Date: Fri, 28 Oct 2022 17:12:30 GMT From: Thierry Thomas <thierry@FreeBSD.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org Subject: git: dfa4c773430c - main - mail/horde-imp: address ZDI-20-1051 / ZDI-CAN-10436 Message-ID: <202210281712.29SHCUL9096480@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch main has been updated by thierry: URL: https://cgit.FreeBSD.org/ports/commit/?id=dfa4c773430c9297b3f54d3b1a1202e18e7f120d commit dfa4c773430c9297b3f54d3b1a1202e18e7f120d Author: Thierry Thomas <thierry@FreeBSD.org> AuthorDate: 2022-10-14 08:35:37 +0000 Commit: Thierry Thomas <thierry@FreeBSD.org> CommitDate: 2022-10-28 17:12:27 +0000 mail/horde-imp: address ZDI-20-1051 / ZDI-CAN-10436 PR: 267049 Approved by: maintainer’s time-out Obtained from: https://github.com/horde/imp/pull/10/files Fixes: Address ZDI-20-1051 / ZDI-CAN-10436 MFH: 2022Q4 Security: https://www.zerodayinitiative.com/advisories/ZDI-20-1051/ --- mail/horde-imp/Makefile | 1 + mail/horde-imp/files/patch-config_prefs.php | 6 +++--- mail/horde-imp/files/patch-lib_Prefs_Sort.php | 19 +++++++++++++++++++ 3 files changed, 23 insertions(+), 3 deletions(-) diff --git a/mail/horde-imp/Makefile b/mail/horde-imp/Makefile index f2cd26c90976..897a035c0b65 100644 --- a/mail/horde-imp/Makefile +++ b/mail/horde-imp/Makefile @@ -1,5 +1,6 @@ PORTNAME= imp PORTVERSION= 6.2.27 +PORTREVISION= 1 CATEGORIES= mail www pear PKGNAMEPREFIX= ${PHP_PKGNAMEPREFIX}horde- diff --git a/mail/horde-imp/files/patch-config_prefs.php b/mail/horde-imp/files/patch-config_prefs.php index de8a319f1870..e355424286ca 100644 --- a/mail/horde-imp/files/patch-config_prefs.php +++ b/mail/horde-imp/files/patch-config_prefs.php @@ -1,6 +1,6 @@ ---- config/prefs.php.orig 2011-05-03 06:27:23.000000000 -0800 -+++ config/prefs.php 2011-05-07 10:06:10.000000000 -0800 -@@ -1200,7 +1200,7 @@ +--- config/prefs.php.orig 2020-08-27 19:34:20 UTC ++++ config/prefs.php +@@ -930,7 +930,7 @@ $_prefs['sourceselect'] = array( // You can provide default values this way: // 'value' => json_encode(array('source_one', 'source_two')) $_prefs['search_sources'] = array( diff --git a/mail/horde-imp/files/patch-lib_Prefs_Sort.php b/mail/horde-imp/files/patch-lib_Prefs_Sort.php new file mode 100644 index 000000000000..c9ffce90eab1 --- /dev/null +++ b/mail/horde-imp/files/patch-lib_Prefs_Sort.php @@ -0,0 +1,19 @@ +--- lib/Prefs/Sort.php.orig 2020-08-27 19:34:20 UTC ++++ lib/Prefs/Sort.php +@@ -39,9 +39,13 @@ class IMP_Prefs_Sort implements ArrayAccess, IteratorA + { + global $prefs; + +- $sortpref = @unserialize($prefs->getValue(self::SORTPREF)); +- if (is_array($sortpref)) { +- $this->_sortpref = $sortpref; ++ $serializedPref = $prefs->getValue(self::SORTPREF); ++ // Only unserialize non-empty strings. Disallow yielding any classes. ++ if (!empty($serializedPref && is_string($serializedPref))) { ++ $sortpref = @unserialize($serializedPref, ['allowed_classes' => false]); ++ if (is_array($sortpref)) { ++ $this->_sortpref = $sortpref; ++ } + } + } +
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202210281712.29SHCUL9096480>