Attachment #202597 for bug #236284

View | Details | Raw Unified | Return to bug 236284
Collapse All | Expand All




# Created by: Yuan-Chung Hsiao (ychsiao@ychsiao.idv.tw)
# $FreeBSD$

PORTNAME=	websvn
PORTVERSION=	2.4
PORTREVISION=	1
CATEGORIES=	devel www
PKGNAMESUFFIX=	${PHP_PKGNAMESUFFIX}

MAINTAINER=	michael.osipov@siemens.com
COMMENT=	Online Subversion repository browser

LICENSE=	GPLv2
LICENSE_FILE=	${WRKSRC}/license.txt

RUN_DEPENDS=	${LOCALBASE}/bin/svn:devel/subversion \
		${PEARDIR}/Archive/Tar.php:devel/pear@${PHP_FLAVOR} \
		${PEARDIR}/geshi.php:devel/pear-geshi@${PHP_FLAVOR} \
		${PEARDIR}/Text/Diff.php:devel/pear-Text_Diff@${PHP_FLAVOR}

USES=		php:flavors cpe
USE_GITHUB=	yes
GH_ACCOUNT=	${PORTNAME}php

USE_PHP=	iconv pcre xml mbstring

NO_BUILD=	yes
NO_ARCH=	yes

PEARDIR?=	${LOCALBASE}/share/pear

SUB_FILES=	pkg-message
PLIST_SUB+=	WWWOWN=${WWWOWN} WWWGRP=${WWWGRP}
PLIST_SUB+=	WEBSVNDIR="${WEBSVNDIR}"

post-patch:
	@${REINPLACE_CMD} -E \
		-e 's|^// \$$config->setSvnConfigDir.+|$$config->setSvnConfigDir('"'"'${ETCDIR}/subversion'"'"')\;|' \
		-e 's|^// \$$config->setSVNCommandPath.+|$$config->setSVNCommandPath('"'"'${LOCALBASE}/bin'"'"')\;|' \
		-e 's|^// \$$config->useGeshi.+|$$config->useGeshi()\;|' \
	${WRKSRC}/include/distconfig.php

do-install:
	@(cd ${WRKSRC} \
		&& ${RM} README.md changes.txt include/.gitignore)
	@${MKDIR} ${STAGEDIR}${WWWDIR}
	@(cd ${WRKSRC} \
		&& ${COPYTREE_SHARE} . ${STAGEDIR}${WWWDIR})

post-install:
	@${MKDIR} ${STAGEDIR}${ETCDIR}/subversion

.include <bsd.port.mk>

Lines 1-2 Link Here

(-)devel/websvn/distinfo (-2 / +3 lines)
1	SHA256 (websvn-2.3.3.tar.gz) = 67d5cb7ffb087f8a92e3dcad10f16612baac4d15a60d659aa8b6e06200ac8742	1	TIMESTAMP = 1551703252
2	SIZE (websvn-2.3.3.tar.gz) = 882779	2	SHA256 (websvnphp-websvn-2.4_GH0.tar.gz) = a6a06c957b48b909d1eb09b313255e0903bfbe39bbfdafc80b920c4108791b0a
		3	SIZE (websvnphp-websvn-2.4_GH0.tar.gz) = 209331




Arbitrary files with a known path can be accessed in websvn by committing a
symlink to a repository and then downloading the file (using the download
link).

Author: Thijs Kinkhorst <thijs@debian.org>

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775682
--- dl.php.orig	2011-06-27 09:02:52 UTC
+++ dl.php
@@ -137,6 +137,18 @@ if ($rep) {
 		exit(0);
 	}
 
+	// For security reasons, disallow direct downloads of filenames that
+	// are a symlink, since they may be a symlink to anywhere (/etc/passwd)
+	// Deciding whether the symlink is relative and legal within the
+	// repository would be nice but seems to error prone at this moment.
+	if ( is_link($tempDir.DIRECTORY_SEPARATOR.$archiveName) ) {
+		header('HTTP/1.x 500 Internal Server Error', true, 500);
+		error_log('to be downloaded file is symlink, aborting: '.$archiveName);
+		print 'Download of symlinks disallowed: "'.xml_entities($archiveName).'".';
+		removeDirectory($tempDir);
+		exit(0);
+	}
+
 	// Set timestamp of exported directory (and subdirectories) to timestamp of
 	// the revision so every archive of a given revision has the same timestamp.
 	$revDate = $logEntry->date;
@@ -180,7 +192,7 @@ if ($rep) {
 		$downloadMimeType = 'application/x-zip';
 		$downloadArchive .= '.zip';
 		// Create zip file
-		$cmd = $config->zip.' -r '.quote($downloadArchive).' '.quote($archiveName);
+		$cmd = $config->zip.' --symlinks -r '.quote($downloadArchive).' '.quote($archiveName);
 		execCommand($cmd, $retcode);
 		if ($retcode != 0) {
 			error_log('Unable to call zip command: '.$cmd);




Obtained from: Debian
--- include/setup.php.orig	2011-06-27 09:12:51 UTC
+++ include/setup.php
@@ -467,7 +467,7 @@ $vars['indexurl'] = $config->getURL('', 
 $vars['validationurl'] = getFullURL($_SERVER['SCRIPT_NAME']).'?'.buildQuery($queryParams + array('template' => $template, 'language' => $language), '%26');
 
 // To avoid a possible XSS exploit, need to clean up the passed-in path first
-$path = !empty($_REQUEST['path']) ? $_REQUEST['path'] : null;
+$path = !empty($_REQUEST['path']) ? escape($_REQUEST['path']) : null;
 if ($path === null || $path === '')
 	$path = '/';
 $vars['safepath'] = escape($path);

Lines 1-4 Link Here

(-)devel/websvn/files/pkg-message.in (-2 / +5 lines)
1	----------------------------------------------------	1	----------------------------------------------------
2	To setup websvn, please edit the configuration file:	2	To setup WebSVN, please edit the configuration file:
3	%%PREFIX%%/%%WEBSVNDIR%%/include/config.php	3	%%WWWDIR%%/include/config.php
		4
		5	and modify your web server's configuration to serve
		6	WebSVN actually!
4	----------------------------------------------------	7	----------------------------------------------------

Lines 1-7 Link Here

(-)devel/websvn/pkg-descr (-3 / +3 lines)
1	WebSVN offers a view onto your subversion repositories that's been designed	1	WebSVN offers a view onto your Subversion repositories that's been designed
2	to reflect the Subversion methodology. You can view the log of any file or	2	to reflect the Subversion methodology. You can view the log of any file or
3	directory and see a list of all the files changed, added or deleted in any	3	directory and see a list of all the files changed, added or deleted in any
4	given revision. You can also view the differences between 2 versions of	4	given revision. You can also view the differences between two versions of
5	a file so as to see exactly what was changed in a particular revision.	5	a file so as to see exactly what was changed in a particular revision.
6		6
7	WWW: http://websvn.info/	7	WWW: https://websvnphp.github.io/




%%WWWDIR%%/blame.php
%%WWWDIR%%/browse.php
%%WWWDIR%%/cache/tmp
%%WWWDIR%%/comp.php
%%WWWDIR%%/diff.php
%%WWWDIR%%/dl.php
%%WWWDIR%%/filedetails.php
%%WWWDIR%%/include/authz.php
%%WWWDIR%%/include/bugtraq.php
%%WWWDIR%%/include/command.php
%%WWWDIR%%/include/configclass.php
%%WWWDIR%%/include/diff_inc.php
%%WWWDIR%%/include/diff_util.php
@sample(,%%WWWGRP%%,640) %%WWWDIR%%/include/distconfig.php %%WWWDIR%%/include/config.php
%%WWWDIR%%/include/header
%%WWWDIR%%/include/setup.php
%%WWWDIR%%/include/svnlook.php
%%WWWDIR%%/include/template.php
%%WWWDIR%%/include/utils.php
%%WWWDIR%%/include/version.php
%%WWWDIR%%/index.php
%%WWWDIR%%/javascript/blame-popup.js
%%WWWDIR%%/javascript/compare-checkboxes.js
%%WWWDIR%%/javascript/group-collapse.js
%%WWWDIR%%/javascript/ie-png-transparency.js
%%WWWDIR%%/languages/catalan.php
%%WWWDIR%%/languages/chinese-simplified.php
%%WWWDIR%%/languages/chinese-traditional.php
%%WWWDIR%%/languages/czech.php
%%WWWDIR%%/languages/danish.php
%%WWWDIR%%/languages/dutch.php
%%WWWDIR%%/languages/english.php
%%WWWDIR%%/languages/finnish.php
%%WWWDIR%%/languages/french.php
%%WWWDIR%%/languages/german.php
%%WWWDIR%%/languages/hebrew.php
%%WWWDIR%%/languages/hindi.php
%%WWWDIR%%/languages/hungarian.php
%%WWWDIR%%/languages/indonesian.php
%%WWWDIR%%/languages/italian.php
%%WWWDIR%%/languages/japanese.php
%%WWWDIR%%/languages/korean.php
%%WWWDIR%%/languages/languages.php
%%WWWDIR%%/languages/macedonian.php
%%WWWDIR%%/languages/marathi.php
%%WWWDIR%%/languages/norwegian.php
%%WWWDIR%%/languages/polish.php
%%WWWDIR%%/languages/portuguese-br.php
%%WWWDIR%%/languages/portuguese.php
%%WWWDIR%%/languages/russian.php
%%WWWDIR%%/languages/slovak.php
%%WWWDIR%%/languages/slovenian.php
%%WWWDIR%%/languages/spanish.php
%%WWWDIR%%/languages/swedish.php
%%WWWDIR%%/languages/turkish.php
%%WWWDIR%%/languages/ukrainian.php
%%WWWDIR%%/languages/uzbek.php
%%WWWDIR%%/license.txt
%%WWWDIR%%/listing.php
%%WWWDIR%%/log.php
%%WWWDIR%%/multiviews.php
%%WWWDIR%%/revision.php
%%WWWDIR%%/rss.php
%%WWWDIR%%/templates/BlueGrey/blame.tmpl
%%WWWDIR%%/templates/BlueGrey/compare.tmpl
%%WWWDIR%%/templates/BlueGrey/diff.tmpl
%%WWWDIR%%/templates/BlueGrey/directory.tmpl
%%WWWDIR%%/templates/BlueGrey/file.tmpl
%%WWWDIR%%/templates/BlueGrey/footer.tmpl
%%WWWDIR%%/templates/BlueGrey/header.tmpl
%%WWWDIR%%/templates/BlueGrey/images/e-node.png
%%WWWDIR%%/templates/BlueGrey/images/favicon.ico
%%WWWDIR%%/templates/BlueGrey/images/file.png
%%WWWDIR%%/templates/BlueGrey/images/filec.png
%%WWWDIR%%/templates/BlueGrey/images/filecpp.png
%%WWWDIR%%/templates/BlueGrey/images/fileh.png
%%WWWDIR%%/templates/BlueGrey/images/filehtml.png
%%WWWDIR%%/templates/BlueGrey/images/filejava.png
%%WWWDIR%%/templates/BlueGrey/images/filem.png
%%WWWDIR%%/templates/BlueGrey/images/filepy.png
%%WWWDIR%%/templates/BlueGrey/images/folder-open.png
%%WWWDIR%%/templates/BlueGrey/images/folder.png
%%WWWDIR%%/templates/BlueGrey/images/i-node.png
%%WWWDIR%%/templates/BlueGrey/images/l-node.png
%%WWWDIR%%/templates/BlueGrey/images/repo.png
%%WWWDIR%%/templates/BlueGrey/images/rss.gif
%%WWWDIR%%/templates/BlueGrey/images/t-node.png
%%WWWDIR%%/templates/BlueGrey/images/websvn.png
%%WWWDIR%%/templates/BlueGrey/index.tmpl
%%WWWDIR%%/templates/BlueGrey/log.tmpl
%%WWWDIR%%/templates/BlueGrey/revision.tmpl
%%WWWDIR%%/templates/BlueGrey/styles.css
%%WWWDIR%%/templates/Elegant/blame.tmpl
%%WWWDIR%%/templates/Elegant/compare.tmpl
%%WWWDIR%%/templates/Elegant/diff.tmpl
%%WWWDIR%%/templates/Elegant/directory.tmpl
%%WWWDIR%%/templates/Elegant/file.tmpl
%%WWWDIR%%/templates/Elegant/footer.tmpl
%%WWWDIR%%/templates/Elegant/header.tmpl
%%WWWDIR%%/templates/Elegant/images/README.txt
%%WWWDIR%%/templates/Elegant/images/added.png
%%WWWDIR%%/templates/Elegant/images/arrow-in.png
%%WWWDIR%%/templates/Elegant/images/arrow-out.png
%%WWWDIR%%/templates/Elegant/images/bg-gray-dark.png
%%WWWDIR%%/templates/Elegant/images/bg-gray-light.png
%%WWWDIR%%/templates/Elegant/images/bg-page-header.png
%%WWWDIR%%/templates/Elegant/images/bg-table-divider.png
%%WWWDIR%%/templates/Elegant/images/bg-table-header.png
%%WWWDIR%%/templates/Elegant/images/blame.png
%%WWWDIR%%/templates/Elegant/images/blank.png
%%WWWDIR%%/templates/Elegant/images/cube-blue.png
%%WWWDIR%%/templates/Elegant/images/deleted.png
%%WWWDIR%%/templates/Elegant/images/detail.png
%%WWWDIR%%/templates/Elegant/images/diff.png
%%WWWDIR%%/templates/Elegant/images/download.png
%%WWWDIR%%/templates/Elegant/images/eye.png
%%WWWDIR%%/templates/Elegant/images/favicon.ico
%%WWWDIR%%/templates/Elegant/images/file-c.png
%%WWWDIR%%/templates/Elegant/images/file-cpp.png
%%WWWDIR%%/templates/Elegant/images/file-css.png
%%WWWDIR%%/templates/Elegant/images/file-h.png
%%WWWDIR%%/templates/Elegant/images/file-html.png
%%WWWDIR%%/templates/Elegant/images/file-image.png
%%WWWDIR%%/templates/Elegant/images/file-java.png
%%WWWDIR%%/templates/Elegant/images/file-m.png
%%WWWDIR%%/templates/Elegant/images/file-php.png
%%WWWDIR%%/templates/Elegant/images/file-py.png
%%WWWDIR%%/templates/Elegant/images/file-xml.png
%%WWWDIR%%/templates/Elegant/images/file.png
%%WWWDIR%%/templates/Elegant/images/folder.png
%%WWWDIR%%/templates/Elegant/images/home.png
%%WWWDIR%%/templates/Elegant/images/information.png
%%WWWDIR%%/templates/Elegant/images/log.png
%%WWWDIR%%/templates/Elegant/images/modified.png
%%WWWDIR%%/templates/Elegant/images/next.png
%%WWWDIR%%/templates/Elegant/images/parent.png
%%WWWDIR%%/templates/Elegant/images/pilcrow.png
%%WWWDIR%%/templates/Elegant/images/previous.png
%%WWWDIR%%/templates/Elegant/images/remove.png
%%WWWDIR%%/templates/Elegant/images/repository.png
%%WWWDIR%%/templates/Elegant/images/repository24.png
%%WWWDIR%%/templates/Elegant/images/reverse.png
%%WWWDIR%%/templates/Elegant/images/revision.png
%%WWWDIR%%/templates/Elegant/images/rss.png
%%WWWDIR%%/templates/Elegant/images/stop.png
%%WWWDIR%%/templates/Elegant/images/subversion-s.png
%%WWWDIR%%/templates/Elegant/images/valid.png
%%WWWDIR%%/templates/Elegant/images/warning.png
%%WWWDIR%%/templates/Elegant/images/youngest.png
%%WWWDIR%%/templates/Elegant/index.tmpl
%%WWWDIR%%/templates/Elegant/log.tmpl
%%WWWDIR%%/templates/Elegant/revision-popup.js
%%WWWDIR%%/templates/Elegant/revision.tmpl
%%WWWDIR%%/templates/Elegant/styles.css
@sample %%WWWDIR%%/templates/Elegant/user_greeting.tmpl %%WWWDIR%%/templates/Elegant/user_greeting.tmpl.sample
%%WWWDIR%%/templates/calm/README.txt
%%WWWDIR%%/templates/calm/blame.tmpl
%%WWWDIR%%/templates/calm/compare.tmpl
%%WWWDIR%%/templates/calm/diff.tmpl
%%WWWDIR%%/templates/calm/directory.tmpl
%%WWWDIR%%/templates/calm/file.tmpl
%%WWWDIR%%/templates/calm/footer.tmpl
%%WWWDIR%%/templates/calm/header.tmpl
%%WWWDIR%%/templates/calm/images/add.png
%%WWWDIR%%/templates/calm/images/arrow_in.png
%%WWWDIR%%/templates/calm/images/arrow_out.png
%%WWWDIR%%/templates/calm/images/blame.png
%%WWWDIR%%/templates/calm/images/bullet_add.png
%%WWWDIR%%/templates/calm/images/bullet_delete.png
%%WWWDIR%%/templates/calm/images/bullet_yellow.png
%%WWWDIR%%/templates/calm/images/compress.png
%%WWWDIR%%/templates/calm/images/css.png
%%WWWDIR%%/templates/calm/images/cube_green.png
%%WWWDIR%%/templates/calm/images/delete.png
%%WWWDIR%%/templates/calm/images/diff.png
%%WWWDIR%%/templates/calm/images/e-node.png
%%WWWDIR%%/templates/calm/images/exclamation.png
%%WWWDIR%%/templates/calm/images/eye.png
%%WWWDIR%%/templates/calm/images/favicon.ico
%%WWWDIR%%/templates/calm/images/file.png
%%WWWDIR%%/templates/calm/images/filec.png
%%WWWDIR%%/templates/calm/images/filedb.png
%%WWWDIR%%/templates/calm/images/fileh.png
%%WWWDIR%%/templates/calm/images/filepaint.png
%%WWWDIR%%/templates/calm/images/filephp.png
%%WWWDIR%%/templates/calm/images/filetxt.png
%%WWWDIR%%/templates/calm/images/filexml.png
%%WWWDIR%%/templates/calm/images/folder.png
%%WWWDIR%%/templates/calm/images/html.png
%%WWWDIR%%/templates/calm/images/i-node.png
%%WWWDIR%%/templates/calm/images/l-node.png
%%WWWDIR%%/templates/calm/images/link.png
%%WWWDIR%%/templates/calm/images/log.png
%%WWWDIR%%/templates/calm/images/next.png
%%WWWDIR%%/templates/calm/images/page_white_add.png
%%WWWDIR%%/templates/calm/images/page_white_delete.png
%%WWWDIR%%/templates/calm/images/page_white_edit.png
%%WWWDIR%%/templates/calm/images/pilcrow.png
%%WWWDIR%%/templates/calm/images/pilcrow_delete.png
%%WWWDIR%%/templates/calm/images/previous.png
%%WWWDIR%%/templates/calm/images/script.png
%%WWWDIR%%/templates/calm/images/sitemap_color.png
%%WWWDIR%%/templates/calm/images/submitbg.png
%%WWWDIR%%/templates/calm/images/t-node.png
%%WWWDIR%%/templates/calm/images/textbg.png
%%WWWDIR%%/templates/calm/images/toggledown.png
%%WWWDIR%%/templates/calm/images/toggleup.png
%%WWWDIR%%/templates/calm/images/up.png
%%WWWDIR%%/templates/calm/images/xml.gif
%%WWWDIR%%/templates/calm/index.tmpl
%%WWWDIR%%/templates/calm/log.tmpl
%%WWWDIR%%/templates/calm/revision.tmpl
%%WWWDIR%%/templates/calm/styles.css
@sample %%WWWDIR%%/templates/calm/user_greeting.tmpl %%WWWDIR%%/templates/calm/user_greeting.tmpl.sample
@postunexec echo "==> If your are permanently removing this package consider deleting %%PREFIX%%/%%ETCDIR%%!"
@dir(%%WWWOWN%%,%%WWWGRP%%,) %%ETCDIR%%/subversion
@dir %%ETCDIR%%
%%WEBSVNDIR%%/lib/geshi/python.php
%%WEBSVNDIR%%/lib/geshi/q.php
%%WEBSVNDIR%%/lib/geshi/qbasic.php
%%WEBSVNDIR%%/lib/geshi/rails.php
%%WEBSVNDIR%%/lib/geshi/rebol.php
%%WEBSVNDIR%%/lib/geshi/reg.php
%%WEBSVNDIR%%/lib/geshi/robots.php
%%WEBSVNDIR%%/lib/geshi/rpmspec.php
%%WEBSVNDIR%%/lib/geshi/rsplus.php
%%WEBSVNDIR%%/lib/geshi/ruby.php
%%WEBSVNDIR%%/lib/geshi/sas.php
%%WEBSVNDIR%%/lib/geshi/scala.php
%%WEBSVNDIR%%/lib/geshi/scheme.php
%%WEBSVNDIR%%/lib/geshi/scilab.php
%%WEBSVNDIR%%/lib/geshi/sdlbasic.php
%%WEBSVNDIR%%/lib/geshi/smalltalk.php
%%WEBSVNDIR%%/lib/geshi/smarty.php
%%WEBSVNDIR%%/lib/geshi/sql.php
%%WEBSVNDIR%%/lib/geshi/systemverilog.php
%%WEBSVNDIR%%/lib/geshi/tcl.php
%%WEBSVNDIR%%/lib/geshi/teraterm.php
%%WEBSVNDIR%%/lib/geshi/text.php
%%WEBSVNDIR%%/lib/geshi/thinbasic.php
%%WEBSVNDIR%%/lib/geshi/tsql.php
%%WEBSVNDIR%%/lib/geshi/typoscript.php
%%WEBSVNDIR%%/lib/geshi/unicon.php
%%WEBSVNDIR%%/lib/geshi/vala.php
%%WEBSVNDIR%%/lib/geshi/vb.php
%%WEBSVNDIR%%/lib/geshi/vbnet.php
%%WEBSVNDIR%%/lib/geshi/verilog.php
%%WEBSVNDIR%%/lib/geshi/vhdl.php
%%WEBSVNDIR%%/lib/geshi/vim.php
%%WEBSVNDIR%%/lib/geshi/visualfoxpro.php
%%WEBSVNDIR%%/lib/geshi/visualprolog.php
%%WEBSVNDIR%%/lib/geshi/whitespace.php
%%WEBSVNDIR%%/lib/geshi/whois.php
%%WEBSVNDIR%%/lib/geshi/winbatch.php
%%WEBSVNDIR%%/lib/geshi/xbasic.php
%%WEBSVNDIR%%/lib/geshi/xml.php
%%WEBSVNDIR%%/lib/geshi/xorg_conf.php
%%WEBSVNDIR%%/lib/geshi/xpp.php
%%WEBSVNDIR%%/lib/geshi/z80.php
%%WEBSVNDIR%%/lib/geshi/zxbasic.php
%%WEBSVNDIR%%/lib/geshi.php
%%WEBSVNDIR%%/lib/pear/Archive/Tar.php
%%WEBSVNDIR%%/lib/pear/PEAR.php
%%WEBSVNDIR%%/lib/pear/Text/Diff/Engine/native.php
%%WEBSVNDIR%%/lib/pear/Text/Diff/Engine/shell.php
%%WEBSVNDIR%%/lib/pear/Text/Diff/Engine/string.php
%%WEBSVNDIR%%/lib/pear/Text/Diff/Engine/xdiff.php
%%WEBSVNDIR%%/lib/pear/Text/Diff/Mapped.php
%%WEBSVNDIR%%/lib/pear/Text/Diff/Renderer/context.php
%%WEBSVNDIR%%/lib/pear/Text/Diff/Renderer/inline.php
%%WEBSVNDIR%%/lib/pear/Text/Diff/Renderer/unified.php
%%WEBSVNDIR%%/lib/pear/Text/Diff/Renderer.php
%%WEBSVNDIR%%/lib/pear/Text/Diff/ThreeWay.php
%%WEBSVNDIR%%/lib/pear/Text/Diff.php
%%WEBSVNDIR%%/lib/pear/Text/Diff3.php
%%WEBSVNDIR%%/license.txt
%%WEBSVNDIR%%/listing.php
%%WEBSVNDIR%%/log.php
%%WEBSVNDIR%%/revision.php
%%WEBSVNDIR%%/rss.php
%%WEBSVNDIR%%/templates/BlueGrey/blame.tmpl
%%WEBSVNDIR%%/templates/BlueGrey/compare.tmpl
%%WEBSVNDIR%%/templates/BlueGrey/diff.tmpl
%%WEBSVNDIR%%/templates/BlueGrey/directory.tmpl
%%WEBSVNDIR%%/templates/BlueGrey/file.tmpl
%%WEBSVNDIR%%/templates/BlueGrey/footer.tmpl
%%WEBSVNDIR%%/templates/BlueGrey/header.tmpl
%%WEBSVNDIR%%/templates/BlueGrey/images/e-node.png
%%WEBSVNDIR%%/templates/BlueGrey/images/favicon.ico
%%WEBSVNDIR%%/templates/BlueGrey/images/file.png
%%WEBSVNDIR%%/templates/BlueGrey/images/filec.png
%%WEBSVNDIR%%/templates/BlueGrey/images/filecpp.png
%%WEBSVNDIR%%/templates/BlueGrey/images/fileh.png
%%WEBSVNDIR%%/templates/BlueGrey/images/filehtml.png
%%WEBSVNDIR%%/templates/BlueGrey/images/filejava.png
%%WEBSVNDIR%%/templates/BlueGrey/images/filem.png
%%WEBSVNDIR%%/templates/BlueGrey/images/filepy.png
%%WEBSVNDIR%%/templates/BlueGrey/images/files.png
%%WEBSVNDIR%%/templates/BlueGrey/images/folder-open.png
%%WEBSVNDIR%%/templates/BlueGrey/images/folder.png
%%WEBSVNDIR%%/templates/BlueGrey/images/i-node.png
%%WEBSVNDIR%%/templates/BlueGrey/images/l-node.png
%%WEBSVNDIR%%/templates/BlueGrey/images/repo.png
%%WEBSVNDIR%%/templates/BlueGrey/images/rss.gif
%%WEBSVNDIR%%/templates/BlueGrey/images/t-node.png
%%WEBSVNDIR%%/templates/BlueGrey/images/websvn.png
%%WEBSVNDIR%%/templates/BlueGrey/index.tmpl
%%WEBSVNDIR%%/templates/BlueGrey/log.tmpl
%%WEBSVNDIR%%/templates/BlueGrey/png.js
%%WEBSVNDIR%%/templates/BlueGrey/revision.tmpl
%%WEBSVNDIR%%/templates/BlueGrey/styles.css
%%WEBSVNDIR%%/templates/Elegant/blame.tmpl
%%WEBSVNDIR%%/templates/Elegant/compare.tmpl
%%WEBSVNDIR%%/templates/Elegant/diff.tmpl
%%WEBSVNDIR%%/templates/Elegant/directory.tmpl
%%WEBSVNDIR%%/templates/Elegant/file.tmpl
%%WEBSVNDIR%%/templates/Elegant/footer.tmpl
%%WEBSVNDIR%%/templates/Elegant/header.tmpl
%%WEBSVNDIR%%/templates/Elegant/images/README.txt
%%WEBSVNDIR%%/templates/Elegant/images/added.png
%%WEBSVNDIR%%/templates/Elegant/images/arrow-in.png
%%WEBSVNDIR%%/templates/Elegant/images/arrow-out.png
%%WEBSVNDIR%%/templates/Elegant/images/bg-gray-dark.png
%%WEBSVNDIR%%/templates/Elegant/images/bg-gray-light.png
%%WEBSVNDIR%%/templates/Elegant/images/bg-page-header.png
%%WEBSVNDIR%%/templates/Elegant/images/bg-table-divider.png
%%WEBSVNDIR%%/templates/Elegant/images/bg-table-header.png
%%WEBSVNDIR%%/templates/Elegant/images/blame.png
%%WEBSVNDIR%%/templates/Elegant/images/blank.png
%%WEBSVNDIR%%/templates/Elegant/images/cube-blue.png
%%WEBSVNDIR%%/templates/Elegant/images/deleted.png
%%WEBSVNDIR%%/templates/Elegant/images/detail.png
%%WEBSVNDIR%%/templates/Elegant/images/diff.png
%%WEBSVNDIR%%/templates/Elegant/images/download.png
%%WEBSVNDIR%%/templates/Elegant/images/eye.png
%%WEBSVNDIR%%/templates/Elegant/images/favicon.ico
%%WEBSVNDIR%%/templates/Elegant/images/file-c.png
%%WEBSVNDIR%%/templates/Elegant/images/file-cpp.png
%%WEBSVNDIR%%/templates/Elegant/images/file-css.png
%%WEBSVNDIR%%/templates/Elegant/images/file-h.png
%%WEBSVNDIR%%/templates/Elegant/images/file-html.png
%%WEBSVNDIR%%/templates/Elegant/images/file-image.png
%%WEBSVNDIR%%/templates/Elegant/images/file-java.png
%%WEBSVNDIR%%/templates/Elegant/images/file-m.png
%%WEBSVNDIR%%/templates/Elegant/images/file-php.png
%%WEBSVNDIR%%/templates/Elegant/images/file-py.png
%%WEBSVNDIR%%/templates/Elegant/images/file-xml.png
%%WEBSVNDIR%%/templates/Elegant/images/file.png
%%WEBSVNDIR%%/templates/Elegant/images/folder.png
%%WEBSVNDIR%%/templates/Elegant/images/home.png
%%WEBSVNDIR%%/templates/Elegant/images/information.png
%%WEBSVNDIR%%/templates/Elegant/images/log.png
%%WEBSVNDIR%%/templates/Elegant/images/modified.png
%%WEBSVNDIR%%/templates/Elegant/images/next.png
%%WEBSVNDIR%%/templates/Elegant/images/parent.png
%%WEBSVNDIR%%/templates/Elegant/images/pilcrow.png
%%WEBSVNDIR%%/templates/Elegant/images/previous.png
%%WEBSVNDIR%%/templates/Elegant/images/remove.png
%%WEBSVNDIR%%/templates/Elegant/images/repository.png
%%WEBSVNDIR%%/templates/Elegant/images/repository24.png
%%WEBSVNDIR%%/templates/Elegant/images/reverse.png
%%WEBSVNDIR%%/templates/Elegant/images/revision.png
%%WEBSVNDIR%%/templates/Elegant/images/rss.png
%%WEBSVNDIR%%/templates/Elegant/images/stop.png
%%WEBSVNDIR%%/templates/Elegant/images/subversion-s.png
%%WEBSVNDIR%%/templates/Elegant/images/valid.png
%%WEBSVNDIR%%/templates/Elegant/images/warning.png
%%WEBSVNDIR%%/templates/Elegant/images/youngest.png
%%WEBSVNDIR%%/templates/Elegant/index.tmpl
%%WEBSVNDIR%%/templates/Elegant/log.tmpl
%%WEBSVNDIR%%/templates/Elegant/revision-popup.js
%%WEBSVNDIR%%/templates/Elegant/revision.tmpl
%%WEBSVNDIR%%/templates/Elegant/styles.css
%%WEBSVNDIR%%/templates/calm/README.txt
%%WEBSVNDIR%%/templates/calm/blame.tmpl
%%WEBSVNDIR%%/templates/calm/compare.tmpl
%%WEBSVNDIR%%/templates/calm/diff.tmpl
%%WEBSVNDIR%%/templates/calm/directory.tmpl
%%WEBSVNDIR%%/templates/calm/file.tmpl
%%WEBSVNDIR%%/templates/calm/footer.tmpl
%%WEBSVNDIR%%/templates/calm/header.tmpl
%%WEBSVNDIR%%/templates/calm/images/add.png
%%WEBSVNDIR%%/templates/calm/images/arrow_in.png
%%WEBSVNDIR%%/templates/calm/images/arrow_out.png
%%WEBSVNDIR%%/templates/calm/images/blame.png
%%WEBSVNDIR%%/templates/calm/images/bullet_add.png
%%WEBSVNDIR%%/templates/calm/images/bullet_delete.png
%%WEBSVNDIR%%/templates/calm/images/bullet_yellow.png
%%WEBSVNDIR%%/templates/calm/images/compress.png
%%WEBSVNDIR%%/templates/calm/images/css.png
%%WEBSVNDIR%%/templates/calm/images/cube_green.png
%%WEBSVNDIR%%/templates/calm/images/delete.png
%%WEBSVNDIR%%/templates/calm/images/diff.png
%%WEBSVNDIR%%/templates/calm/images/e-node.png
%%WEBSVNDIR%%/templates/calm/images/exclamation.png
%%WEBSVNDIR%%/templates/calm/images/eye.png
%%WEBSVNDIR%%/templates/calm/images/favicon.ico
%%WEBSVNDIR%%/templates/calm/images/file.png
%%WEBSVNDIR%%/templates/calm/images/filec.png
%%WEBSVNDIR%%/templates/calm/images/filedb.png
%%WEBSVNDIR%%/templates/calm/images/fileh.png
%%WEBSVNDIR%%/templates/calm/images/filepaint.png
%%WEBSVNDIR%%/templates/calm/images/filephp.png
%%WEBSVNDIR%%/templates/calm/images/files.png
%%WEBSVNDIR%%/templates/calm/images/filetxt.png
%%WEBSVNDIR%%/templates/calm/images/filexml.png
%%WEBSVNDIR%%/templates/calm/images/folder.png
%%WEBSVNDIR%%/templates/calm/images/html.png
%%WEBSVNDIR%%/templates/calm/images/i-node.png
%%WEBSVNDIR%%/templates/calm/images/l-node.png
%%WEBSVNDIR%%/templates/calm/images/link.png
%%WEBSVNDIR%%/templates/calm/images/log.png
%%WEBSVNDIR%%/templates/calm/images/next.png
%%WEBSVNDIR%%/templates/calm/images/page_white_add.png
%%WEBSVNDIR%%/templates/calm/images/page_white_delete.png
%%WEBSVNDIR%%/templates/calm/images/page_white_edit.png
%%WEBSVNDIR%%/templates/calm/images/pilcrow.png
%%WEBSVNDIR%%/templates/calm/images/pilcrow_delete.png
%%WEBSVNDIR%%/templates/calm/images/previous.png
%%WEBSVNDIR%%/templates/calm/images/script.png
%%WEBSVNDIR%%/templates/calm/images/sitemap_color.png
%%WEBSVNDIR%%/templates/calm/images/submitbg.png
%%WEBSVNDIR%%/templates/calm/images/t-node.png
%%WEBSVNDIR%%/templates/calm/images/textbg.png
%%WEBSVNDIR%%/templates/calm/images/toggledown.png
%%WEBSVNDIR%%/templates/calm/images/toggleup.png
%%WEBSVNDIR%%/templates/calm/images/up.png
%%WEBSVNDIR%%/templates/calm/images/xml.gif
%%WEBSVNDIR%%/templates/calm/index.tmpl
%%WEBSVNDIR%%/templates/calm/log.tmpl
%%WEBSVNDIR%%/templates/calm/png.js
%%WEBSVNDIR%%/templates/calm/revision.tmpl
%%WEBSVNDIR%%/templates/calm/styles.css
%%WEBSVNDIR%%/wsvn.php

Return to bug 236284

Lines 1-32 Link Here

(-)devel/websvn/Makefile (-16 / +34 lines)
1	# Created by: Yuan-Chung Hsiao (ychsiao@ychsiao.idv.tw)
2	# $FreeBSD$	1	# $FreeBSD$
3		2
4	PORTNAME= websvn	3	PORTNAME= websvn
5	PORTVERSION= 2.3.3	4	PORTVERSION= 2.4
6	PORTREVISION= 1
7	CATEGORIES= devel www	5	CATEGORIES= devel www
8	MASTER_SITES= http://websvn.tigris.org/files/documents/1380/49056/	6	PKGNAMESUFFIX= ${PHP_PKGNAMESUFFIX}
9		7
10	MAINTAINER= ychsiao@ychsiao.org	8	MAINTAINER= michael.osipov@siemens.com
11	COMMENT= Subversion repository web frontend	9	COMMENT= Online Subversion repository browser
12		10
13	LICENSE= GPLv2+	11	LICENSE= GPLv2
14	LICENSE_FILE= ${WRKSRC}/license.txt	12	LICENSE_FILE= ${WRKSRC}/license.txt
15		13
16	USES= cpe	14	RUN_DEPENDS= ${LOCALBASE}/bin/svn:devel/subversion \
17	USE_PHP= iconv pcre xml	15	${PEARDIR}/Archive/Tar.php:devel/pear@${PHP_FLAVOR} \
		16	${PEARDIR}/geshi.php:devel/pear-geshi@${PHP_FLAVOR} \
		17	${PEARDIR}/Text/Diff.php:devel/pear-Text_Diff@${PHP_FLAVOR}
		18
		19	USES= php:flavors cpe
		20	USE_GITHUB= yes
		21	GH_ACCOUNT= ${PORTNAME}php
		22
		23	USE_PHP= iconv pcre xml mbstring
		24
18	NO_BUILD= yes	25	NO_BUILD= yes
		26	NO_ARCH= yes
19		27
20	WEBSVNDIR?= ${WWWDIR_REL}	28	PEARDIR?= ${LOCALBASE}/share/pear
21		29
22	SUB_FILES= pkg-message	30	SUB_FILES= pkg-message
23	SUB_LIST+= WEBSVNDIR="${WEBSVNDIR}"	31	PLIST_SUB+= WWWOWN=${WWWOWN} WWWGRP=${WWWGRP}
24	PLIST_SUB+= WEBSVNDIR="${WEBSVNDIR}"
25		32
		33	post-patch:
		34	@${REINPLACE_CMD} -E \
		35	-e 's\|^// \$$config->setSvnConfigDir.+\|$$config->setSvnConfigDir('"'"'${ETCDIR}/subversion'"'"')\;\|' \
		36	-e 's\|^// \$$config->setSVNCommandPath.+\|$$config->setSVNCommandPath('"'"'${LOCALBASE}/bin'"'"')\;\|' \
		37	-e 's\|^// \$$config->useGeshi.+\|$$config->useGeshi()\;\|' \
		38	${WRKSRC}/include/distconfig.php
		39
26	do-install:	40	do-install:
27	${MKDIR} ${STAGEDIR}${PREFIX}/${WEBSVNDIR}	41	@(cd ${WRKSRC} \
28	(cd ${WRKSRC} \	42	&& ${RM} README.md changes.txt include/.gitignore)
29	&& ${COPYTREE_SHARE} \* ${STAGEDIR}${PREFIX}/${WEBSVNDIR})	43	@${MKDIR} ${STAGEDIR}${WWWDIR}
30	${FIND} ${STAGEDIR}${PREFIX}/${WEBSVNDIR} -type f -exec ${CHMOD} 644 {} +	44	@(cd ${WRKSRC} \
		45	&& ${COPYTREE_SHARE} . ${STAGEDIR}${WWWDIR})
31		46
		47	post-install:
		48	@${MKDIR} ${STAGEDIR}${ETCDIR}/subversion
		49
32	.include <bsd.port.mk>	50	.include <bsd.port.mk>

Lines 1-37 Link Here

(-)devel/websvn/files/patch-CVE-2013-6892 (-37 lines)
1	Arbitrary files with a known path can be accessed in websvn by committing a
2	symlink to a repository and then downloading the file (using the download
3	link).
4
5	Author: Thijs Kinkhorst <thijs@debian.org>
6
7	https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775682
8	--- dl.php.orig 2011-06-27 09:02:52 UTC
9	+++ dl.php
10	@@ -137,6 +137,18 @@ if ($rep) {
11	exit(0);
12	}
13
14	+ // For security reasons, disallow direct downloads of filenames that
15	+ // are a symlink, since they may be a symlink to anywhere (/etc/passwd)
16	+ // Deciding whether the symlink is relative and legal within the
17	+ // repository would be nice but seems to error prone at this moment.
18	+ if ( is_link($tempDir.DIRECTORY_SEPARATOR.$archiveName) ) {
19	+ header('HTTP/1.x 500 Internal Server Error', true, 500);
20	+ error_log('to be downloaded file is symlink, aborting: '.$archiveName);
21	+ print 'Download of symlinks disallowed: "'.xml_entities($archiveName).'".';
22	+ removeDirectory($tempDir);
23	+ exit(0);
24	+ }
25	+
26	// Set timestamp of exported directory (and subdirectories) to timestamp of
27	// the revision so every archive of a given revision has the same timestamp.
28	$revDate = $logEntry->date;
29	@@ -180,7 +192,7 @@ if ($rep) {
30	$downloadMimeType = 'application/x-zip';
31	$downloadArchive .= '.zip';
32	// Create zip file
33	- $cmd = $config->zip.' -r '.quote($downloadArchive).' '.quote($archiveName);
34	+ $cmd = $config->zip.' --symlinks -r '.quote($downloadArchive).' '.quote($archiveName);
35	execCommand($cmd, $retcode);
36	if ($retcode != 0) {
37	error_log('Unable to call zip command: '.$cmd);

Lines 1-12 Link Here

(-)devel/websvn/files/patch-CVE-2016-2511 (-12 lines)
1	Obtained from: Debian
2	--- include/setup.php.orig 2011-06-27 09:12:51 UTC
3	+++ include/setup.php
4	@@ -467,7 +467,7 @@ $vars['indexurl'] = $config->getURL('',
5	$vars['validationurl'] = getFullURL($_SERVER['SCRIPT_NAME']).'?'.buildQuery($queryParams + array('template' => $template, 'language' => $language), '%26');
6
7	// To avoid a possible XSS exploit, need to clean up the passed-in path first
8	-$path = !empty($_REQUEST['path']) ? $_REQUEST['path'] : null;
9	+$path = !empty($_REQUEST['path']) ? escape($_REQUEST['path']) : null;
10	if ($path === null \|\| $path === '')
11	$path = '/';
12	$vars['safepath'] = escape($path);

Lines 1-434 Link Here

(-)devel/websvn/pkg-plist (-434 / +217 lines)
1	%%WEBSVNDIR%%/blame.php	1	%%WWWDIR%%/blame.php
2	%%WEBSVNDIR%%/cache/tmp	2	%%WWWDIR%%/browse.php
3	%%WEBSVNDIR%%/changes.txt	3	%%WWWDIR%%/cache/tmp
4	%%WEBSVNDIR%%/comp.php	4	%%WWWDIR%%/comp.php
5	%%WEBSVNDIR%%/diff.php	5	%%WWWDIR%%/diff.php
6	%%WEBSVNDIR%%/dl.php	6	%%WWWDIR%%/dl.php
7	%%WEBSVNDIR%%/doc/install.html	7	%%WWWDIR%%/filedetails.php
8	%%WEBSVNDIR%%/doc/style.css	8	%%WWWDIR%%/include/authz.php
9	%%WEBSVNDIR%%/doc/templates.html	9	%%WWWDIR%%/include/bugtraq.php
10	%%WEBSVNDIR%%/filedetails.php	10	%%WWWDIR%%/include/command.php
11	%%WEBSVNDIR%%/include/accessfile.php	11	%%WWWDIR%%/include/configclass.php
12	%%WEBSVNDIR%%/include/auth.php	12	%%WWWDIR%%/include/diff_inc.php
13	%%WEBSVNDIR%%/include/bugtraq.php	13	%%WWWDIR%%/include/diff_util.php
14	%%WEBSVNDIR%%/include/command.php	14	@sample(,%%WWWGRP%%,640) %%WWWDIR%%/include/distconfig.php %%WWWDIR%%/include/config.php
15	%%WEBSVNDIR%%/include/configclass.php	15	%%WWWDIR%%/include/header
16	%%WEBSVNDIR%%/include/diff_inc.php	16	%%WWWDIR%%/include/setup.php
17	%%WEBSVNDIR%%/include/diff_util.php	17	%%WWWDIR%%/include/svnlook.php
18	@sample %%WEBSVNDIR%%/include/distconfig.php %%WWWDIR%%/include/config.php	18	%%WWWDIR%%/include/template.php
19	%%WEBSVNDIR%%/include/header	19	%%WWWDIR%%/include/utils.php
20	%%WEBSVNDIR%%/include/setup.php	20	%%WWWDIR%%/include/version.php
21	%%WEBSVNDIR%%/include/svnlook.php	21	%%WWWDIR%%/index.php
22	%%WEBSVNDIR%%/include/template.php	22	%%WWWDIR%%/javascript/blame-popup.js
23	%%WEBSVNDIR%%/include/utils.php	23	%%WWWDIR%%/javascript/compare-checkboxes.js
24	%%WEBSVNDIR%%/include/version.php	24	%%WWWDIR%%/javascript/group-collapse.js
25	%%WEBSVNDIR%%/index.php	25	%%WWWDIR%%/javascript/ie-png-transparency.js
26	%%WEBSVNDIR%%/javascript/blame-popup.js	26	%%WWWDIR%%/languages/catalan.php
27	%%WEBSVNDIR%%/javascript/group-collapse.js	27	%%WWWDIR%%/languages/chinese-simplified.php
28	%%WEBSVNDIR%%/languages/catalan.php	28	%%WWWDIR%%/languages/chinese-traditional.php
29	%%WEBSVNDIR%%/languages/chinese-simplified.php	29	%%WWWDIR%%/languages/czech.php
30	%%WEBSVNDIR%%/languages/chinese-traditional.php	30	%%WWWDIR%%/languages/danish.php
31	%%WEBSVNDIR%%/languages/czech.php	31	%%WWWDIR%%/languages/dutch.php
32	%%WEBSVNDIR%%/languages/danish.php	32	%%WWWDIR%%/languages/english.php
33	%%WEBSVNDIR%%/languages/dutch.php	33	%%WWWDIR%%/languages/finnish.php
34	%%WEBSVNDIR%%/languages/english.php	34	%%WWWDIR%%/languages/french.php
35	%%WEBSVNDIR%%/languages/finnish.php	35	%%WWWDIR%%/languages/german.php
36	%%WEBSVNDIR%%/languages/french.php	36	%%WWWDIR%%/languages/hebrew.php
37	%%WEBSVNDIR%%/languages/german.php	37	%%WWWDIR%%/languages/hindi.php
38	%%WEBSVNDIR%%/languages/hebrew.php	38	%%WWWDIR%%/languages/hungarian.php