83,13 +83,7 @@ $disable_log_rotation = false;
  ini_set('max_input_vars', '5000');
+ $config = array();
  
 -/* Include configuration, or use the defaults */
 -if (file_exists(dirname(__FILE__) . '/config.php')) {
+-      if (!is_readable(dirname(__FILE__) . '/config.php')) {
+-              die('Configuration file include/config.php is present, but 
unreadable.' . PHP_EOL);
+-      }
 -      include(dirname(__FILE__) . '/config.php');
 -}
 +require '/etc/webapps/cacti/config.php';
  
  if (isset($config['cacti_version'])) {
-       die('Invalid include/config.php file detected.');
+       die('Invalid include/config.php file detected.' . PHP_EOL);
 @@ -139,7 +139,8 @@ if ($config['cacti_server_os'] == 'win32
        $config['library_path'] = preg_replace("/(.*[\/])include/", "\\1lib", 
dirname(__FILE__));
  }
================================================================

---- gitweb:

http://git.pld-linux.org/gitweb.cgi/packages/cacti.git/commitdiff/7a13808f24fa60940d143ee090ec615e50575b41

_______________________________________________
pld-cvs-commit mailing list
pld-cvs-commit@lists.pld-linux.org
http://lists.pld-linux.org/mailman/listinfo/pld-cvs-commit