From cc39562d435d67a1d9ba6655928e9e5c061c59fd Mon Sep 17 00:00:00 2001 From: Vincent Bernat Date: Sun, 15 Feb 2009 15:57:20 +0000 Subject: [PATCH 1/1] Prepare a new release for unstable --- debian/changelog | 15 +++ debian/control | 10 +- debian/control.in | 8 +- debian/patches/cve-2008-5620.patch | 45 ------- debian/patches/cve-2009-0413.patch | 45 +++++++ debian/patches/dont-use-preg-e-option.patch | 123 -------------------- debian/patches/fix_login.patch | 13 --- debian/patches/series | 5 +- debian/patches/use-db-backend.patch | 13 --- debian/rules | 4 - debian/sql/mysql/0.1.1-1 | 17 +++ debian/sql/mysql/0.2~alpha-5 | 10 ++ debian/sql/mysql/0.2~stable-1 | 18 +++ debian/sql/pgsql/0.1.1-1 | 20 ++++ debian/sql/pgsql/0.2~stable-1 | 18 +++ debian/sql/sqlite/0.1.1-1 | 28 +++++ debian/sql/sqlite/0.2~stable-1 | 8 ++ 17 files changed, 189 insertions(+), 211 deletions(-) delete mode 100644 debian/patches/cve-2008-5620.patch create mode 100644 debian/patches/cve-2009-0413.patch delete mode 100644 debian/patches/dont-use-preg-e-option.patch delete mode 100644 debian/patches/fix_login.patch delete mode 100644 debian/patches/use-db-backend.patch create mode 100644 debian/sql/mysql/0.1.1-1 create mode 100644 debian/sql/mysql/0.2~alpha-5 create mode 100644 debian/sql/mysql/0.2~stable-1 create mode 100644 debian/sql/pgsql/0.1.1-1 create mode 100644 debian/sql/pgsql/0.2~stable-1 create mode 100644 debian/sql/sqlite/0.1.1-1 create mode 100644 debian/sql/sqlite/0.2~stable-1 diff --git a/debian/changelog b/debian/changelog index b97f2f8..63ac70a 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,18 @@ +roundcube (0.2~stable-1) unstable; urgency=low + + * New upstream version. Closes: #503573. + + Add SQL update scripts for this new release and for + 0.2~alpha. Remove copy of SQL upgrade script from debian/rules. + + Remove patch for CVE-2008-5620 which is now fixed upstream. + + Remove patch correcting a vulnerability in html2text.php. + + Remove patch fixing login issue. This is fixed upstream. + + Remove patch setting the default backend to db instead of mdb2: + this is not possible any more. We depend on php-mdb2 now. + * Upload to unstable since Lenny is out. + * Apply fix for XSS issue (CVE-2009-0413). Closes: #514179. + + -- Vincent Bernat Sun, 15 Feb 2009 16:18:58 +0100 + roundcube (0.2~alpha-4) experimental; urgency=low * Add missing ${misc:Depends} to make Lintian happy. diff --git a/debian/control b/debian/control index a510c79..b40f1f4 100644 --- a/debian/control +++ b/debian/control @@ -3,7 +3,7 @@ Section: web Priority: extra Maintainer: Debian Roundcube Maintainers Uploaders: Vincent Bernat , Romain Beauxis -Build-Depends: debhelper (>= 5), quilt, patchutils (>= 0.2.25), cdbs (>= 0.4.27), po-debconf +Build-Depends: cdbs (>= 0.4.23-1.1), debhelper (>= 5), quilt, patchutils (>= 0.2.25), cdbs (>= 0.4.27), po-debconf Homepage: http://www.roundcube.net/ Standards-Version: 3.8.0 Vcs-Svn: svn://svn.debian.org/svn/pkg-roundcube/roundcube @@ -11,7 +11,7 @@ Vcs-Browser: http://svn.debian.org/wsvn/pkg-roundcube/roundcube Package: roundcube-core Architecture: all -Depends: dbconfig-common, debconf | debconf-2.0, apache2 | lighttpd | httpd, php5, php5-mcrypt, php5-gd, roundcube-db, php-db, php-auth, php-net-smtp, php-net-socket, php-mail-mime (>= 1.5.0), ucf, tinymce (>= 3), ${misc:Depends}, libmagic1 +Depends: dbconfig-common, debconf | debconf-2.0, apache2 | lighttpd | httpd, php5, php5-mcrypt, php5-gd, roundcube-db, php-mdb2, php-auth, php-net-smtp, php-net-socket, php-mail-mime (>= 1.5.0), ucf, tinymce (>= 3), ${misc:Depends}, libmagic1 Replaces: roundcube Conflicts: roundcube (<< 0.1~rc2-2) Description: skinnable AJAX based webmail solution for IMAP servers @@ -40,7 +40,7 @@ Description: skinnable AJAX based webmail solution for IMAP servers Package: roundcube-mysql Architecture: all -Depends: php5-mysql, mysql-client | virtual-mysql-client, ${misc:Depends} +Depends: php-mdb2-driver-mysql, mysql-client | virtual-mysql-client, ${misc:Depends} Suggests: mysql-server Provides: roundcube-db Description: metapackage providing MySQL dependencies for RoundCube @@ -50,7 +50,7 @@ Description: metapackage providing MySQL dependencies for RoundCube Package: roundcube-pgsql Architecture: all -Depends: php5-pgsql, postgresql-client, ${misc:Depends} +Depends: php-mdb2-driver-pgsql, postgresql-client-8.1 | postgresql-client, ${misc:Depends} Suggests: postgresql-server Provides: roundcube-db Description: metapackage providing PostgreSQL dependencies for RoundCube @@ -60,7 +60,7 @@ Description: metapackage providing PostgreSQL dependencies for RoundCube Package: roundcube-sqlite Architecture: all -Depends: php5-sqlite, sqlite, ${misc:Depends} +Depends: php-mdb2-driver-sqlite, sqlite, ${misc:Depends} Provides: roundcube-db Description: metapackage providing sqlite dependencies for RoundCube This package provides sqlite dependencies for RoundCube Webmail, a diff --git a/debian/control.in b/debian/control.in index 22c0cfc..c583a16 100644 --- a/debian/control.in +++ b/debian/control.in @@ -11,7 +11,7 @@ Vcs-Browser: http://svn.debian.org/wsvn/pkg-roundcube/roundcube Package: roundcube-core Architecture: all -Depends: dbconfig-common, debconf | debconf-2.0, apache2 | lighttpd | httpd, php5, php5-mcrypt, php5-gd, roundcube-db, php-db, php-auth, php-net-smtp, php-net-socket, php-mail-mime (>= 1.5.0), ucf, tinymce (>= 3), ${misc:Depends}, libmagic1 +Depends: dbconfig-common, debconf | debconf-2.0, apache2 | lighttpd | httpd, php5, php5-mcrypt, php5-gd, roundcube-db, php-mdb2, php-auth, php-net-smtp, php-net-socket, php-mail-mime (>= 1.5.0), ucf, tinymce (>= 3), ${misc:Depends}, libmagic1 Replaces: roundcube Conflicts: roundcube (<< 0.1~rc2-2) Description: skinnable AJAX based webmail solution for IMAP servers @@ -40,7 +40,7 @@ Description: skinnable AJAX based webmail solution for IMAP servers Package: roundcube-mysql Architecture: all -Depends: php5-mysql, mysql-client | virtual-mysql-client, ${misc:Depends} +Depends: php-mdb2-driver-mysql, mysql-client | virtual-mysql-client, ${misc:Depends} Suggests: mysql-server Provides: roundcube-db Description: metapackage providing MySQL dependencies for RoundCube @@ -50,7 +50,7 @@ Description: metapackage providing MySQL dependencies for RoundCube Package: roundcube-pgsql Architecture: all -Depends: php5-pgsql, postgresql-client-8.1 | postgresql-client, ${misc:Depends} +Depends: php-mdb2-driver-pgsql, postgresql-client-8.1 | postgresql-client, ${misc:Depends} Suggests: postgresql-server Provides: roundcube-db Description: metapackage providing PostgreSQL dependencies for RoundCube @@ -60,7 +60,7 @@ Description: metapackage providing PostgreSQL dependencies for RoundCube Package: roundcube-sqlite Architecture: all -Depends: php5-sqlite, sqlite, ${misc:Depends} +Depends: php-mdb2-driver-sqlite, sqlite, ${misc:Depends} Provides: roundcube-db Description: metapackage providing sqlite dependencies for RoundCube This package provides sqlite dependencies for RoundCube Webmail, a diff --git a/debian/patches/cve-2008-5620.patch b/debian/patches/cve-2008-5620.patch deleted file mode 100644 index c1fdd23..0000000 --- a/debian/patches/cve-2008-5620.patch +++ /dev/null @@ -1,45 +0,0 @@ -Fix CVE-2008-5620 which was caused by insufficient input sanitizing for quota bar. - -diff --git a/bin/quotaimg.php b/bin/quotaimg.php -index 354f4eb..4e73c21 100644 ---- a/bin/quotaimg.php -+++ b/bin/quotaimg.php -@@ -18,10 +18,10 @@ - - */ - --$used = ((isset($_GET['u']) && !empty($_GET['u'])) || $_GET['u']=='0')?(int)$_GET['u']:'??'; --$quota = ((isset($_GET['q']) && !empty($_GET['q'])) || $_GET['q']=='0')?(int)$_GET['q']:'??'; --$width = empty($_GET['w']) ? 100 : (int)$_GET['w']; --$height = empty($_GET['h']) ? 14 : (int)$_GET['h']; -+$used = isset($_GET['u']) ? intval($_GET['u']) : '??'; -+$quota = isset($_GET['q']) ? intval($_GET['q']) : '??'; -+$width = empty($_GET['w']) ? 100 : min(300, intval($_GET['w'])); -+$height = empty($_GET['h']) ? 14 : min(50, intval($_GET['h'])); - - /** - * Quota display -@@ -159,7 +159,7 @@ function genQuota($used, $total, $width, $height) - } - - $quota_width = $quota / 100 * $width; -- imagefilledrectangle($im, $border, 0, $quota, $height-2*$border, $fill); -+ imagefilledrectangle($im, $border, 0, $quota_width, $height-2*$border, $fill); - - $string = $quota . '%'; - $mid = floor(($width-(strlen($string)*imagefontwidth($font)))/2)+1; -@@ -178,6 +178,12 @@ function genQuota($used, $total, $width, $height) - imagedestroy($im); - } - --genQuota($used, $quota, $width, $height); -+if ($width > 1 && $height > 1) { -+ genQuota($used, $quota, $width, $height); -+} -+else { -+ header("HTTP/1.0 404 Not Found"); -+} -+ - exit; - ?> -\ No newline at end of file diff --git a/debian/patches/cve-2009-0413.patch b/debian/patches/cve-2009-0413.patch new file mode 100644 index 0000000..8b4349b --- /dev/null +++ b/debian/patches/cve-2009-0413.patch @@ -0,0 +1,45 @@ +Fix CVE-2009-0413 by handling carefully background attribute. +--- roundcubemail/CHANGELOG (revision 2242) ++++ roundcubemail/CHANGELOG (revision 2245) +@@ -1,4 +1,8 @@ + CHANGELOG RoundCube Webmail + --------------------------- ++ ++2009/01/20 (thomasb) ++---------- ++- Fix XSS vulnerability through background attributes as reported by Julien Cayssol + + 2009/01/18 (alec) +--- roundcubemail/program/lib/washtml.php (revision 1811) ++++ roundcubemail/program/lib/washtml.php (revision 2245) +@@ -81,5 +81,5 @@ + + /* Allowed HTML attributes */ +- static $html_attribs = array('name', 'class', 'title', 'alt', 'width', 'height', 'align', 'nowrap', 'col', 'row', 'id', 'rowspan', 'colspan', 'cellspacing', 'cellpadding', 'valign', 'bgcolor', 'color', 'border', 'bordercolorlight', 'bordercolordark', 'face', 'marginwidth', 'marginheight', 'axis', 'border', 'abbr', 'char', 'charoff', 'clear', 'compact', 'coords', 'vspace', 'hspace', 'cellborder', 'size', 'lang', 'dir', 'background'); ++ static $html_attribs = array('name', 'class', 'title', 'alt', 'width', 'height', 'align', 'nowrap', 'col', 'row', 'id', 'rowspan', 'colspan', 'cellspacing', 'cellpadding', 'valign', 'bgcolor', 'color', 'border', 'bordercolorlight', 'bordercolordark', 'face', 'marginwidth', 'marginheight', 'axis', 'border', 'abbr', 'char', 'charoff', 'clear', 'compact', 'coords', 'vspace', 'hspace', 'cellborder', 'size', 'lang', 'dir'); + + /* State for linked objects in HTML */ +@@ -161,13 +161,13 @@ + $value = $node->getAttribute($key); + if(isset($this->_html_attribs[$key]) || +- ($key == 'href' && preg_match('/^(http|https|ftp|mailto):.*/i', $value))) ++ ($key == 'href' && preg_match('/^(http|https|ftp|mailto):.+/i', $value))) + $t .= ' ' . $key . '="' . htmlspecialchars($value, ENT_QUOTES) . '"'; + else if($key == 'style' && ($style = $this->wash_style($value))) + $t .= ' style="' . $style . '"'; +- else if($key == 'src' && strtolower($node->tagName) == 'img') { //check tagName anyway ++ else if($key == 'background' || ($key == 'src' && strtolower($node->tagName) == 'img')) { //check tagName anyway + if($src = $this->config['cid_map'][$value]) { + $t .= ' ' . $key . '="' . htmlspecialchars($src, ENT_QUOTES) . '"'; + } +- else if(preg_match('/^(http|https|ftp):.*/i', $value)) { ++ else if(preg_match('/^(http|https|ftp):.+/i', $value)) { + if($this->config['allow_remote']) + $t .= ' ' . $key . '="' . htmlspecialchars($value, ENT_QUOTES) . '"'; +@@ -175,5 +175,5 @@ + $this->extlinks = true; + if ($this->config['blocked_src']) +- $t .= ' src="' . htmlspecialchars($this->config['blocked_src'], ENT_QUOTES) . '"'; ++ $t .= ' ' . $key . '="' . htmlspecialchars($this->config['blocked_src'], ENT_QUOTES) . '"'; + } + } diff --git a/debian/patches/dont-use-preg-e-option.patch b/debian/patches/dont-use-preg-e-option.patch deleted file mode 100644 index 718526b..0000000 --- a/debian/patches/dont-use-preg-e-option.patch +++ /dev/null @@ -1,123 +0,0 @@ -Fix a vulnerability due to the use of "e" option of preg_replace. - ---- roundcube-0.2~alpha/program/lib/html2text.php 2008-04-12 15:54:45.000000000 +0200 -+++ roundcube-0.2~alpha/program/lib/html2text.php 2008-12-13 14:21:44.000000000 +0100 -@@ -99,6 +99,22 @@ - */ - var $width = 70; - -+ /** -+ * List of preg* regular expression patterns to search for -+ * and replace using callback function. -+ * -+ * @var array $callback_search -+ * @access public -+ */ -+ var $callback_search = array( -+ '/<(h)[123456][^>]*>(.*?)<\/h[123456]>/i', // H1 - H3 -+ '/<(b)[^>]*>(.*?)<\/b>/i', // -+ '/<(strong)[^>]*>(.*?)<\/strong>/i', // -+ '/<(a) [^>]*href=("|\')([^"\']+)\2[^>]*>(.*?)<\/a>/i', -+ // -+ '/<(th)[^>]*>(.*?)<\/th>/i', // and -+ ); -+ - /** - * List of preg* regular expression patterns to search for, - * used in conjunction with $replace. -@@ -112,12 +128,8 @@ - "/[\n\t]+/", // Newlines and tabs - '/]*>.*?<\/script>/i', //