From owner-svn-ports-all@FreeBSD.ORG  Wed Mar 12 02:04:04 2014
Return-Path: <owner-svn-ports-all@FreeBSD.ORG>
Delivered-To: svn-ports-all@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
 (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTPS id C24BABD6;
 Wed, 12 Mar 2014 02:04:04 +0000 (UTC)
Received: from svn.freebsd.org (svn.freebsd.org
 [IPv6:2001:1900:2254:2068::e6a:0])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (No client certificate requested)
 by mx1.freebsd.org (Postfix) with ESMTPS id AF2C517D;
 Wed, 12 Mar 2014 02:04:04 +0000 (UTC)
Received: from svn.freebsd.org ([127.0.1.70])
 by svn.freebsd.org (8.14.8/8.14.8) with ESMTP id s2C244qc012795;
 Wed, 12 Mar 2014 02:04:04 GMT (envelope-from kevlo@svn.freebsd.org)
Received: (from kevlo@localhost)
 by svn.freebsd.org (8.14.8/8.14.8/Submit) id s2C2441F012793;
 Wed, 12 Mar 2014 02:04:04 GMT (envelope-from kevlo@svn.freebsd.org)
Message-Id: <201403120204.s2C2441F012793@svn.freebsd.org>
From: Kevin Lo <kevlo@FreeBSD.org>
Date: Wed, 12 Mar 2014 02:04:04 +0000 (UTC)
To: ports-committers@freebsd.org, svn-ports-all@freebsd.org,
 svn-ports-head@freebsd.org
Subject: svn commit: r347952 - head/www/owncloud
X-SVN-Group: ports-head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-ports-all@freebsd.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: SVN commit messages for the ports tree <svn-ports-all.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/svn-ports-all>,
 <mailto:svn-ports-all-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-ports-all/>
List-Post: <mailto:svn-ports-all@freebsd.org>
List-Help: <mailto:svn-ports-all-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/svn-ports-all>,
 <mailto:svn-ports-all-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 12 Mar 2014 02:04:04 -0000

Author: kevlo
Date: Wed Mar 12 02:04:03 2014
New Revision: 347952
URL: http://svnweb.freebsd.org/changeset/ports/347952
QAT: https://qat.redports.org/buildarchive/r347952/

Log:
  Work around a very obscure but potentially severe security problem.
  The user can have the variables OWNCLOUD_USERNAME and OWNCLOUD_GROUPNAME
  defined in his environment to point to his own username and groupname.
  
  Suggested by:	Adam McDougall

Modified:
  head/www/owncloud/Makefile
  head/www/owncloud/pkg-plist

Modified: head/www/owncloud/Makefile
==============================================================================
--- head/www/owncloud/Makefile	Wed Mar 12 01:42:52 2014	(r347951)
+++ head/www/owncloud/Makefile	Wed Mar 12 02:04:03 2014	(r347952)
@@ -2,6 +2,7 @@
 
 PORTNAME=	owncloud
 PORTVERSION=	6.0.2
+PORTREVISION=	1
 CATEGORIES=	www
 MASTER_SITES=	http://download.owncloud.org/community/
 
@@ -19,9 +20,14 @@ USE_PHP=	bz2 ctype curl dom exif fileinf
 		xsl wddx zip zlib
 WANT_PHP_WEB=	yes
 
+OWNCLOUD_USERNAME?=	www
+OWNCLOUD_GROUPNAME?=	${OWNCLOUD_USERNAME}
+
 WRKSRC=		${WRKDIR}/${PORTNAME}
 NO_BUILD=	yes
 SUB_FILES=	pkg-message
+PLIST_SUB=	OWNCLOUD_USERNAME=${OWNCLOUD_USERNAME} \
+		OWNCLOUD_GROUPNAME=${OWNCLOUD_GROUPNAME}
 
 OPTIONS_MULTI=	DB
 OPTIONS_MULTI_DB=	MYSQL PGSQL SQLITE

Modified: head/www/owncloud/pkg-plist
==============================================================================
--- head/www/owncloud/pkg-plist	Wed Mar 12 01:42:52 2014	(r347951)
+++ head/www/owncloud/pkg-plist	Wed Mar 12 02:04:03 2014	(r347952)
@@ -1,5 +1,5 @@
-@owner www
-@group www
+@owner %%OWNCLOUD_USERNAME%%
+@group %%OWNCLOUD_GROUPNAME%%
 %%WWWDIR%%/.htaccess
 %%WWWDIR%%/3rdparty/Archive/Tar.php
 %%WWWDIR%%/3rdparty/Console/Getopt.php