Date: Tue, 06 Jun 2006 10:22:14 +0100 From: Simon Dick <simond@irrelevant.org> To: FreeBSD-gnats-submit@FreeBSD.org Subject: ports/98588: Maintainer port update: mail/squirrelmail Message-ID: <E1FnXlO-000CON-Ex@home.irrelevant.org> Resent-Message-ID: <200606060930.k569UMNg007791@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 98588
>Category: ports
>Synopsis: Maintainer port update: mail/squirrelmail
>Confidential: no
>Severity: serious
>Priority: high
>Responsible: freebsd-ports-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: maintainer-update
>Submitter-Id: current-users
>Arrival-Date: Tue Jun 06 09:30:22 GMT 2006
>Closed-Date:
>Last-Modified:
>Originator: Simon Dick
>Release: FreeBSD 6.1-RELEASE amd64
>Organization:
>Environment:
System: FreeBSD amd64.irrelevant.org 6.1-RELEASE FreeBSD 6.1-RELEASE #3: Tue May 9 10:53:21 BST 2006 root@amd64.irrelevant.org:/usr/obj/usr/src/sys/HOME amd64
>Description:
Apply a security fix to mail/squirrelmail
>How-To-Repeat:
>Fix:
diff -ruN /usr/ports/mail/squirrelmail/Makefile squirrelmail/Makefile
--- /usr/ports/mail/squirrelmail/Makefile Mon Mar 20 16:24:33 2006
+++ squirrelmail/Makefile Tue Jun 6 10:19:01 2006
@@ -7,6 +7,7 @@
PORTNAME= squirrelmail
PORTVERSION= 1.4.6
+PORTREVISION= 1
CATEGORIES= mail www
MASTER_SITES= ${MASTER_SITE_SOURCEFORGE}
MASTER_SITE_SUBDIR= ${PORTNAME}
@@ -57,7 +58,7 @@
post-patch:
.ifndef PATCH_DEBUG
- @${RM} -f ${WRKSRC}/config/config_default.php.orig
+ @${RM} -f ${WRKSRC}/config/config_default.php.orig ${WRKSRC}/functions/global.php.orig
.endif
@${REINPLACE_CMD} -e 's|ispell|${LOCALBASE}/bin/ispell|g' \
${WRKSRC}/plugins/squirrelspell/sqspell_config.php
diff -ruN /usr/ports/mail/squirrelmail/files/patch-functions-global.php squirrelmail/files/patch-functions-global.php
--- /usr/ports/mail/squirrelmail/files/patch-functions-global.php Thu Jan 1 01:00:00 1970
+++ squirrelmail/files/patch-functions-global.php Tue Jun 6 10:13:04 2006
@@ -0,0 +1,50 @@
+--- functions/global.php.orig Fri Feb 3 22:27:47 2006
++++ functions/global.php Tue Jun 6 10:12:22 2006
+@@ -62,6 +62,47 @@
+ sqstripslashes($_POST);
+ }
+
++/**
++ * If register_globals are on, unregister globals.
++ * Code requires PHP 4.1.0 or newer.
++ * Second test covers boolean set as string (php_value register_globals off).
++ */
++if ((bool) @ini_get('register_globals') &&
++ strtolower(ini_get('register_globals'))!='off') {
++ /**
++ * Remove all globals from $_GET, $_POST, and $_COOKIE.
++ */
++ foreach ($_REQUEST as $key => $value) {
++ unset($GLOBALS[$key]);
++ }
++ /**
++ * Remove globalized $_FILES variables
++ * Before 4.3.0 $_FILES are included in $_REQUEST.
++ * Unglobalize them in separate call in order to remove dependency
++ * on PHP version.
++ */
++ foreach ($_FILES as $key => $value) {
++ unset($GLOBALS[$key]);
++ // there are three undocumented $_FILES globals.
++ unset($GLOBALS[$key.'_type']);
++ unset($GLOBALS[$key.'_name']);
++ unset($GLOBALS[$key.'_size']);
++ }
++ /**
++ * Remove globalized environment variables.
++ */
++ foreach ($_ENV as $key => $value) {
++ unset($GLOBALS[$key]);
++ }
++ /**
++ * Remove globalized server variables.
++ */
++ foreach ($_SERVER as $key => $value) {
++ unset($GLOBALS[$key]);
++ }
++}
++
++
+ /* strip any tags added to the url from PHP_SELF.
+ This fixes hand crafted url XXS expoits for any
+ page that uses PHP_SELF as the FORM action */
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?E1FnXlO-000CON-Ex>