From owner-freebsd-ports-bugs@FreeBSD.ORG Thu Sep 10 03:50:02 2009 Return-Path: Delivered-To: freebsd-ports-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 252091065672 for ; Thu, 10 Sep 2009 03:50:02 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id 019568FC13 for ; Thu, 10 Sep 2009 03:50:02 +0000 (UTC) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.14.3/8.14.3) with ESMTP id n8A3o1c0022125 for ; Thu, 10 Sep 2009 03:50:01 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.3/8.14.3/Submit) id n8A3o1fK022124; Thu, 10 Sep 2009 03:50:01 GMT (envelope-from gnats) Resent-Date: Thu, 10 Sep 2009 03:50:01 GMT Resent-Message-Id: <200909100350.n8A3o1fK022124@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-ports-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Sahil Tandon Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 27E361065693 for ; Thu, 10 Sep 2009 03:42:52 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21]) by mx1.freebsd.org (Postfix) with ESMTP id 1647F8FC15 for ; Thu, 10 Sep 2009 03:42:52 +0000 (UTC) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.14.3/8.14.3) with ESMTP id n8A3gp4t067281 for ; Thu, 10 Sep 2009 03:42:51 GMT (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.14.3/8.14.3/Submit) id n8A3gpOC067280; Thu, 10 Sep 2009 03:42:51 GMT (envelope-from nobody) Message-Id: <200909100342.n8A3gpOC067280@www.freebsd.org> Date: Thu, 10 Sep 2009 03:42:51 GMT From: Sahil Tandon To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-3.1 Cc: Subject: ports/138687: [PATCH] mail/roundcube: fix broken password plugin's parsing of email usernames X-BeenThere: freebsd-ports-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Ports bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Sep 2009 03:50:02 -0000 >Number: 138687 >Category: ports >Synopsis: [PATCH] mail/roundcube: fix broken password plugin's parsing of email usernames >Confidential: no >Severity: serious >Priority: low >Responsible: freebsd-ports-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Thu Sep 10 03:50:01 UTC 2009 >Closed-Date: >Last-Modified: >Originator: Sahil Tandon >Release: 7.1-RELEASE >Organization: >Environment: 7.1-RELEASE >Description: The recent update to 0.3 introduced a plugins/ directory that is now distributed with the software. Unfortunately, the password plugin has a broken SQL driver. According to the documentation, '%d' is supposed to be replaced with the domain part of a username in case the IMAP username is an email address. However, the PHP code just passes the local-part of the username instead. The fix is trivial and should obviously be adopted upstream. Until this is done (I have tried to contact the author), this patch fixes the problem. CVS diff attached. >How-To-Repeat: Use an SQL password_query that employs the '%d' expansion. Notice that the local-part (instead of the domain name) is passed to SQL. >Fix: Apply patch. Patch attached with submission follows: Index: files/patch-plugins_password_drivers_sql.php =================================================================== RCS file: files/patch-plugins_password_drivers_sql.php diff -N files/patch-plugins_password_drivers_sql.php --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ files/patch-plugins_password_drivers_sql.php 10 Sep 2009 03:30:02 -0000 @@ -0,0 +1,11 @@ +--- plugins/password/drivers/sql.php.orig 2009-09-09 23:22:07.000000000 -0400 ++++ plugins/password/drivers/sql.php 2009-09-09 23:21:30.733707000 -0400 +@@ -81,7 +81,7 @@ + $user_info = explode('@', $_SESSION['username']); + if (count($user_info) >= 2) { + $sql = str_replace('%l', $db->quote($user_info[0], 'text'), $sql); +- $sql = str_replace('%d', $db->quote($user_info[0], 'text'), $sql); ++ $sql = str_replace('%d', $db->quote($user_info[1], 'text'), $sql); + } + + $sql = str_replace('%u', $db->quote($_SESSION['username'],'text'), $sql); >Release-Note: >Audit-Trail: >Unformatted: