Fix various cross site scripting, arbitrary command execution and various

other vulnerabilities in webmin (CVE-2008-0720).

20 files changed, 538 insertions, 3 deletions

diff --git a/sysutils/webmin/Makefile b/sysutils/webmin/Makefile
index 1687a52308a..6e9ffc7959c 100644
--- a/sysutils/webmin/Makefile
+++ b/sysutils/webmin/Makefile
@@ -1,9 +1,9 @@
-# $NetBSD: Makefile,v 1.23 2008/05/26 22:37:30 tnn Exp $
+# $NetBSD: Makefile,v 1.24 2008/07/25 02:55:27 tonnerre Exp $
 
 .include "version.mk"
 
 DISTNAME=	webmin-${WBM_VERSION}
-PKGREVISION=	2
+PKGREVISION=	3
 CATEGORIES=	sysutils www
 MASTER_SITES=	${MASTER_SITE_SOURCEFORGE:=webadmin/}
 
diff --git a/sysutils/webmin/distinfo b/sysutils/webmin/distinfo
index f239b735819..e36dbefa54a 100644
--- a/sysutils/webmin/distinfo
+++ b/sysutils/webmin/distinfo
@@ -1,13 +1,31 @@
-$NetBSD: distinfo,v 1.15 2007/10/05 15:47:00 obache Exp $
+$NetBSD: distinfo,v 1.16 2008/07/25 02:55:27 tonnerre Exp $
 
 SHA1 (webmin-1.370.tar.gz) = ed4c1ee751953146356f308c4091eb8ad21df309
 RMD160 (webmin-1.370.tar.gz) = 28805b553adc85b642ad3acffa3765a5127a529d
 Size (webmin-1.370.tar.gz) = 13132344 bytes
 SHA1 (patch-aa) = 3b66c111357358548a8f5e47ae4dfb2e9be5fc2a
 SHA1 (patch-ab) = fa07200462df76af23b9952739388053940c6743
+SHA1 (patch-ac) = c4f73a091ef8b5c5c0d5a6f82427c497e823a946
 SHA1 (patch-ad) = 51d6875b0d825b06ab088e7e63f3e86c280a06f6
 SHA1 (patch-ae) = 16583d392d44176e8175e7637851d000ca2ecb9d
 SHA1 (patch-af) = 24f130a985ab7d3bdfc7db8d82114e8b107f1574
 SHA1 (patch-ag) = 4a2ba61d26a3f3a9bb0e1a22a8afb65d66e43746
 SHA1 (patch-ah) = 9cf6fc0d420535697eac2c32a29701fc095ef67f
 SHA1 (patch-ai) = 14accea4c38882933da3b565fe51adec06db1878
+SHA1 (patch-aj) = bc86ea60c49266fc537690b07d194d5c2fa690c4
+SHA1 (patch-ak) = 201c124d8c407e0439b8531dfb4dacba37ce37bb
+SHA1 (patch-al) = b1382143d42af3ce5057368dc442ba9c2e6de259
+SHA1 (patch-am) = d61fed9c53870aad36651389a5d655f5b2d5c21f
+SHA1 (patch-an) = 4416c2586fc7a732b255d4787be1a3f93c23f32c
+SHA1 (patch-ao) = 007eba7b551fd3d154e470f82c1c15552481e9fa
+SHA1 (patch-ap) = 7b8c983770c7fd08b20de36b006e0f30ce1bce3e
+SHA1 (patch-aq) = 52751d7ec0ce1ebb89aee977a752486372b80e36
+SHA1 (patch-ar) = 647703ab0281991cec015f2f6a6d191c70c0301e
+SHA1 (patch-as) = 65f246bfca5b077d15bf0e874d56792f08c93c03
+SHA1 (patch-at) = 72e88355d9c3bd159d5077acc81073ec048efd0b
+SHA1 (patch-au) = f0d0aaf6819f92fd96543246e7600054fb150d08
+SHA1 (patch-av) = c3a4096058a432863eb10a2b2d44184bc91f8926
+SHA1 (patch-aw) = 2d7738459ed4618b11558d31aef70a42f26c25be
+SHA1 (patch-ax) = 09f78731d35603e736b22a0f1e478103ca14cc4d
+SHA1 (patch-ay) = 04bf4d094a2051469e956b4e57af842daf0232d7
+SHA1 (patch-az) = 55e40bcf0841b20d185265fff98685fe56cb1810
diff --git a/sysutils/webmin/patches/patch-ac b/sysutils/webmin/patches/patch-ac
new file mode 100644
index 00000000000..f34eb48ed94
--- /dev/null
+++ b/sysutils/webmin/patches/patch-ac
@@ -0,0 +1,34 @@
+$NetBSD: patch-ac,v 1.3 2008/07/25 02:55:27 tonnerre Exp $
+
+--- software/search.cgi.orig	2007-09-21 23:26:13.000000000 +0200
++++ software/search.cgi
+@@ -34,7 +34,8 @@ if (@match == 1 && $in{'goto'}) {
+ if (@match) {
+ 	@match = sort { lc($packages{$a,'name'}) cmp lc($packages{$b,'name'}) }
+ 		      @match;
+-	print "<b>",&text('search_match', "<tt>$s</tt>"),"</b><p>\n";
++	print "<b>",&text('search_match', "<tt>" . &html_escape($s) . "</tt>"),
++		"</b><p>\n";
+ 	print "<form action=delete_packs.cgi method=post>\n";
+ 	print "<input type=hidden name=search value='$in{'search'}'>\n";
+ 	@tds = ( "width=5" );
+@@ -47,7 +48,8 @@ if (@match) {
+ 				  $text{'search_desc'} ], 100, 0, \@tds);
+ 	foreach $i (@match) {
+ 		local @cols;
+-		push(@cols, "<a href=\"edit_pack.cgi?search=$s&package=".
++		push(@cols, "<a href=\"edit_pack.cgi?search=" .
++			&urlize($s) . "&package=".
+ 		      &urlize($packages{$i,'name'})."&version=".
+ 		      &urlize($packages{$i,'version'})."\">".&html_escape(
+ 			$packages{$i,'name'}.($packages{$i,'version'} ?
+@@ -69,7 +71,8 @@ if (@match) {
+ 	print "<input type=submit value='$text{'search_delete'}'></form>\n";
+ 	}
+ else {
+-	print "<b>",&text('search_nomatch', "<tt>$s</tt>"),"</b><p>\n";
++	print "<b>",&text('search_nomatch', "<tt>" . &html_escape($s) .
++		"</tt>"),"</b><p>\n";
+ 	}
+ 
+ &ui_print_footer("", $text{'index_return'});
diff --git a/sysutils/webmin/patches/patch-aj b/sysutils/webmin/patches/patch-aj
new file mode 100644
index 00000000000..37c7e4723ab
--- /dev/null
+++ b/sysutils/webmin/patches/patch-aj
@@ -0,0 +1,46 @@
+$NetBSD: patch-aj,v 1.1 2008/07/25 02:55:27 tonnerre Exp $
+
+--- proc/index_search.cgi.orig	2008-07-25 04:39:36.000000000 +0200
++++ proc/index_search.cgi
+@@ -22,12 +22,12 @@ printf "<input type=radio name=mode valu
+ 	$in{mode}==1 ? "checked" : "";
+ print &hlink("<b>$text{'search_match'}</b>","smatch"),"\n";
+ printf "<input name=match size=20 value=\"%s\"><br>\n",
+-	$in{mode}==1 ? $in{match} : "";
++	$in{mode}==1 ? &html_escape($in{match}) : "";
+ 
+ printf "<input type=radio name=mode value=2 %s>\n",
+ 	$in{mode}==2 ? "checked" : "";
+ $cpu = sprintf "<input name=cpu size=4 value=\"%s\">\n",
+-		$in{mode}==2 ? $in{cpu} : "";
++		$in{mode}==2 ? html_escape($in{cpu}) : "";
+ print &hlink("<b>".&text('search_cpupc', $cpu)."</b>", "scpu"),"<br>\n";
+ 
+ print "</td><td valign=top>\n";
+@@ -49,7 +49,7 @@ if ($has_fuser_command) {
+ 		}
+ 	else {
+ 		printf "<input name=fs size=15 value='%s'><br>\n",
+-			$in{'mode'}==3 ? $in{'fs'} : "";
++			$in{'mode'}==3 ? &html_escape($in{'fs'}) : "";
+ 		}
+ 
+ 	printf "<input type=radio name=mode value=4 %s>\n",
+@@ -66,7 +66,7 @@ if ($has_lsof_command) {
+ 		$in{mode}==5 ? "checked" : "";
+ 	print &hlink("<b>$text{'search_port'}</b>","ssocket"),"\n";
+ 	printf "<input name=port size=6 value='%s'>\n",
+-		$in{mode}==5 ? $in{port} : "";
++		$in{mode}==5 ? &html_escape($in{port}) : "";
+ 
+ 	# Show input for protocol and port
+ 	print &hlink("<b>$text{'search_protocol'}</b>","ssocket"),"\n";
+@@ -83,7 +83,7 @@ if ($has_lsof_command) {
+ 		$in{mode}==6 ? "checked" : "";
+ 	print &hlink("<b>$text{'search_ip'}</b>","sip"),"\n";
+ 	printf "<input name=ip size=15 value='%s'>\n",
+-		$in{mode}==6 ? $in{ip} : "";
++		$in{mode}==6 ? &html_escape($in{ip}) : "";
+ 	}
+ 
+ print "</td></tr></table>\n";
diff --git a/sysutils/webmin/patches/patch-ak b/sysutils/webmin/patches/patch-ak
new file mode 100644
index 00000000000..c5fd66f84f5
--- /dev/null
+++ b/sysutils/webmin/patches/patch-ak
@@ -0,0 +1,14 @@
+$NetBSD: patch-ak,v 1.1 2008/07/25 02:55:27 tonnerre Exp $
+
+--- sendmail/mailq_search.cgi.orig	2007-09-21 23:26:27.000000000 +0200
++++ sendmail/mailq_search.cgi
+@@ -18,7 +18,8 @@ $conf = &get_sendmailcf();
+ $fields = [ [ $in{'field'}, $in{'match'} ] ];
+ @qmails = grep { &mail_matches($fields, 1, $_) } @qmails;
+ print "<p><b>",&text($in{'field'} =~ /^\!/ ? 'search_results3' :
+-	  'search_results2', scalar(@qmails), "<tt>$in{'match'}</tt>"),"</b><p>\n";
++	  'search_results2', scalar(@qmails), "<tt>" .
++	  &html_escape($in{'match'}) . "</tt>"),"</b><p>\n";
+ 
+ if (@qmails) {
+ 	%qmails = map { $_->{'file'}, $_ } @qmails;
diff --git a/sysutils/webmin/patches/patch-al b/sysutils/webmin/patches/patch-al
new file mode 100644
index 00000000000..2b3b8e9d521
--- /dev/null
+++ b/sysutils/webmin/patches/patch-al
@@ -0,0 +1,25 @@
+$NetBSD: patch-al,v 1.1 2008/07/25 02:55:27 tonnerre Exp $
+
+--- file/search.cgi.orig	2007-09-21 23:26:33.000000000 +0200
++++ file/search.cgi
+@@ -17,16 +17,16 @@ if ($in{'dir'} ne '/') {
+ 	}
+ $cmd = "find ".quotemeta(&unmake_chroot($in{'dir'}))." -name ".quotemeta($in{'match'});
+ if ($in{'type'}) {
+-	$cmd .= " -type $in{'type'}";
++	$cmd .= " -type " . quotemeta($in{'type'});
+ 	}
+ if ($in{'user'}) {
+-	$cmd .= " -user $in{'user'}";
++	$cmd .= " -user " . quotemeta($in{'user'});
+ 	}
+ if ($in{'group'}) {
+-	$cmd .= " -group $in{'group'}";
++	$cmd .= " -group " . quotemeta($in{'group'});
+ 	}
+ if ($in{'size'}) {
+-	$cmd .= " -size $in{'size'}";
++	$cmd .= " -size " . quotemeta($in{'size'});
+ 	}
+ if ($in{'xdev'}) {
+ 	$cmd .= " -mount";
diff --git a/sysutils/webmin/patches/patch-am b/sysutils/webmin/patches/patch-am
new file mode 100644
index 00000000000..8b683543ba4
--- /dev/null
+++ b/sysutils/webmin/patches/patch-am
@@ -0,0 +1,34 @@
+$NetBSD: patch-am,v 1.1 2008/07/25 02:55:27 tonnerre Exp $
+
+--- mysql/search_form.cgi.orig	2007-09-21 23:26:42.000000000 +0200
++++ mysql/search_form.cgi
+@@ -12,7 +12,8 @@ require './view-lib.pl';
+ &can_edit_db($in{'db'}) || &error($text{'dbase_ecannot'});
+ @str = &table_structure($in{'db'}, $in{'table'});
+ 
+-$desc = &text('table_header', "<tt>$in{'table'}</tt>", "<tt>$in{'db'}</tt>");
++$desc = &text('table_header', "<tt>" . &html_escape($in{'table'}) .
++	"</tt>", "<tt>" . &html_escape($in{'db'}) . "</tt>");
+ &ui_print_header($desc, $text{'adv_title'}, "");
+ 
+ print &ui_form_start("view_table.cgi", "post");
+@@ -36,13 +37,13 @@ print "</table>\n";
+ print &ui_form_end([ [ "advanced", $text{'adv_ok'} ] ]);
+ 
+ if ($access{'edonly'}) {
+-	&ui_print_footer("edit_dbase.cgi?db=$in{'db'}",$text{'dbase_return'},
+-		"", $text{'index_return'});
++	&ui_print_footer("edit_dbase.cgi?db=" . &urlize($in{'db'}),
++		$text{'dbase_return'}, "", $text{'index_return'});
+ 	}
+ else {
+-	&ui_print_footer("edit_table.cgi?db=$in{'db'}&table=$in{'table'}",
+-		$text{'table_return'},
+-		"edit_dbase.cgi?db=$in{'db'}", $text{'dbase_return'},
+-		"", $text{'index_return'});
++	&ui_print_footer("edit_table.cgi?db=" . &urlize($in{'db'}) .
++		"&table=" . &urlize($in{'table'}), $text{'table_return'},
++		"edit_dbase.cgi?db=" .  &urlize($in{'db'}),
++		$text{'dbase_return'}, "", $text{'index_return'});
+ 	}
+ 
diff --git a/sysutils/webmin/patches/patch-an b/sysutils/webmin/patches/patch-an
new file mode 100644
index 00000000000..5fe8f1fd446
--- /dev/null
+++ b/sysutils/webmin/patches/patch-an
@@ -0,0 +1,24 @@
+$NetBSD: patch-an,v 1.1 2008/07/25 02:55:27 tonnerre Exp $
+
+--- man/search.cgi.orig	2007-09-21 23:26:43.000000000 +0200
++++ man/search.cgi
+@@ -255,7 +255,8 @@ if (@rv == 1 && !$in{'check'}) {
+ 	}
+ 
+ # Display search results
+-$for = join($in{'and'} ? " and " : " or ", map { "<tt>$_</tt>" } @for);
++$for = join($in{'and'} ? " and " : " or ", map { "<tt>" . &html_escape($_) .
++	"</tt>" } @for);
+ &ui_print_header(&text('search_for', $for), $text{'search_title'}, "");
+ if (@rv) {
+ 	#@rv = sort { $b->[4] <=> $a->[4] } @rv;
+@@ -280,7 +281,8 @@ if (@rv) {
+ 	print &ui_columns_end();
+ 	}
+ else {
+-	print "<p><b>",&text('search_none', "<tt>$in{'for'}</tt>"),"</b><p>\n";
++	print "<p><b>",&text('search_none', "<tt>" . &html_escape($in{'for'}) .
++		"</tt>"),"</b><p>\n";
+ 	}
+ 
+ &ui_print_footer("", $text{'index_return'});
diff --git a/sysutils/webmin/patches/patch-ao b/sysutils/webmin/patches/patch-ao
new file mode 100644
index 00000000000..fb196cd4ed4
--- /dev/null
+++ b/sysutils/webmin/patches/patch-ao
@@ -0,0 +1,14 @@
+$NetBSD: patch-ao,v 1.1 2008/07/25 02:55:27 tonnerre Exp $
+
+--- postfix/mailq_search.cgi.orig	2007-09-21 23:26:52.000000000 +0200
++++ postfix/mailq_search.cgi
+@@ -17,7 +17,8 @@ $neg = ($in{'field'} =~ s/^!//);
+ 		 $neg ? !$r : $r } @qfiles;
+ 
+ print "<p><b>",&text($in{'field'} =~ /^\!/ ? 'search_results3' :
+-	  'search_results2', scalar(@qfiles), "<tt>$in{'match'}</tt>"),"</b><p>\n";
++	  'search_results2', scalar(@qfiles), "<tt>" .
++	  &html_escape($in{'match'}) . "</tt>"),"</b><p>\n";
+ if (@qfiles) {
+ 	# Show matching messages
+ 	&mailq_table(\@qfiles);
diff --git a/sysutils/webmin/patches/patch-ap b/sysutils/webmin/patches/patch-ap
new file mode 100644
index 00000000000..60762bb64d8
--- /dev/null
+++ b/sysutils/webmin/patches/patch-ap
@@ -0,0 +1,14 @@
+$NetBSD: patch-ap,v 1.1 2008/07/25 02:55:27 tonnerre Exp $
+
+--- webminlog/search.cgi.orig	2007-09-21 23:26:52.000000000 +0200
++++ webminlog/search.cgi
+@@ -91,7 +91,8 @@ $searchmsg = join(" ",
+ if (@match) {
+ 	if ($in{'sid'}) {
+ 		print "<b>",&text('search_sid', "<tt>$match[0]->{'user'}</tt>",
+-				  "<tt>$in{'sid'}</tt>")," ..</b><p>\n";
++				  "<tt>" . &html_escape($in{'sid'}) . "</tt>"),
++				  " ..</b><p>\n";
+ 		}
+ 	elsif ($in{'uall'} == 1 && $in{'mall'} && $in{'tall'}) {
+ 		print "<b>$text{'search_critall'} ..</b><p>\n";
diff --git a/sysutils/webmin/patches/patch-aq b/sysutils/webmin/patches/patch-aq
new file mode 100644
index 00000000000..a73893cb300
--- /dev/null
+++ b/sysutils/webmin/patches/patch-aq
@@ -0,0 +1,34 @@
+$NetBSD: patch-aq,v 1.1 2008/07/25 02:55:27 tonnerre Exp $
+
+--- postgresql/old/search_form.cgi.orig	2007-09-21 23:26:53.000000000 +0200
++++ postgresql/old/search_form.cgi
+@@ -6,7 +6,8 @@ require './postgresql-lib.pl';
+ &can_edit_db($in{'db'}) || &error($text{'dbase_ecannot'});
+ @str = &table_structure($in{'db'}, $in{'table'});
+ 
+-$desc = &text('table_header', "<tt>$in{'table'}</tt>", "<tt>$in{'db'}</tt>");
++$desc = &text('table_header', "<tt>" . &html_escape($in{'table'}) . "</tt>",
++	"<tt>" . &html_escape($in{'db'}) . "</tt>");
+ &ui_print_header($desc, $text{'adv_title'}, "");
+ 
+ print &ui_form_start("view_table.cgi", "post");
+@@ -30,13 +31,13 @@ print "</table>\n";
+ print &ui_form_end([ [ "advanced", $text{'adv_ok'} ] ]);
+ 
+ if ($access{'edonly'}) {
+-	&ui_print_footer("edit_dbase.cgi?db=$in{'db'}",$text{'dbase_return'},
+-		"", $text{'index_return'});
++	&ui_print_footer("edit_dbase.cgi?db=" . &urlize($in{'db'}),
++		$text{'dbase_return'}, "", $text{'index_return'});
+ 	}
+ else {
+-	&ui_print_footer("edit_table.cgi?db=$in{'db'}&table=$in{'table'}",
+-		$text{'table_return'},
+-		"edit_dbase.cgi?db=$in{'db'}", $text{'dbase_return'},
+-		"", $text{'index_return'});
++	&ui_print_footer("edit_table.cgi?db=" . &urlize($in{'db'}) .
++		"&table=" . &urlize($in{'table'}), $text{'table_return'},
++		"edit_dbase.cgi?db=" . &urlize($in{'db'}),
++		$text{'dbase_return'}, "", $text{'index_return'});
+ 	}
+ 
diff --git a/sysutils/webmin/patches/patch-ar b/sysutils/webmin/patches/patch-ar
new file mode 100644
index 00000000000..f792d38e999
--- /dev/null
+++ b/sysutils/webmin/patches/patch-ar
@@ -0,0 +1,34 @@
+$NetBSD: patch-ar,v 1.1 2008/07/25 02:55:27 tonnerre Exp $
+
+--- postgresql/search_form.cgi.orig	2007-09-21 23:26:53.000000000 +0200
++++ postgresql/search_form.cgi
+@@ -12,7 +12,8 @@ require './view-lib.pl';
+ &can_edit_db($in{'db'}) || &error($text{'dbase_ecannot'});
+ @str = &table_structure($in{'db'}, $in{'table'});
+ 
+-$desc = &text('table_header', "<tt>$in{'table'}</tt>", "<tt>$in{'db'}</tt>");
++$desc = &text('table_header', "<tt>" . &html_escape($in{'table'}) . "</tt>",
++	"<tt>" . &html_escape($in{'db'}) . "</tt>");
+ &ui_print_header($desc, $text{'adv_title'}, "");
+ 
+ print &ui_form_start("view_table.cgi", "post");
+@@ -36,13 +37,13 @@ print "</table>\n";
+ print &ui_form_end([ [ "advanced", $text{'adv_ok'} ] ]);
+ 
+ if ($access{'edonly'}) {
+-	&ui_print_footer("edit_dbase.cgi?db=$in{'db'}",$text{'dbase_return'},
+-		"", $text{'index_return'});
++	&ui_print_footer("edit_dbase.cgi?db=" . &urlize($in{'db'}),
++		$text{'dbase_return'}, "", $text{'index_return'});
+ 	}
+ else {
+-	&ui_print_footer("edit_table.cgi?db=$in{'db'}&table=$in{'table'}",
+-		$text{'table_return'},
+-		"edit_dbase.cgi?db=$in{'db'}", $text{'dbase_return'},
+-		"", $text{'index_return'});
++	&ui_print_footer("edit_table.cgi?db=" . &urlize($in{'db'}) .
++		"&table=" . &urlize($in{'table'}), $text{'table_return'},
++		"edit_dbase.cgi?db=" . &urlize($in{'db'}),
++		$text{'dbase_return'}, "", $text{'index_return'});
+ 	}
+ 
diff --git a/sysutils/webmin/patches/patch-as b/sysutils/webmin/patches/patch-as
new file mode 100644
index 00000000000..9f2c1491488
--- /dev/null
+++ b/sysutils/webmin/patches/patch-as
@@ -0,0 +1,36 @@
+$NetBSD: patch-as,v 1.1 2008/07/25 02:55:27 tonnerre Exp $
+
+--- cluster-software/search.cgi.orig	2007-09-21 23:27:39.000000000 +0200
++++ cluster-software/search.cgi
+@@ -29,7 +29,8 @@ if (@match == 1) {
+ &ui_print_header(undef, $text{'search_title'}, "", "search");
+ if (@match) {
+ 	@match = sort { lc($a->{'name'}) cmp lc($b->{'name'}) } @match;
+-	print "<b>",&text('search_match', "<tt>$s</tt>"),"</b><br>\n";
++	print "<b>",&text('search_match', "<tt>" . &html_escape($s) . "</tt>"),
++		"</b><br>\n";
+ 
+ 	print &ui_form_start("delete_packs.cgi", "post");
+ 	print &ui_hidden("search", $in{'search'}),"\n";
+@@ -43,8 +44,9 @@ if (@match) {
+ 				  $text{'search_desc'} ], 100, 0, \@tds);
+ 	foreach $i (@match) {
+ 		local @cols;
+-		push(@cols, "<a href=\"edit_pack.cgi?search=$s&package=".
+-		      &urlize($i->{'name'})."\">$i->{'name'}</a>");
++		push(@cols, "<a href=\"edit_pack.cgi?search=" .
++			&urlize($s) . "&package=". &urlize($i->{'name'}) .
++			"\">$i->{'name'}</a>");
+ 		$c = $i->{'class'};
+ 		push(@cols, $i->{'class'} || $text{'search_none'});
+ 		push(@cols, $i->{'desc'});
+@@ -62,7 +64,8 @@ if (@match) {
+ 	print &ui_form_end();
+ 	}
+ else {
+-	print "<b>",&text('search_nomatch', "<tt>$s</tt>"),"</b>\n";
++	print "<b>",&text('search_nomatch', "<tt>" . &html_escape($s) .
++		"</tt>"),"</b>\n";
+ 	}
+ 
+ &ui_print_footer("", $text{'index_return'});
diff --git a/sysutils/webmin/patches/patch-at b/sysutils/webmin/patches/patch-at
new file mode 100644
index 00000000000..ca40f8189cd
--- /dev/null
+++ b/sysutils/webmin/patches/patch-at
@@ -0,0 +1,38 @@
+$NetBSD: patch-at,v 1.1 2008/07/25 02:55:27 tonnerre Exp $
+
+--- cluster-software/software/search.cgi.orig	2007-09-21 23:27:39.000000000 +0200
++++ cluster-software/software/search.cgi
+@@ -34,9 +34,11 @@ if (@match == 1 && $in{'goto'}) {
+ if (@match) {
+ 	@match = sort { lc($packages{$a,'name'}) cmp lc($packages{$b,'name'}) }
+ 		      @match;
+-	print "<b>",&text('search_match', "<tt>$s</tt>"),"</b><p>\n";
++	print "<b>",&text('search_match', "<tt>" . &html_escape($s) . "</tt>"),
++		"</b><p>\n";
+ 	print "<form action=delete_packs.cgi method=post>\n";
+-	print "<input type=hidden name=search value='$in{'search'}'>\n";
++	print "<input type=hidden name=search value='" .
++		&html_escape($in{'search'}) . "'>\n";
+ 	print &select_all_link("del", 0, $text{'search_selall'}),"&nbsp;\n";
+ 	print &select_invert_link("del", 0, $text{'search_invert'}),"<br>\n";
+ 	print &ui_columns_start([ "",
+@@ -45,7 +47,8 @@ if (@match) {
+ 				  $text{'search_desc'} ], 100);
+ 	foreach $i (@match) {
+ 		local @cols;
+-		push(@cols, "<a href=\"edit_pack.cgi?search=$s&package=".
++		push(@cols, "<a href=\"edit_pack.cgi?search=" .
++			&urlize($s) . "&package=".
+ 		      &urlize($packages{$i,'name'})."&version=".
+ 		      &urlize($packages{$i,'version'})."\">".&html_escape(
+ 			$packages{$i,'name'}.($packages{$i,'version'} ?
+@@ -63,7 +66,8 @@ if (@match) {
+ 	print "<input type=submit value='$text{'search_delete'}'></form>\n";
+ 	}
+ else {
+-	print "<b>",&text('search_nomatch', "<tt>$s</tt>"),"</b><p>\n";
++	print "<b>",&text('search_nomatch', "<tt>" . &html_escape($s) .
++		"</tt>"),"</b><p>\n";
+ 	}
+ 
+ &ui_print_footer("", $text{'index_return'});
diff --git a/sysutils/webmin/patches/patch-au b/sysutils/webmin/patches/patch-au
new file mode 100644
index 00000000000..add7d28e35a
--- /dev/null
+++ b/sysutils/webmin/patches/patch-au
@@ -0,0 +1,14 @@
+$NetBSD: patch-au,v 1.1 2008/07/25 02:55:27 tonnerre Exp $
+
+--- smf/search_instance.cgi.orig	2007-09-21 23:28:42.000000000 +0200
++++ smf/search_instance.cgi
+@@ -34,7 +34,8 @@ print "</h2>";
+ 
+ print "<form  method=\"POST\" action=\"search_instance.cgi\">\n";
+ print
+-    "<input size=60 name=\"searchstring\" value=\"$original_searchstring\">\n";
++    "<input size=60 name=\"searchstring\" value=\"" .
++    &html_escape($original_searchstring) . "\">\n";
+ &print_svc_chooser("searchstring", 0, "$text{'search_instance_browse'}",
+ 	"both", "0");
+ print "&nbsp;<input type=submit value=\"$text{'search_instance_go'}\">\n";
diff --git a/sysutils/webmin/patches/patch-av b/sysutils/webmin/patches/patch-av
new file mode 100644
index 00000000000..34206fde175
--- /dev/null
+++ b/sysutils/webmin/patches/patch-av
@@ -0,0 +1,15 @@
+$NetBSD: patch-av,v 1.1 2008/07/25 02:55:27 tonnerre Exp $
+
+--- ldap-useradmin/search_user.cgi.orig	2007-09-21 23:28:25.000000000 +0200
++++ ldap-useradmin/search_user.cgi
+@@ -23,8 +23,8 @@ elsif ($in{'match'} == 3) {
+ $rv = $ldap->search(base => $base,
+ 		    filter => "(&(objectClass=posixAccount)$search)");
+ if ($rv->code) {
+-	&error(&text('search_err', "<tt>$search</tt>",
+-		     "<tt>$base</tt>", $rv->error));
++	&error(&text('search_err', "<tt>" . &html_escape($search) . "</tt>",
++		     "<tt>" . &html_escape($base) . "</tt>", $rv->error));
+ 	}
+ @users = $rv->all_entries;
+ 
diff --git a/sysutils/webmin/patches/patch-aw b/sysutils/webmin/patches/patch-aw
new file mode 100644
index 00000000000..74c16b27d0c
--- /dev/null
+++ b/sysutils/webmin/patches/patch-aw
@@ -0,0 +1,15 @@
+$NetBSD: patch-aw,v 1.1 2008/07/25 02:55:27 tonnerre Exp $
+
+--- ldap-useradmin/search_group.cgi.orig	2007-09-21 23:28:25.000000000 +0200
++++ ldap-useradmin/search_group.cgi
+@@ -23,8 +23,8 @@ elsif ($in{'match'} == 3) {
+ $rv = $ldap->search(base => $base,
+ 		    filter => "(&(objectClass=posixGroup)$search)");
+ if ($rv->code) {
+-	&error(&text('search_err', "<tt>$search</tt>",
+-		     "<tt>$base</tt>", $rv->error));
++	&error(&text('search_err', "<tt>" . &html_escape($search) . "</tt>",
++		     "<tt>" . &html_escape($base) . "</tt>", $rv->error));
+ 	}
+ @groups = $rv->all_entries;
+ 
diff --git a/sysutils/webmin/patches/patch-ax b/sysutils/webmin/patches/patch-ax
new file mode 100644
index 00000000000..00e77bffec8
--- /dev/null
+++ b/sysutils/webmin/patches/patch-ax
@@ -0,0 +1,48 @@
+$NetBSD: patch-ax,v 1.1 2008/07/25 02:55:27 tonnerre Exp $
+
+--- htaccess-htpasswd/search.cgi.orig	2007-09-21 23:28:30.000000000 +0200
++++ htaccess-htpasswd/search.cgi
+@@ -19,7 +19,8 @@ $in{'search'} =~ /^\// && $in{'search'} 
+ 
+ @dirs = &list_directories();
+ %got = map { ( "$_->[0]/$config{'htaccess'}", 1 ) } @dirs;
+-print "<b>",&text('search_doing', "<tt>$in{'search'}</tt>"),"</b><p>\n";
++print "<b>",&text('search_doing', "<tt>" . &html_escape($in{'search'}) .
++	"</tt>"), "</b><p>\n";
+ 
+ # Use the find command
+ &switch_user();
+@@ -28,24 +29,28 @@ open(FIND, "find ".quotemeta($in{'search
+ while($f = <FIND>) {
+ 	chop($f);
+ 	if ($got{$f}) {
+-		print &text('search_already', "<tt>$f</tt>"),"<br>\n";
++		print &text('search_already', "<tt>" . &html_escape($f) .
++			"</tt>"),"<br>\n";
+ 		}
+ 	elsif (!open(TEST, $f)) {
+-		print &text('search_open', "<tt>$f</tt>", $!),"<br>\n";
++		print &text('search_open', "<tt>" . &html_escape($f) . "</tt>",
++			$!),"<br>\n";
+ 		}
+ 	else {
+ 		$conf = &foreign_call($apachemod, "get_htaccess_config", $f);
+ 		$currfile = &foreign_call($apachemod, "find_directive",
+ 					  "AuthUserFile", $conf, 1);
+ 		if ($currfile) {
+-			print &text('search_found', "<tt>$f</tt>",
+-				    "<tt>$currfile</tt>"),"<br>\n";
++			print &text('search_found', "<tt>" . &html_escape($f) .
++				"</tt>", "<tt>" . &html_escape($currfile) .
++				"</tt>"),"<br>\n";
+ 			local $d = $f;
+ 			$d =~ s/\/$config{'htaccess'}$//;
+ 			push(@dirs, [ $d, $currfile ]);
+ 			}
+ 		else {
+-			print &text('search_noprot', "<tt>$f</tt>"),"<br>\n";
++			print &text('search_noprot', "<tt>" .
++				&html_escape($f) . "</tt>"),"<br>\n";
+ 			}
+ 		}
+ 	}
diff --git a/sysutils/webmin/patches/patch-ay b/sysutils/webmin/patches/patch-ay
new file mode 100644
index 00000000000..c97178ab744
--- /dev/null
+++ b/sysutils/webmin/patches/patch-ay
@@ -0,0 +1,50 @@
+$NetBSD: patch-ay,v 1.1 2008/07/25 02:55:28 tonnerre Exp $
+
+--- mailboxes/mail_search.cgi.orig	2007-09-21 23:28:31.000000000 +0200
++++ mailboxes/mail_search.cgi
+@@ -46,7 +46,8 @@ if ($in{'simple'}) {
+ 		@searchlist = ( [ $field, $what ] );
+ 		@rv = &mailbox_search_mail(\@searchlist, 0, $folder);
+ 		print "<p><b>",&text('search_results5', scalar(@rv),
+-			    "<tt>$field</tt>", "<tt>$what</tt>")," ..</b><p>\n";
++			    "<tt>" . &html_escape($field) . "</tt>", "<tt>" .
++			    &html_escape($what) . "</tt>")," ..</b><p>\n";
+ 		}
+ 	else {
+ 		# Just search by Subject and From in one folder
+@@ -73,7 +74,8 @@ if ($in{'simple'}) {
+ 			&error($text{'search_eboolean'});
+ 			}
+ 		print "<p><b>",&text('search_results2', scalar(@rv),
+-				     "<tt>$in{'search'}</tt>")," ..</b><p>\n";
++				     "<tt>" . &html_escape($in{'search'}) .
++				     "</tt>")," ..</b><p>\n";
+ 		}
+ 	foreach $mail (@rv) {
+ 		$mail->{'folder'} = $folder;
+@@ -106,8 +108,10 @@ else {
+ $showto = $folder->{'sent'} || $folder->{'drafts'};
+ if (@rv) {
+ 	print "<form action=delete_mail.cgi method=post>\n";
+-	print "<input type=hidden name=folder value='$in{'folder'}'>\n";
+-	print "<input type=hidden name=user value='$in{'user'}'>\n";
++	print "<input type=hidden name=folder value='" .
++		&html_escape($in{'folder'}) . "'>\n";
++	print "<input type=hidden name=user value='" .
++		&html_escape($in{'user'}) . "'>\n";
+ 	if ($config{'top_buttons'}) {
+ 		if (!$multi_folder) {
+ 			&show_buttons(1, \@folders, $folder, \@rv, $in{'user'},
+@@ -200,8 +204,9 @@ else {
+ 	print "<b>$text{'search_none'}</b> <p>\n";
+ 	}
+ 
+-&ui_print_footer($in{'simple'} ? ( ) : ( "search_form.cgi?folder=$in{'folder'}",
+-				$text{'sform_return'} ),
+-	"list_mail.cgi?user=$in{'user'}&folder=$in{'folder'}", $text{'mail_return'},
++&ui_print_footer($in{'simple'} ? ( ) : ( "search_form.cgi?folder=" .
++	&urlize($in{'folder'}), $text{'sform_return'} ),
++	"list_mail.cgi?user=" . &urlize($in{'user'}) . "&folder=" .
++	&urlize($in{'folder'}), $text{'mail_return'},
+ 	"", $text{'index_return'});
+ 
diff --git a/sysutils/webmin/patches/patch-az b/sysutils/webmin/patches/patch-az
new file mode 100644
index 00000000000..e5a6d39e11d
--- /dev/null
+++ b/sysutils/webmin/patches/patch-az
@@ -0,0 +1,28 @@
+$NetBSD: patch-az,v 1.1 2008/07/25 02:55:28 tonnerre Exp $
+
+--- mailboxes/search_form.cgi.orig	2007-09-21 23:28:31.000000000 +0200
++++ mailboxes/search_form.cgi
+@@ -12,8 +12,10 @@ require './mailboxes-lib.pl';
+ 	&folder_link($in{'user'}, $folder));
+ 
+ print "<form action=mail_search.cgi>\n";
+-print "<input type=hidden name=user value='$in{'user'}'>\n";
+-print "<input type=hidden name=ofolder value='$in{'folder'}'>\n";
++print "<input type=hidden name=user value='" . &html_escape($in{'user'}) .
++	"'>\n";
++print "<input type=hidden name=ofolder value='" . &html_escape($in{'folder'}) .
++	"'>\n";
+ print "<input type=radio name=and value=1 checked> $text{'sform_and'}\n";
+ print "<input type=radio name=and value=0> $text{'sform_or'}<p>\n";
+ 
+@@ -48,7 +50,7 @@ print " $text{'sform_folder'} ",&folder_
+ 					       $extra);
+ print "</form>\n";
+ 
+-&ui_print_footer("list_mail.cgi?folder=$in{'folder'}&user=".
+-		  &urlize($in{'user'}), $text{'mail_return'},
+-		 "", $text{'index_return'});
++&ui_print_footer("list_mail.cgi?folder=" . &urlize($in{'folder'}) . "&user=".
++		  &urlize($in{'user'}), $text{'mail_return'}, "",
++		  $text{'index_return'});
+