Pullup ticket 242 - requested by Takahiro Kambe

security fix for webmin

Revisions pulled up:
- pkgsrc/sysutils/webmin/DEINSTALL        1.3
- pkgsrc/sysutils/webmin/Makefile         1.4-1.5
- pkgsrc/sysutils/webmin/distinfo         1.3
- pkgsrc/sysutils/webmin/files/webmin.sh  1.2
- pkgsrc/sysutils/webmin/patches/patch-aa 1.3

   Module Name:	pkgsrc
   Committed By:	jlam
   Date:		Sun Jan 23 04:36:27 UTC 2005

   Modified Files:
   	pkgsrc/sysutils/webmin: DEINSTALL Makefile distinfo
   	pkgsrc/sysutils/webmin/files: webmin.sh
   	pkgsrc/sysutils/webmin/patches: patch-aa

   Log Message:
   Update sysutils/webmin to webmin-1.170.  Changes from version 1.150
   include:

   * Added the new Bandwidth Monitoring module, for generating simple
     reports of network traffic by port, time and host on Linux systems.
   * Added the Cluster Copy module, for copying files to multiple servers
     either on schedule or manually.
   * Added the Backup Configuration Files module, for backing up and
     restoring config files known to Webmin.
   * Several improvements to the Linux firewall module, including pre-
     and post commands, cluster support and the ability to reset the
     firewall configuration.
   * Support for selecting specific MySQL and PostgreSQL tables to back
     up, and improved searching in the MySQL module.
   * Automatic email notification for users approaching their disk quotas.
   * The timezone can now be set in the System Time module on Linux,
     Solaris and FreeBSD.
   * Added the new Sarg Squid access reporting module. Thanks to Omar
     Armas for sponsoring its development.
   * Added support for NFSv4 to the Disk and Network Filesystems module.
   * In the MySQL and PostgreSQL modules, all databases can now be backed
     up at once, either manually or on a configured schedule.
   * Added the ability to delete multiple users at once to the Users and
     Groups module.
   * Added support for MD5 encryption for Webmin passwords, to avoid the
     8-character effective password length limit.
   * The BIND module can now create and edit delegation-only zones.
   * When PAM is used for Unix authentication, expired passwords are now
     detected and the user is prompted to select a new password (if this
     feature is enabled on the Webmin Configuration module).
---
   Module Name:	pkgsrc
   Committed By:	jlam
   Date:		Sun Jan 23 06:20:43 UTC 2005

   Modified Files:
   	pkgsrc/sysutils/webmin: Makefile

   Log Message:
   Use the openssl/buildlink3.mk file to properly handle a built-in OpenSSL
   distribution for the location of the "openssl" binary (used to generate
   the self-signed certificate).

5 files changed, 54 insertions, 41 deletions

diff --git a/sysutils/webmin/DEINSTALL b/sysutils/webmin/DEINSTALL
index 90d830f89b9..e89b37b8f24 100644
--- a/sysutils/webmin/DEINSTALL
+++ b/sysutils/webmin/DEINSTALL
@@ -1,4 +1,4 @@
-# $NetBSD: DEINSTALL,v 1.2 2004/07/23 19:47:21 jlam Exp $
+# $NetBSD: DEINSTALL,v 1.2.4.1 2005/01/23 18:06:15 salo Exp $
 
 WEBMIN_DIR="@WEBMIN_DIR@"
 WEBMIN_ETCDIR="@WEBMIN_ETCDIR@"
@@ -6,7 +6,7 @@ WEBMIN_ETCDIR="@WEBMIN_ETCDIR@"
 case ${STAGE} in
 DEINSTALL)
 	uninstall="${WEBMIN_ETCDIR}/uninstall.sh"
-	if [ -x ${uninstall} ]; then
+	if [ -x "${uninstall}" ]; then
 		${ECHO} "y" | ${uninstall}
 	fi
 	;;
diff --git a/sysutils/webmin/Makefile b/sysutils/webmin/Makefile
index c50547180ff..a6135f23cd8 100644
--- a/sysutils/webmin/Makefile
+++ b/sysutils/webmin/Makefile
@@ -1,7 +1,8 @@
-# $NetBSD: Makefile,v 1.2 2004/07/23 19:47:21 jlam Exp $
+# $NetBSD: Makefile,v 1.2.4.1 2005/01/23 18:06:15 salo Exp $
 
-DISTNAME=	webmin-1.150-minimal
+DISTNAME=	webmin-1.170-minimal
 PKGNAME=	${DISTNAME:S/-minimal$//}
+PKGREVISION=	1
 CATEGORIES=	sysutils www
 MASTER_SITES=	${MASTER_SITE_SOURCEFORGE:=webadmin/}
 
@@ -10,11 +11,10 @@ HOMEPAGE=	http://www.webmin.com/
 COMMENT=	Perl web server and CGI for Unix system administration
 
 DEPENDS+=	p5-Net-SSLeay-[0-9]*:../../security/p5-Net-SSLeay
-DEPENDS+=	openssl-[0-9]*:../../security/openssl
 
-USE_LANGUAGES=	# empty
 WRKSRC=		${WRKDIR}/${PKGNAME_NOREV}
-NO_BUILDLINK=	yes
+USE_LANGUAGES=	# empty
+USE_BUILDLINK3=	yes
 NO_BUILD=	yes
 
 USE_PERL5=	yes
@@ -58,6 +58,15 @@ do-configure:
 		fi;							\
 		${MV} -f $$file.new $$file;				\
 	done
+	case "${USE_BUILTIN.openssl}" in				\
+	[nN][oO])							\
+		for file in ${WRKSRC}/acl/config ${WRKSRC}/acl/config-*; do \
+			${SED}	-e "s|^ssleay=.*|ssleay=${SSLBASE}/bin/openssl|" \
+				$$file > $$file.new;			\
+			${MV} -f $$file.new $$file;			\
+		done;							\
+		;;							\
+	esac
 
 pre-install:
 	${FIND} ${WRKSRC} -name "*.orig" -print | ${XARGS} ${RM} -f
@@ -66,4 +75,5 @@ do-install:
 	${INSTALL_DATA_DIR} ${WEBMIN_DIR}
 	${CP} -R ${WRKSRC}/* ${WEBMIN_DIR}
 
+.include "../../security/openssl/buildlink3.mk"
 .include "../../mk/bsd.pkg.mk"
diff --git a/sysutils/webmin/distinfo b/sysutils/webmin/distinfo
index a94babaf99f..1f3b3fe5023 100644
--- a/sysutils/webmin/distinfo
+++ b/sysutils/webmin/distinfo
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.2 2004/07/23 19:47:21 jlam Exp $
+$NetBSD: distinfo,v 1.2.4.1 2005/01/23 18:06:15 salo Exp $
 
-SHA1 (webmin-1.150-minimal.tar.gz) = 2bcc9ae2c9dddce70117d0061d5db3faed349019
-Size (webmin-1.150-minimal.tar.gz) = 955826 bytes
-SHA1 (patch-aa) = ea7b6b7d3ce63b273a3ad09127631da51df13946
+SHA1 (webmin-1.170-minimal.tar.gz) = a32ef7e89d669020cb47e13bc40e321e3c4b6aa5
+Size (webmin-1.170-minimal.tar.gz) = 1011002 bytes
+SHA1 (patch-aa) = e732d88ab149ba4e577e6b0aa28884d6bc3b8102
diff --git a/sysutils/webmin/files/webmin.sh b/sysutils/webmin/files/webmin.sh
index 7983b23bcce..ecb6e0ffe87 100644
--- a/sysutils/webmin/files/webmin.sh
+++ b/sysutils/webmin/files/webmin.sh
@@ -1,13 +1,12 @@
 #!@RCD_SCRIPTS_SHELL@
 #
-# $NetBSD: webmin.sh,v 1.1.1.1 2004/07/23 19:28:32 jlam Exp $
+# $NetBSD: webmin.sh,v 1.1.1.1.4.1 2005/01/23 18:06:15 salo Exp $
 #
+
 # PROVIDE: webmin
 # REQUIRE: LOGIN
 
-if [ -f /etc/rc.subr ]; then
-	. /etc/rc.subr
-fi
+. /etc/rc.subr
 
 name="webmin"
 rcvar=${name}
@@ -16,13 +15,17 @@ command_interpreter="@PERL5@"
 webmin_etcdir="@WEBMIN_ETCDIR@"
 required_files="@WEBMIN_ETCDIR@/miniserv.conf"
 
-start_cmd="webmin_doit"
-stop_cmd="webmin_doit"
+start_cmd="webmin_doit start"
+stop_cmd="webmin_doit stop"
 
 webmin_doit()
 {
-	script="${webmin_etcdir}/${rc_arg}"
-	required_files="${required_files} ${script}"
+	case $1 in
+	start)	script="${webmin_etcdir}/start" ;;
+	stop)	script="${webmin_etcdir}/stop" ;;
+	*)
+	esac
+	required_files="$required_files $script"
 	for f in $required_files; do
 		if [ ! -r "$f" ]; then
 			@ECHO@ 1>&2 "$0: WARNING: $f is not readable"
@@ -31,22 +34,8 @@ webmin_doit()
 			fi
 		fi
 	done
-	${script}
+	$script
 }
 
-if [ -f /etc/rc.subr -a -d /etc/rc.d -a -f /etc/rc.d/DAEMON ]; then
-	load_rc_config $name
-	run_rc_command "$1"
-else
-	if [ -f /etc/rc.conf ]; then
-		. /etc/rc.conf
-	fi
-	case "$1" in
-	stop)
-		eval ${stop_cmd}
-		;;
-	start)
-		eval ${start_cmd}
-		;;
-	esac
-fi
+load_rc_config $name
+run_rc_command "$1"
diff --git a/sysutils/webmin/patches/patch-aa b/sysutils/webmin/patches/patch-aa
index 2fb22b0e919..bba6db5630e 100644
--- a/sysutils/webmin/patches/patch-aa
+++ b/sysutils/webmin/patches/patch-aa
@@ -1,8 +1,8 @@
-$NetBSD: patch-aa,v 1.2 2004/07/23 19:47:21 jlam Exp $
+$NetBSD: patch-aa,v 1.2.4.1 2005/01/23 18:06:15 salo Exp $
 
---- setup.sh.orig	Wed Jun  2 01:33:09 2004
+--- setup.sh.orig	2004-11-12 23:26:56.000000000 -0500
 +++ setup.sh
-@@ -419,6 +419,7 @@ else
+@@ -425,6 +425,7 @@ else
  	fi
  
  	# Ask whether to run at boot time
@@ -10,7 +10,7 @@ $NetBSD: patch-aa,v 1.2 2004/07/23 19:47:21 jlam Exp $
  	if [ "$atboot" = "" ]; then
  		initsupp=`grep "^os_support=" "$srcdir/init/module.info" | sed -e 's/os_support=//g' | grep $os_type`
  		atboot=0
-@@ -535,6 +536,7 @@ EOF
+@@ -550,6 +551,7 @@ EOF
  	fi
  fi
  
@@ -18,7 +18,21 @@ $NetBSD: patch-aa,v 1.2 2004/07/23 19:47:21 jlam Exp $
  if [ "$noperlpath" = "" ]; then
  	echo "Inserting path to perl into scripts.."
  	(find "$wadir" -name '*.cgi' -print ; find "$wadir" -name '*.pl' -print) | $perl "$wadir/perlpath.pl" $perl -
-@@ -661,8 +663,6 @@ if [ "\$answer" = "y" ]; then
+@@ -641,6 +643,13 @@ if [ "$?" != "0" ]; then
+ 	echo passwd_mode=0 >> $config_dir/miniserv.conf
+ fi
+ 
++# Default to having delays on successive incorrect passwords for the same
++# username.
++grep passdelay= $config_dir/miniserv.conf >/dev/null
++if [ "$?" != "0" ]; then
++	echo passdelay=1 >> $config_dir/miniserv.conf
++fi
++
+ # If Perl crypt supports MD5, then make it the default
+ if [ "$md5pass" = "1" ]; then
+ 	echo md5pass=1 >> $config_dir/config
+@@ -681,8 +690,6 @@ if [ "\$answer" = "y" ]; then
  	$config_dir/stop
  	echo "Running uninstall scripts .."
  	(cd "$wadir" ; WEBMIN_CONFIG=$config_dir WEBMIN_VAR=$var_dir LANG= "$wadir/run-uninstalls.pl")