Bugtraq: "Cross-site scripting (XSS) vulnerability in search.php of Gallery 1.1 through 1.3.4 allows remote attackers to insert arbitrary web script via the searchstring parameter." Fix: Update to version 1.3.4-pl1.
Does PORTREVISION really need to be set? PORTVERSION *is* changing. Otherwise patch is great - thanks Thomas! -- Jamie
State Changed From-To: open->closed Committed, thanks.
pkg_version sees this update as downgrade: gallery-1.3.4 > succeeds port (port has pl1) This is because the PORTVERSION has a '-' in it. I suggest removing this dash. Due to the use of webmail, tabs have been converted to spaces (and attached text files get encoded like binaries, so you're screwed either way) -- please don't apply this diff directly: $ diff -u Makefile.orig Makefile --- Makefile.orig Tue Sep 2 20:41:43 2003 +++ Makefile Wed Sep 3 15:05:38 2003 @@ -6,7 +6,7 @@ # PORTNAME= gallery -PORTVERSION= 1.3.4-pl1 +PORTVERSION= 1.3.4pl1 CATEGORIES= www MASTER_SITES= ${MASTER_SITE_SOURCEFORGE} MASTER_SITE_SUBDIR= ${PORTNAME}
Then again, may we want to be able to fetch... *blush* Maybe a bump in PORTEPOCH?
PORTREVISION bump still didn't fix pkg_version seeing this as a downgrade: gallery-1.3.4 > succeeds port (port has pl1_1)
On Wed, Sep 03, 2003 at 07:20:09PM -0500, Jon Noack wrote: > PORTREVISION bump still didn't fix pkg_version seeing this as a downgrade: > gallery-1.3.4 > succeeds port (port has pl1_1) > OK - this one works. I'm sure this breaks 'the rules', but I can't think of a better way to make this work with the version scheme they chose to use for the gallery patch. # pkg_version -v | grep gallery gallery-1.3.4 < needs updating (port has 1.3.4pl1) diff -ruN gallery/Makefile gallery-new/Makefile --- gallery/Makefile Wed Sep 3 16:14:22 2003 +++ gallery-new/Makefile Wed Sep 3 20:02:00 2003 @@ -6,8 +6,8 @@ # PORTNAME= gallery -PORTVERSION= 1.3.4-pl1 -PORTREVISION= 1 +PORTVERSION= 1.3.4pl1 +DISTFILES= gallery-1.3.4-pl1.tar.gz CATEGORIES= www MASTER_SITES= ${MASTER_SITE_SOURCEFORGE} MASTER_SITE_SUBDIR= ${PORTNAME} -- Jamie
On Wed, Sep 03, 2003 at 08:10:53PM -0600, Jamie Hermans wrote: > On Wed, Sep 03, 2003 at 07:20:09PM -0500, Jon Noack wrote: > > PORTREVISION bump still didn't fix pkg_version seeing this as a downgrade: > > gallery-1.3.4 > succeeds port (port has pl1_1) > > > > OK - this one works. I'm sure this breaks 'the rules', but I can't > think of a better way to make this work with the version scheme they > chose to use for the gallery patch. > > # pkg_version -v | grep gallery > gallery-1.3.4 < needs updating (port has 1.3.4pl1) portlint tells me it's illegal: FATAL: PORTVERSION looks illegal. should modify "1.3.4pl1". How about the attached patch file? -- Yen-Ming Lee [§õ«Û©ú] KeyID: 0x5EB52E51 : www.leeym.com : Taipei, Taiwan
On Thu, Sep 04, 2003 at 11:18:55AM +0800, Yen-Ming Lee wrote: > On Wed, Sep 03, 2003 at 08:10:53PM -0600, Jamie Hermans wrote: > > On Wed, Sep 03, 2003 at 07:20:09PM -0500, Jon Noack wrote: > > > PORTREVISION bump still didn't fix pkg_version seeing this as a downgrade: > > > gallery-1.3.4 > succeeds port (port has pl1_1) > > > > > > > OK - this one works. I'm sure this breaks 'the rules', but I can't > > think of a better way to make this work with the version scheme they > > chose to use for the gallery patch. > > > > # pkg_version -v | grep gallery > > gallery-1.3.4 < needs updating (port has 1.3.4pl1) > > portlint tells me it's illegal: > FATAL: PORTVERSION looks illegal. should modify "1.3.4pl1". > > How about the attached patch file? This just gets more and more complicated :) Looks good ... and works here as well. -- Jamie