Bug 56313 - Update www/gallery - security update
Summary: Update www/gallery - security update
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: Normal Affects Only Me
Assignee: freebsd-ports-bugs (Nobody)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2003-09-02 14:30 UTC by Thomas Vogt
Modified: 2003-09-04 04:50 UTC (History)
0 users

See Also:


Attachments
file.diff (237 bytes, patch)
2003-09-02 14:30 UTC, Thomas Vogt
no flags Details | Diff
file.diff (290 bytes, patch)
2003-09-02 14:30 UTC, Thomas Vogt
no flags Details | Diff
gallery.diff (1.51 KB, patch)
2003-09-04 04:18 UTC, Yen-Ming Lee
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Thomas Vogt 2003-09-02 14:30:16 UTC
Bugtraq:
"Cross-site scripting (XSS) vulnerability in search.php of Gallery 1.1 
through 1.3.4 allows remote attackers to insert arbitrary web script via 
the searchstring parameter."

Fix: Update to version 1.3.4-pl1.
Comment 1 Jamie Hermans 2003-09-03 02:03:20 UTC
Does PORTREVISION really need to be set? PORTVERSION *is* changing.

Otherwise patch is great - thanks Thomas!

-- Jamie
Comment 2 Yen-Ming Lee freebsd_committer 2003-09-03 02:41:52 UTC
State Changed
From-To: open->closed

Committed, thanks.
Comment 3 Jonathan Noack 2003-09-03 21:12:24 UTC
pkg_version sees this update as downgrade:
gallery-1.3.4                       >   succeeds port (port has pl1)

This is because the PORTVERSION has a '-' in it.  I suggest removing this
dash.  Due to the use of webmail, tabs have been converted to spaces (and
attached text files get encoded like binaries, so you're screwed either
way) -- please don't apply this diff directly:

$ diff -u Makefile.orig Makefile
--- Makefile.orig       Tue Sep  2 20:41:43 2003
+++ Makefile    Wed Sep  3 15:05:38 2003
@@ -6,7 +6,7 @@
 #

 PORTNAME=      gallery
-PORTVERSION=   1.3.4-pl1
+PORTVERSION=   1.3.4pl1
 CATEGORIES=    www
 MASTER_SITES=  ${MASTER_SITE_SOURCEFORGE}
 MASTER_SITE_SUBDIR=    ${PORTNAME}
Comment 4 Jonathan Noack 2003-09-03 22:19:43 UTC
Then again, may we want to be able to fetch... *blush*

Maybe a bump in PORTEPOCH?
Comment 5 Jonathan Noack 2003-09-04 01:20:09 UTC
PORTREVISION bump still didn't fix pkg_version seeing this as a downgrade:
gallery-1.3.4                       >   succeeds port (port has pl1_1)
Comment 6 Jamie Hermans 2003-09-04 03:10:53 UTC
On Wed, Sep 03, 2003 at 07:20:09PM -0500, Jon Noack wrote:
> PORTREVISION bump still didn't fix pkg_version seeing this as a downgrade:
> gallery-1.3.4                       >   succeeds port (port has pl1_1)
> 

OK - this one works.  I'm sure this breaks 'the rules', but I can't
think of a better way to make this work with the version scheme they
chose to use for the gallery patch.

# pkg_version -v | grep gallery
gallery-1.3.4    <   needs updating (port has 1.3.4pl1)


diff -ruN gallery/Makefile gallery-new/Makefile
--- gallery/Makefile	Wed Sep  3 16:14:22 2003
+++ gallery-new/Makefile	Wed Sep  3 20:02:00 2003
@@ -6,8 +6,8 @@
 #
 
 PORTNAME=	gallery
-PORTVERSION=	1.3.4-pl1
-PORTREVISION=	1
+PORTVERSION=	1.3.4pl1
+DISTFILES=	gallery-1.3.4-pl1.tar.gz
 CATEGORIES=	www
 MASTER_SITES=	${MASTER_SITE_SOURCEFORGE}
 MASTER_SITE_SUBDIR=	${PORTNAME}

-- Jamie
Comment 7 Yen-Ming Lee freebsd_committer 2003-09-04 04:18:55 UTC
On Wed, Sep 03, 2003 at 08:10:53PM -0600, Jamie Hermans wrote:
> On Wed, Sep 03, 2003 at 07:20:09PM -0500, Jon Noack wrote:
> > PORTREVISION bump still didn't fix pkg_version seeing this as a downgrade:
> > gallery-1.3.4                       >   succeeds port (port has pl1_1)
> > 
> 
> OK - this one works.  I'm sure this breaks 'the rules', but I can't
> think of a better way to make this work with the version scheme they
> chose to use for the gallery patch.
> 
> # pkg_version -v | grep gallery
> gallery-1.3.4    <   needs updating (port has 1.3.4pl1)

portlint tells me it's illegal:
FATAL: PORTVERSION looks illegal. should modify "1.3.4pl1".

How about the attached patch file?

-- 
Yen-Ming Lee [§õ«Û©ú] KeyID: 0x5EB52E51 : www.leeym.com : Taipei, Taiwan
Comment 8 Jamie Hermans 2003-09-04 04:49:27 UTC
On Thu, Sep 04, 2003 at 11:18:55AM +0800, Yen-Ming Lee wrote:
> On Wed, Sep 03, 2003 at 08:10:53PM -0600, Jamie Hermans wrote:
> > On Wed, Sep 03, 2003 at 07:20:09PM -0500, Jon Noack wrote:
> > > PORTREVISION bump still didn't fix pkg_version seeing this as a downgrade:
> > > gallery-1.3.4                       >   succeeds port (port has pl1_1)
> > > 
> > 
> > OK - this one works.  I'm sure this breaks 'the rules', but I can't
> > think of a better way to make this work with the version scheme they
> > chose to use for the gallery patch.
> > 
> > # pkg_version -v | grep gallery
> > gallery-1.3.4    <   needs updating (port has 1.3.4pl1)
> 
> portlint tells me it's illegal:
> FATAL: PORTVERSION looks illegal. should modify "1.3.4pl1".
> 
> How about the attached patch file?

This just gets more and more complicated :)

Looks good ... and works here as well.

-- Jamie