From nobody Fri Oct 28 17:16:07 2022 X-Original-To: dev-commits-ports-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4MzTj33ypHz4gc25; Fri, 28 Oct 2022 17:16:07 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4MzTj33PTdz41xX; Fri, 28 Oct 2022 17:16:07 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1666977367; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=fU/snNqKGb6lX2WOWf0cENDSqYd+9cXXFXxIxEWhijg=; b=wxGBTxHhZ5d8+9aC9xyeTqE6epgeGfkWPt6YryE9wStJdLIx7UzTrznd1TyCBT9yQ/ta35 eVnDKTYfFtEK2S1tdcNesVqqbz2rUuQjHZHsd387EOpIjz3XMQk+ezm/4MlT4X15BG/pK1 8yzexCwLwEc4ff9SGB/4gB0/Uqf0WysIEKYVpfA1Y684Y05HBJ+/x3QVX25xG/D2c8JpOU +w+NGc9xtSnAFSN5zH36bWgdjzpxmI5mTtRIFihmEaJkDxZ2rXJqvDgC5MYbV4sd8T1Utj yEkNPTGa6wj7Y5svtLN6v/IFUUGZLgXvQJkMqFzWGjF30P0ow8LZJrw1c4oULw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4MzTj32QPJzlZj; Fri, 28 Oct 2022 17:16:07 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 29SHG7TW097086; Fri, 28 Oct 2022 17:16:07 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 29SHG7BA097085; Fri, 28 Oct 2022 17:16:07 GMT (envelope-from git) Date: Fri, 28 Oct 2022 17:16:07 GMT Message-Id: <202210281716.29SHG7BA097085@gitrepo.freebsd.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-branches@FreeBSD.org From: Thierry Thomas Subject: git: f25808f72426 - 2022Q4 - mail/horde-imp: address ZDI-20-1051 / ZDI-CAN-10436 List-Id: Commit messages for all branches of the ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-ports-all@freebsd.org X-BeenThere: dev-commits-ports-all@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: thierry X-Git-Repository: ports X-Git-Refname: refs/heads/2022Q4 X-Git-Reftype: branch X-Git-Commit: f25808f72426f5644fe9a1c0d0d037aa9c16fb29 Auto-Submitted: auto-generated ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1666977367; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=fU/snNqKGb6lX2WOWf0cENDSqYd+9cXXFXxIxEWhijg=; b=Xd4Wt8FGu3bW18qN4+/ayNOyY9xtAPAdxqK7QSgI15NpdTaTQJ/SlhIFrW7h+l6DooB9s6 T5y9djwRxuRR1gJDVohF8nwMRtsYfykwEkSt+IjyjVVXUXjwr9A80IwXRXc2zru3QMtLW1 4tajJF5ph0jwCBnISGbJsMU4QfGPXXV8NHAn1xyxDcyvJMmdiJ+xy1DlRVlgpSrRwLe+bT VD6A772pXUrj35PTY1r/GMthjXgNTLmAFKjFloCFT+tITOy+VNKOEATQvncwT6adCET5S6 W7K0XXo3rRG57YC4xBFTdShR2YsFRIWPEaeQQss0dPfwZpNNdxsqU9NWOyRobA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1666977367; a=rsa-sha256; cv=none; b=Z+J8jhDGrqDfxRMSyTiT6RvZFst/8L6lv8dBLoQGvVm8udSQu2DRSIKv3gsOiMju145F0p BpMt7jXQJJO+tTtrWbt6qMyA86pw5jcCX1lmbsUGnPZEUz+bwKMnEh7xCnLEIbcvZmRn9P jqGjSR5mFeRo2+kigALkEAT186/1Pm/no5jz2UeFYNVTM/pm0bZzXVPcnNONuiqf0DM5+A sNdGmCUqdGMH1xJdhNUmGbhMxAUwL6lxhH48TLauYwfvLg+NtlD8TxH9QM6K0kLMZkKbcN JoEm11flYIO/A1aPK0MINQVkzTXN7xtRP+UdA6pOuCpPBa2klqdxSnN7dwFemg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N The branch 2022Q4 has been updated by thierry: URL: https://cgit.FreeBSD.org/ports/commit/?id=f25808f72426f5644fe9a1c0d0d037aa9c16fb29 commit f25808f72426f5644fe9a1c0d0d037aa9c16fb29 Author: Thierry Thomas AuthorDate: 2022-10-14 08:35:37 +0000 Commit: Thierry Thomas CommitDate: 2022-10-28 17:15:44 +0000 mail/horde-imp: address ZDI-20-1051 / ZDI-CAN-10436 PR: 267049 Approved by: maintainer’s time-out Obtained from: https://github.com/horde/imp/pull/10/files Fixes: Address ZDI-20-1051 / ZDI-CAN-10436 MFH: 2022Q4 Security: https://www.zerodayinitiative.com/advisories/ZDI-20-1051/ (cherry picked from commit dfa4c773430c9297b3f54d3b1a1202e18e7f120d) --- mail/horde-imp/Makefile | 1 + mail/horde-imp/files/patch-config_prefs.php | 6 +++--- mail/horde-imp/files/patch-lib_Prefs_Sort.php | 19 +++++++++++++++++++ 3 files changed, 23 insertions(+), 3 deletions(-) diff --git a/mail/horde-imp/Makefile b/mail/horde-imp/Makefile index f2cd26c90976..897a035c0b65 100644 --- a/mail/horde-imp/Makefile +++ b/mail/horde-imp/Makefile @@ -1,5 +1,6 @@ PORTNAME= imp PORTVERSION= 6.2.27 +PORTREVISION= 1 CATEGORIES= mail www pear PKGNAMEPREFIX= ${PHP_PKGNAMEPREFIX}horde- diff --git a/mail/horde-imp/files/patch-config_prefs.php b/mail/horde-imp/files/patch-config_prefs.php index de8a319f1870..e355424286ca 100644 --- a/mail/horde-imp/files/patch-config_prefs.php +++ b/mail/horde-imp/files/patch-config_prefs.php @@ -1,6 +1,6 @@ ---- config/prefs.php.orig 2011-05-03 06:27:23.000000000 -0800 -+++ config/prefs.php 2011-05-07 10:06:10.000000000 -0800 -@@ -1200,7 +1200,7 @@ +--- config/prefs.php.orig 2020-08-27 19:34:20 UTC ++++ config/prefs.php +@@ -930,7 +930,7 @@ $_prefs['sourceselect'] = array( // You can provide default values this way: // 'value' => json_encode(array('source_one', 'source_two')) $_prefs['search_sources'] = array( diff --git a/mail/horde-imp/files/patch-lib_Prefs_Sort.php b/mail/horde-imp/files/patch-lib_Prefs_Sort.php new file mode 100644 index 000000000000..c9ffce90eab1 --- /dev/null +++ b/mail/horde-imp/files/patch-lib_Prefs_Sort.php @@ -0,0 +1,19 @@ +--- lib/Prefs/Sort.php.orig 2020-08-27 19:34:20 UTC ++++ lib/Prefs/Sort.php +@@ -39,9 +39,13 @@ class IMP_Prefs_Sort implements ArrayAccess, IteratorA + { + global $prefs; + +- $sortpref = @unserialize($prefs->getValue(self::SORTPREF)); +- if (is_array($sortpref)) { +- $this->_sortpref = $sortpref; ++ $serializedPref = $prefs->getValue(self::SORTPREF); ++ // Only unserialize non-empty strings. Disallow yielding any classes. ++ if (!empty($serializedPref && is_string($serializedPref))) { ++ $sortpref = @unserialize($serializedPref, ['allowed_classes' => false]); ++ if (is_array($sortpref)) { ++ $this->_sortpref = $sortpref; ++ } + } + } +