diff options
author | tron <tron> | 2011-01-08 15:01:11 +0000 |
---|---|---|
committer | tron <tron> | 2011-01-08 15:01:11 +0000 |
commit | 0f7c862e830dcfd84ec59f87c1655a8c24c9d291 (patch) | |
tree | da1cd28c28e63decfee8b8eb501595d80699115b | |
parent | 77cb6c871877e03cadf8f3dfdf79870a4753ce33 (diff) | |
download | pkgsrc-0f7c862e830dcfd84ec59f87c1655a8c24c9d291.tar.gz |
Pullup ticket #3318 - requested by taca
www/typolight28: security patch
Revisions pulled up:
- www/typolight28/Makefile 1.12
- www/typolight28/distinfo 1.10
- www/typolight28/patches/patch-ae 1.1
- www/typolight28/patches/patch-af 1.1
---
Mommitted By: taca
Date: Thu Jan 6 14:23:41 UTC 2011
Modified Files:
pkgsrc/www/typolight28: Makefile distinfo
Added Files:
pkgsrc/www/typolight28/patches: patch-ae patch-af
Log Message:
Add the same patch of Comment module as Contao 2.9.3.
Changes are derived from Conao's repository.
Bump PKGREVISION.
-rw-r--r-- | www/typolight28/Makefile | 4 | ||||
-rw-r--r-- | www/typolight28/distinfo | 4 | ||||
-rw-r--r-- | www/typolight28/patches/patch-ae | 19 | ||||
-rw-r--r-- | www/typolight28/patches/patch-af | 15 |
4 files changed, 39 insertions, 3 deletions
diff --git a/www/typolight28/Makefile b/www/typolight28/Makefile index dec94251fe4..2d43e99fefe 100644 --- a/www/typolight28/Makefile +++ b/www/typolight28/Makefile @@ -1,9 +1,9 @@ -# $NetBSD: Makefile,v 1.11 2010/07/28 16:24:20 taca Exp $ +# $NetBSD: Makefile,v 1.11.2.1 2011/01/08 15:01:11 tron Exp $ # DISTNAME= typolight-${TL_VERSION} PKGNAME= typolight${TL_VER}-${TL_PKGVER} -PKGREVISION= 1 +PKGREVISION= 2 CATEGORIES= www MASTER_SITES= ${MASTER_SITE_SOURCEFORGE:=typolight/} diff --git a/www/typolight28/distinfo b/www/typolight28/distinfo index 9db47f75de3..95337f9951a 100644 --- a/www/typolight28/distinfo +++ b/www/typolight28/distinfo @@ -1,6 +1,8 @@ -$NetBSD: distinfo,v 1.9 2010/07/28 16:24:20 taca Exp $ +$NetBSD: distinfo,v 1.9.2.1 2011/01/08 15:01:11 tron Exp $ SHA1 (typolight-2.8.4.tar.gz) = d18d684a06f5dd29ffc6a28d08143feb613cd47b RMD160 (typolight-2.8.4.tar.gz) = ad82d00e3b7ec4e604640779fec841fcfc65f75c Size (typolight-2.8.4.tar.gz) = 4097946 bytes SHA1 (patch-ad) = 207ce919bb6fa7148108f8bd075d3a7d7ad1eeb9 +SHA1 (patch-ae) = eed6db905809b3782acb8324799de6bc8d4e855b +SHA1 (patch-af) = 868309cff4ba1855a96745c578737878f8d118d5 diff --git a/www/typolight28/patches/patch-ae b/www/typolight28/patches/patch-ae new file mode 100644 index 00000000000..52526e9f4f6 --- /dev/null +++ b/www/typolight28/patches/patch-ae @@ -0,0 +1,19 @@ +$NetBSD: patch-ae,v 1.1.2.2 2011/01/08 15:01:11 tron Exp $ + +* Prevent the X_FORWARDED_FOR header against XSS attacks, from repository r587. + +--- system/libraries/Environment.php.orig 2010-04-12 15:52:19.000000000 +0000 ++++ system/libraries/Environment.php +@@ -312,7 +312,11 @@ class Environment + */ + protected function ip() + { +- return !empty($_SERVER['HTTP_X_FORWARDED_FOR']) ? $_SERVER['HTTP_X_FORWARDED_FOR'] : $_SERVER['REMOTE_ADDR']; ++ if (!empty($_SERVER['HTTP_X_FORWARDED_FOR']) && preg_match('/^[A-Fa-f0-9, \.\:]+$/', $_SERVER['HTTP_X_FORWARDED_FOR'])) ++ { ++ return $_SERVER['HTTP_X_FORWARDED_FOR']; ++ } ++ return $_SERVER['REMOTE_ADDR']; + } + + diff --git a/www/typolight28/patches/patch-af b/www/typolight28/patches/patch-af new file mode 100644 index 00000000000..c6f6586b410 --- /dev/null +++ b/www/typolight28/patches/patch-af @@ -0,0 +1,15 @@ +$NetBSD: patch-af,v 1.1.2.2 2011/01/08 15:01:11 tron Exp $ + +* Prevent the X_FORWARDED_FOR header against XSS attacks, from repository r587. + +--- system/modules/comments/dca/tl_comments.php.orig 2010-04-08 15:11:44.000000000 +0000 ++++ system/modules/comments/dca/tl_comments.php +@@ -469,7 +469,7 @@ class tl_comments extends Backend + + return ' + <div class="comment_wrap"> +-<div class="cte_type ' . $key . '"><strong><a href="mailto:' . $arrRow['email'] . '" title="' . specialchars($arrRow['email']) . '">' . $arrRow['name'] . '</a></strong>' . (strlen($arrRow['website']) ? ' (<a href="' . $arrRow['website'] . '" title="' . specialchars($arrRow['website']) . '"' . LINK_NEW_WINDOW . '>' . $GLOBALS['TL_LANG']['MSC']['com_website'] . '</a>)' : '') . ' - ' . $this->parseDate($GLOBALS['TL_CONFIG']['datimFormat'], $arrRow['date']) . ' - IP ' . $arrRow['ip'] . '<br />' . $title . '</div> ++<div class="cte_type ' . $key . '"><strong><a href="mailto:' . $arrRow['email'] . '" title="' . specialchars($arrRow['email']) . '">' . $arrRow['name'] . '</a></strong>' . (strlen($arrRow['website']) ? ' (<a href="' . $arrRow['website'] . '" title="' . specialchars($arrRow['website']) . '"' . LINK_NEW_WINDOW . '>' . $GLOBALS['TL_LANG']['MSC']['com_website'] . '</a>)' : '') . ' - ' . $this->parseDate($GLOBALS['TL_CONFIG']['datimFormat'], $arrRow['date']) . ' - IP ' . specialchars($arrRow['ip']) . '<br />' . $title . '</div> + <div class="limit_height mark_links' . (!$GLOBALS['TL_CONFIG']['doNotCollapse'] ? ' h52' : '') . ' block"> + ' . $arrRow['comment'] . ' + </div> |