Date: Fri, 9 Aug 2002 01:30:01 -0600 (MDT) From: Jamie Hermans <jamie@hermans.ca> To: FreeBSD-gnats-submit@FreeBSD.org Subject: ports/41465: Update: www/gallery - security fixes Message-ID: <20020809073001.A2ED5391@zinebar.hermans.ca>
next in thread | raw e-mail | index | archive | help
>Number: 41465
>Category: ports
>Synopsis: Update: www/gallery - security fixes
>Confidential: no
>Severity: critical
>Priority: medium
>Responsible: freebsd-ports
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: maintainer-update
>Submitter-Id: current-users
>Arrival-Date: Fri Aug 09 00:40:01 PDT 2002
>Closed-Date:
>Last-Modified:
>Originator: Jamie Hermans
>Release: FreeBSD 4.6-STABLE i386
>Organization:
hermans.ca
>Environment:
System: FreeBSD zinebar.hermans.ca 4.6-STABLE FreeBSD 4.6-STABLE #1: Tue Jul 23 09:09:16 MDT 2002 root@zinebar.hermans.ca:/usr/obj/usr/src/sys/ZINEBAR i386
>Description:
This release includes several SECURITY FIXES that address weaknesses in the Gallery code that can lead to a REMOTE EXPLOIT.
Cleaned up a minor pkg-plist error as well.
>How-To-Repeat:
>Fix:
diff -ruN gallery-old/Makefile gallery/Makefile
--- gallery-old/Makefile Thu Jun 13 22:38:30 2002
+++ gallery/Makefile Fri Aug 9 01:06:58 2002
@@ -6,7 +6,7 @@
#
PORTNAME= gallery
-PORTVERSION= 1.3
+PORTVERSION= 1.3.1
CATEGORIES= www
MASTER_SITES= ${MASTER_SITE_SOURCEFORGE}
MASTER_SITE_SUBDIR= ${PORTNAME}
diff -ruN gallery-old/distinfo gallery/distinfo
--- gallery-old/distinfo Thu Jun 13 22:38:30 2002
+++ gallery/distinfo Fri Aug 9 01:23:22 2002
@@ -1 +1 @@
-MD5 (gallery-1.3.tar.gz) = 9922b47cf734cb55065a502a2c1324f9
+MD5 (gallery-1.3.1.tar.gz) = 0c0ef90962414cac95f28a881c80117d
diff -ruN gallery-old/pkg-plist gallery/pkg-plist
--- gallery-old/pkg-plist Thu Jun 13 22:38:30 2002
+++ gallery/pkg-plist Fri Aug 9 01:24:47 2002
@@ -8,17 +8,6 @@
%%GALLERYDIR%%/album_permissions.php
%%GALLERYDIR%%/albums.php
%%GALLERYDIR%%/captionator.php
-%%GALLERYDIR%%/classes/Album.php
-%%GALLERYDIR%%/classes/AlbumDB.php
-%%GALLERYDIR%%/classes/AlbumItem.php
-%%GALLERYDIR%%/classes/Comment.php
-%%GALLERYDIR%%/classes/Database.php
-%%GALLERYDIR%%/classes/EverybodyUser.php
-%%GALLERYDIR%%/classes/Image.php
-%%GALLERYDIR%%/classes/LoggedInUser.php
-%%GALLERYDIR%%/classes/NobodyUser.php
-%%GALLERYDIR%%/classes/User.php
-%%GALLERYDIR%%/classes/UserDB.php
%%GALLERYDIR%%/classes/database/mysql/Database.php
%%GALLERYDIR%%/classes/gallery/User.php
%%GALLERYDIR%%/classes/gallery/UserDB.php
@@ -29,10 +18,21 @@
%%GALLERYDIR%%/classes/postnuke/UserDB.php
%%GALLERYDIR%%/classes/postnuke0.7.1/User.php
%%GALLERYDIR%%/classes/postnuke0.7.1/UserDB.php
+%%GALLERYDIR%%/classes/Album.php
+%%GALLERYDIR%%/classes/AlbumItem.php
+%%GALLERYDIR%%/classes/AlbumDB.php
+%%GALLERYDIR%%/classes/Database.php
+%%GALLERYDIR%%/classes/Comment.php
+%%GALLERYDIR%%/classes/EverybodyUser.php
+%%GALLERYDIR%%/classes/Image.php
+%%GALLERYDIR%%/classes/LoggedInUser.php
+%%GALLERYDIR%%/classes/NobodyUser.php
+%%GALLERYDIR%%/classes/User.php
+%%GALLERYDIR%%/classes/UserDB.php
%%GALLERYDIR%%/configure.sh
%%GALLERYDIR%%/create_user.php
-%%GALLERYDIR%%/css/embedded_style.css.default
%%GALLERYDIR%%/css/standalone_style.css.default
+%%GALLERYDIR%%/css/embedded_style.css.default
%%GALLERYDIR%%/delete_album.php
%%GALLERYDIR%%/delete_photo.php
%%GALLERYDIR%%/delete_user.php
@@ -41,22 +41,22 @@
%%GALLERYDIR%%/edit_caption.php
%%GALLERYDIR%%/edit_field.php
%%GALLERYDIR%%/edit_thumb.php
-%%GALLERYDIR%%/errors/configmode.php
%%GALLERYDIR%%/errors/configure_help.php
+%%GALLERYDIR%%/errors/configmode.php
%%GALLERYDIR%%/errors/configure_instructions.php
%%GALLERYDIR%%/errors/needinit.php
%%GALLERYDIR%%/errors/reconfigure.php
%%GALLERYDIR%%/errors/unconfigured.php
%%GALLERYDIR%%/gallery_remote.php
-%%GALLERYDIR%%/highlight_photo.php
%%GALLERYDIR%%/html/errorRow.inc
%%GALLERYDIR%%/html/userData.inc
+%%GALLERYDIR%%/highlight_photo.php
+%%GALLERYDIR%%/html_wrap/inline_albumthumb.frame.default
%%GALLERYDIR%%/html_wrap/album.footer.default
%%GALLERYDIR%%/html_wrap/album.header.default
%%GALLERYDIR%%/html_wrap/gallery.footer.default
%%GALLERYDIR%%/html_wrap/gallery.header.default
%%GALLERYDIR%%/html_wrap/inline_albumthumb.footer.default
-%%GALLERYDIR%%/html_wrap/inline_albumthumb.frame.default
%%GALLERYDIR%%/html_wrap/inline_albumthumb.header.default
%%GALLERYDIR%%/html_wrap/inline_gallerythumb.frame.default
%%GALLERYDIR%%/html_wrap/inline_moviethumb.frame.default
@@ -101,10 +101,10 @@
%%GALLERYDIR%%/init.php
%%GALLERYDIR%%/java/ImageTools.jar
%%GALLERYDIR%%/js/client_sniff.js
+%%GALLERYDIR%%/layout/commentboxbottom.inc
%%GALLERYDIR%%/layout/adminbox.inc
%%GALLERYDIR%%/layout/breadcrumb.inc
%%GALLERYDIR%%/layout/commentbox.inc
-%%GALLERYDIR%%/layout/commentboxbottom.inc
%%GALLERYDIR%%/layout/commentboxtop.inc
%%GALLERYDIR%%/layout/commentdraw.inc
%%GALLERYDIR%%/layout/navigator.inc
@@ -115,8 +115,8 @@
%%GALLERYDIR%%/modify_user.php
%%GALLERYDIR%%/move_album.php
%%GALLERYDIR%%/move_photo.php
-%%GALLERYDIR%%/platform/fs_unix.php
%%GALLERYDIR%%/platform/fs_win32.php
+%%GALLERYDIR%%/platform/fs_unix.php
%%GALLERYDIR%%/progress_uploading.php
%%GALLERYDIR%%/rename_album.php
%%GALLERYDIR%%/resize_photo.php
@@ -125,9 +125,10 @@
%%GALLERYDIR%%/search.php
%%GALLERYDIR%%/secure.sh
%%GALLERYDIR%%/session.php
+%%GALLERYDIR%%/setup/check_netpbm.php
%%GALLERYDIR%%/setup/.htaccess
%%GALLERYDIR%%/setup/check.inc
-%%GALLERYDIR%%/setup/check_netpbm.php
+%%GALLERYDIR%%/setup/mod_rewrite.template
%%GALLERYDIR%%/setup/config_data.inc
%%GALLERYDIR%%/setup/confirm.inc
%%GALLERYDIR%%/setup/constants.inc
@@ -136,12 +137,12 @@
%%GALLERYDIR%%/setup/gpl.txt
%%GALLERYDIR%%/setup/index.php
%%GALLERYDIR%%/setup/init.php
-%%GALLERYDIR%%/setup/mod_rewrite.template
%%GALLERYDIR%%/setup/php_value.template
%%GALLERYDIR%%/setup/php_value_ok.php
%%GALLERYDIR%%/setup/phpinfo.php
%%GALLERYDIR%%/setup/session_test.php
%%GALLERYDIR%%/setup/write.inc
+%%GALLERYDIR%%/setup/diagnostics.php
%%GALLERYDIR%%/slideshow.php
%%GALLERYDIR%%/slideshow_low.php
%%GALLERYDIR%%/sort_album.php
@@ -153,22 +154,22 @@
%%GALLERYDIR%%/view_comments.php
%%GALLERYDIR%%/view_photo.php
%%GALLERYDIR%%/view_photo_properties.php
-@dirrm %%GALLERYDIR%%/setup
-@dirrm %%GALLERYDIR%%/platform
-@dirrm %%GALLERYDIR%%/layout
-@dirrm %%GALLERYDIR%%/js
-@dirrm %%GALLERYDIR%%/java
-@dirrm %%GALLERYDIR%%/images
-@dirrm %%GALLERYDIR%%/html
-@dirrm %%GALLERYDIR%%/errors
-@dirrm %%GALLERYDIR%%/classes/postnuke0.7.1
-@dirrm %%GALLERYDIR%%/classes/postnuke
-@dirrm %%GALLERYDIR%%/classes/nuke5
-@dirrm %%GALLERYDIR%%/classes/gallery
@dirrm %%GALLERYDIR%%/classes/database/mysql
@dirrm %%GALLERYDIR%%/classes/database
+@dirrm %%GALLERYDIR%%/classes/gallery
+@dirrm %%GALLERYDIR%%/classes/nuke5
+@dirrm %%GALLERYDIR%%/classes/postnuke
+@dirrm %%GALLERYDIR%%/classes/postnuke0.7.1
@dirrm %%GALLERYDIR%%/classes
-%%PORTDOCS%%@dirrm share/doc/gallery
+@dirrm %%GALLERYDIR%%/errors
+@dirrm %%GALLERYDIR%%/html
+@dirrm %%GALLERYDIR%%/images
+@dirrm %%GALLERYDIR%%/java
+@dirrm %%GALLERYDIR%%/js
+@dirrm %%GALLERYDIR%%/layout
+@dirrm %%GALLERYDIR%%/platform
+@dirrm %%GALLERYDIR%%/setup
+@dirrm %%PORTDOCS%%share/doc/gallery
@unexec rmdir %D/%%GALLERYDIR%%/html_wrap 2>/dev/null || true
@unexec rmdir %D/%%GALLERYDIR%%/css 2>/dev/null || true
@unexec rmdir %D/%%GALLERYDIR%% 2>/dev/null || true
>Release-Note:
>Audit-Trail:
>Unformatted:
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-ports" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020809073001.A2ED5391>