Security fixes for bug #106149.

Package-Manager: portage-2.0.51.22-r2

diff --git a/www-apps/twiki/ChangeLog b/www-apps/twiki/ChangeLog
index 421441e6daa1571282de1d31cf2186e763d81f0e..520a3aace03764e9cc444e07f2ee730ea8e38be1 100644 (file)
--- a/www-apps/twiki/ChangeLog
+++ b/www-apps/twiki/ChangeLog
@@ -1,6 +1,10 @@
 # ChangeLog for www-apps/twiki
 # Copyright 2000-2005 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/www-apps/twiki/ChangeLog,v 1.15 2005/08/22 22:50:36 rl03 Exp $
+# $Header: /var/cvsroot/gentoo-x86/www-apps/twiki/ChangeLog,v 1.16 2005/09/16 11:38:20 rl03 Exp $
+
+  16 Sep 2005; Renat Lumpau <rl03@gentoo.org> +files/exec_command.patch,
+  files/postinstall-en.txt, twiki-20041030.ebuild:
+  Security fixes for bug #106149.
 
   22 Aug 2005; Renat Lumpau <rl03@gentoo.org> files/postinstall-en.txt,
   files/reconfig, twiki-20041030.ebuild:

diff --git a/www-apps/twiki/Manifest b/www-apps/twiki/Manifest
index 856a7edb19fb0234451ade0b6e42a21cdd24c85d..79d2010d7917656d323625b52b6c0062d102fc24 100644 (file)
--- a/www-apps/twiki/Manifest
+++ b/www-apps/twiki/Manifest
@@ -1,18 +1,19 @@
 -----BEGIN PGP SIGNED MESSAGE-----
 Hash: SHA1
 
-MD5 92872e036efba580668e29a12da1d3dd twiki-20041030.ebuild 1378
-MD5 889ea77fb14101813d892655d77ba9e2 ChangeLog 3374
+MD5 f9c4e052fb172a7f5f942de00c156dca twiki-20041030.ebuild 1562
+MD5 bfe9fdf35b29999b6c383080b9f9ae22 ChangeLog 3533
 MD5 c339473e0ff43da76eb2f2607c441921 metadata.xml 280
+MD5 e2754c98027bd6468cfe636616377892 files/exec_command.patch 2445
 MD5 d6ef3da92ece6d68c83fa4be8f6f97be files/twiki.conf 508
 MD5 fab10473182738fadb4188bf90af8162 files/execwithsearch.patch 653
-MD5 538297b9f7809dff8d3d1ade91b3698c files/postinstall-en.txt 722
-MD5 67624b3735f6d1c92bce9dacf2cb36b8 files/digest-twiki-20041030 67
+MD5 81a10e4ed2ea4d51fd1001d051951a61 files/postinstall-en.txt 795
+MD5 4369d80c9ef3589ccebce4a23095082b files/digest-twiki-20041030 138
 MD5 f4898afe44208d27fee4ab3910b8cc88 files/reconfig 588
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.1 (GNU/Linux)
 
-iD8DBQFDClbIEzitwsaoONoRAjnAAKC5wqwhyUOJiEImXCZkxl4lyYJAyACeOM6v
-z5/8GYiXHef56Zz3+R4hDy4=
-=lBC2
+iD8DBQFDKq7CEzitwsaoONoRAtPeAJ4nDgJPgjbNX6XHPkIdrZKWpeOhagCfVsfB
+F37DCLiHIhiKcH+wSg7Mjkg=
+=bEck
 -----END PGP SIGNATURE-----

diff --git a/www-apps/twiki/files/digest-twiki-20041030 b/www-apps/twiki/files/digest-twiki-20041030
index 2c2dfac017e453bc1240fcc4841d89bdc1045d06..215f002bbb13fc615da45bdb7bf6a3d33b374f6e 100644 (file)
--- a/www-apps/twiki/files/digest-twiki-20041030
+++ b/www-apps/twiki/files/digest-twiki-20041030
@@ -1 +1,2 @@
 MD5 b4acc3ba9e09524d344db4bc76d2faaa TWiki20041030beta.zip 2606614
+MD5 c8e3010b59013dbb7814b26cc609825e twiki-robustness-r3342.diff 36473

diff --git a/www-apps/twiki/files/exec_command.patch b/www-apps/twiki/files/exec_command.patch
new file mode 100644 (file)
index 0000000..0425bd5
--- /dev/null
+++ b/www-apps/twiki/files/exec_command.patch
@@ -0,0 +1,52 @@
+diff -ur work/lib/TWiki/Store.pm work-patched/lib/TWiki/Store.pm
+--- work/lib/TWiki/Store.pm    2004-10-19 14:48:40.000000000 -0400
++++ work-patched/lib/TWiki/Store.pm    2005-09-16 07:19:40.000000000 -0400
+@@ -572,7 +572,9 @@
+     }
+ 
+     $theRev = "" unless( $theRev );
+-    $theRev =~ s/^1\.//o;
++    $theRev =~ s/r?1\.//o;  # cut 'r' and major
++    # Fix for Codev.SecurityAlertExecuteCommandsWithRev
++    $theRev = "" unless( $theRev =~ s/.*?([0-9]+).*/$1/o );
+ 
+     $topicHandler = _getTopicHandler( $theWebName, $theTopic, $attachment ) if( ! $topicHandler );
+     my( $rcsOut, $rev, $date, $user, $comment ) = $topicHandler->getRevisionInfo( $theRev );
+diff -ur work/lib/TWiki/UI/RDiff.pm work-patched/lib/TWiki/UI/RDiff.pm
+--- work/lib/TWiki/UI/RDiff.pm 2004-08-08 04:28:45.000000000 -0400
++++ work-patched/lib/TWiki/UI/RDiff.pm 2005-09-16 07:19:40.000000000 -0400
+@@ -409,6 +409,9 @@
+     if( ! $rev2 ) { $rev2 = 0; }
+     $rev1 =~ s/r?1\.//go;  # cut 'r' and major
+     $rev2 =~ s/r?1\.//go;  # cut 'r' and major
++    # Fix for Codev.SecurityAlertExecuteCommandsWithRev
++    $rev1 = $maxrev unless( $rev1 =~ s/.*?([0-9]+).*/$1/o );
++    $rev2 = $maxrev unless( $rev2 =~ s/.*?([0-9]+).*/$1/o );
+     if( $rev1 < 1 )       { $rev1 = $maxrev; }
+     if( $rev1 > $maxrev ) { $rev1 = $maxrev; }
+     if( $rev2 < 1 )       { $rev2 = 1; }
+diff -ur work/lib/TWiki/UI/View.pm work-patched/lib/TWiki/UI/View.pm
+--- work/lib/TWiki/UI/View.pm  2004-08-25 02:36:15.000000000 -0400
++++ work-patched/lib/TWiki/UI/View.pm  2005-09-16 07:19:40.000000000 -0400
+@@ -106,6 +106,8 @@
+     $revdate = TWiki::formatTime( $revdate );
+ 
+     if( $rev ) {
++      # Fix for Codev.SecurityAlertExecuteCommandsWithRev
++      $rev = $maxrev unless( $rev =~ s/.*?([0-9]+).*/$1/o );
+       $rev =~ s/r?1\.//go;  # cut 'r' and major
+       if( $rev < 1 )       { $rev = 1; }
+       if( $rev > $maxrev ) { $rev = $maxrev; }
+diff -ur work/lib/TWiki/UI/Viewfile.pm work-patched/lib/TWiki/UI/Viewfile.pm
+--- work/lib/TWiki/UI/Viewfile.pm      2004-05-29 02:51:35.000000000 -0400
++++ work-patched/lib/TWiki/UI/Viewfile.pm      2005-09-16 07:19:40.000000000 -0400
+@@ -43,6 +43,9 @@
+ 
+   my $fileName = $query->param( 'filename' );
+   my $rev = $query->param( 'rev' ) || "";
++  $rev =~ s/r?1\.//o;  # cut 'r' and major
++  # Fix for Codev.SecurityAlertExecuteCommandsWithRev
++  $rev = "" unless( $rev =~ s/.*?([0-9]+).*/$1/o );
+ 
+   return unless TWiki::UI::webExists( $webName, $topic );
+ 

diff --git a/www-apps/twiki/files/postinstall-en.txt b/www-apps/twiki/files/postinstall-en.txt
index f0187ae2a51102b18305db6e67e38002f43e4912..c70a30ed65d355ddcefd841cea1a2cdd5d6a8e18 100644 (file)
--- a/www-apps/twiki/files/postinstall-en.txt
+++ b/www-apps/twiki/files/postinstall-en.txt
@@ -16,5 +16,7 @@ You are almost done!
    http://twiki.org/cgi-bin/view/TWiki/TWikiInstallationGuide
    particularly if you wish to set up email preferences or I18N.
 
-5. Visit http://${VHOST_HOSTNAME}/twiki, or
+5. Read ${MY_INSTALLDIR}/README.robustness for important security info.
+
+6. Visit http://${VHOST_HOSTNAME}/twiki, or
    http://${VHOST_HOSTNAME}/${VHOST_APPDIR}/bin/view

diff --git a/www-apps/twiki/twiki-20041030.ebuild b/www-apps/twiki/twiki-20041030.ebuild
index bb0162775bd544efc49b669574a54f2695ace184..5700dfa21f73fc19edf2752fa565336a2805025c 100644 (file)
--- a/www-apps/twiki/twiki-20041030.ebuild
+++ b/www-apps/twiki/twiki-20041030.ebuild
@@ -1,12 +1,13 @@
 # Copyright 1999-2005 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/www-apps/twiki/twiki-20041030.ebuild,v 1.3 2005/08/22 22:50:36 rl03 Exp $
+# $Header: /var/cvsroot/gentoo-x86/www-apps/twiki/twiki-20041030.ebuild,v 1.4 2005/09/16 11:38:20 rl03 Exp $
 
 inherit webapp eutils depend.apache
 
 DESCRIPTION="A Web Based Collaboration Platform"
 HOMEPAGE="http://twiki.org/"
-SRC_URI="http://ftp.ale.org/pub/mirrors/openpkg/sources/DST/${PN}//TWiki${PV}beta.zip"
+SRC_URI="http://ftp.ale.org/pub/mirrors/openpkg/sources/DST/${PN}//TWiki${PV}beta.zip
+       http://static.enyo.de/fw/patches/twiki/twiki-robustness-r3342.diff"
 
 LICENSE="GPL-2"
 KEYWORDS="~amd64 ~ppc ~sparc ~x86"
@@ -14,7 +15,7 @@ IUSE=""
 
 S=${WORKDIR}
 
-RDEPEND=">=dev-lang/perl-5.6.2
+RDEPEND=">=dev-lang/perl-5.8
                perl-core/CGI
                dev-perl/libnet
                >=app-text/rcs-5.7
@@ -27,6 +28,12 @@ src_unpack() {
        unpack ${A}
        cd ${S}/lib/TWiki
        epatch ${FILESDIR}/execwithsearch.patch
+
+       # bug #106149
+       cd ${S}
+       epatch ${FILESDIR}/exec_command.patch
+       epatch ${DISTDIR}/twiki-robustness-r3342.diff
+
        # change web user to apache
        find . -name '*,v' -exec sed -i 's|nobody:|apache:|g' '{}' ';'
 }
@@ -36,7 +43,7 @@ src_install() {
 
        cp -r . ${D}/${MY_HTDOCSDIR}
 
-       dodoc readme.txt license.txt
+       dodoc readme.txt README.robustness
 
        insinto ${APACHE1_VHOSTDIR}
        doins ${FILESDIR}/twiki.conf