Imported Debian patch 0.2.1-1

diff --git a/debian/changelog b/debian/changelog
index 5cc61b26f95675da1ce2a96a2c50eab9025f6129..741708e9becb2049d024be8e358d93fce1b53e60 100644 (file)
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,11 @@
+roundcube (0.2.1-1) unstable; urgency=low
+
+  * New upstream release:
+      + Fix use_packaged_tinymce.patch to apply to this new version
+      + Remove cve-2009-0413.patch which has been applied upstream
+
+ -- Vincent Bernat <bernat@debian.org>  Sat, 14 Mar 2009 17:42:07 +0100
+
 roundcube (0.2~stable-2) unstable; urgency=low
 
   * Update debconf translations:

diff --git a/debian/patches/cve-2009-0413.patch b/debian/patches/cve-2009-0413.patch
deleted file mode 100644 (file)
index 8b4349b..0000000
--- a/debian/patches/cve-2009-0413.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-Fix CVE-2009-0413 by handling carefully background attribute.
---- roundcubemail/CHANGELOG (revision 2242)
-+++ roundcubemail/CHANGELOG (revision 2245)
-@@ -1,4 +1,8 @@
- CHANGELOG RoundCube Webmail
- ---------------------------
-+
-+2009/01/20 (thomasb)
-+----------
-+- Fix XSS vulnerability through background attributes as reported by Julien Cayssol
- 
- 2009/01/18 (alec)
---- roundcubemail/program/lib/washtml.php (revision 1811)
-+++ roundcubemail/program/lib/washtml.php (revision 2245)
-@@ -81,5 +81,5 @@
-   
-   /* Allowed HTML attributes */
--  static $html_attribs = array('name', 'class', 'title', 'alt', 'width', 'height', 'align', 'nowrap', 'col', 'row', 'id', 'rowspan', 'colspan', 'cellspacing', 'cellpadding', 'valign', 'bgcolor', 'color', 'border', 'bordercolorlight', 'bordercolordark', 'face', 'marginwidth', 'marginheight', 'axis', 'border', 'abbr', 'char', 'charoff', 'clear', 'compact', 'coords', 'vspace', 'hspace', 'cellborder', 'size', 'lang', 'dir', 'background');  
-+  static $html_attribs = array('name', 'class', 'title', 'alt', 'width', 'height', 'align', 'nowrap', 'col', 'row', 'id', 'rowspan', 'colspan', 'cellspacing', 'cellpadding', 'valign', 'bgcolor', 'color', 'border', 'bordercolorlight', 'bordercolordark', 'face', 'marginwidth', 'marginheight', 'axis', 'border', 'abbr', 'char', 'charoff', 'clear', 'compact', 'coords', 'vspace', 'hspace', 'cellborder', 'size', 'lang', 'dir');  
-   
-   /* State for linked objects in HTML */
-@@ -161,13 +161,13 @@
-       $value = $node->getAttribute($key);
-       if(isset($this->_html_attribs[$key]) ||
--         ($key == 'href' && preg_match('/^(http|https|ftp|mailto):.*/i', $value)))
-+         ($key == 'href' && preg_match('/^(http|https|ftp|mailto):.+/i', $value)))
-         $t .= ' ' . $key . '="' . htmlspecialchars($value, ENT_QUOTES) . '"';
-       else if($key == 'style' && ($style = $this->wash_style($value)))
-         $t .= ' style="' . $style . '"';
--      else if($key == 'src' && strtolower($node->tagName) == 'img') { //check tagName anyway
-+      else if($key == 'background' || ($key == 'src' && strtolower($node->tagName) == 'img')) { //check tagName anyway
-         if($src = $this->config['cid_map'][$value]) {
-           $t .= ' ' . $key . '="' . htmlspecialchars($src, ENT_QUOTES) . '"';
-         }
--        else if(preg_match('/^(http|https|ftp):.*/i', $value)) {
-+        else if(preg_match('/^(http|https|ftp):.+/i', $value)) {
-           if($this->config['allow_remote'])
-             $t .= ' ' . $key . '="' . htmlspecialchars($value, ENT_QUOTES) . '"';
-@@ -175,5 +175,5 @@
-             $this->extlinks = true;
-             if ($this->config['blocked_src'])
--              $t .= ' src="' . htmlspecialchars($this->config['blocked_src'], ENT_QUOTES) . '"';
-+              $t .= ' ' . $key . '="' . htmlspecialchars($this->config['blocked_src'], ENT_QUOTES) . '"';
-           }
-         }

diff --git a/debian/patches/series b/debian/patches/series
index 8e2bd18f676236384d72f4919573822bda4f0e6c..e148aedf8f1b79e4e3eecd3b3d625b0c80d368b6 100644 (file)
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -2,5 +2,4 @@ dbconfig-common_support.patch
 correct_install_path.patch
 use_packaged_tinymce.patch
 correct-magic-path.patch
-cve-2009-0413.patch
 too-old-mdb2.patch

diff --git a/debian/patches/use_packaged_tinymce.patch b/debian/patches/use_packaged_tinymce.patch
index 7b3a1ffc00535fffda5d737e47a6fe77dff85b99..f2a7a91b4b6f455476c66b88a8c853b48c8cd91e 100644 (file)
--- a/debian/patches/use_packaged_tinymce.patch
+++ b/debian/patches/use_packaged_tinymce.patch
@@ -4,10 +4,10 @@ Use tinymce from tinycme package instead of the shipped one.
 +++ roundcube-0.1~rc2/program/steps/mail/sendmail.inc  2007-11-26 11:44:04.000000000 +0100
 @@ -123,7 +123,7 @@
  
-     // sanitize image name so resulting attachment doesn't leave images dir
-     $image_name = preg_replace('/[^a-zA-Z0-9_\.\-]/i','',$image_name);
--    $img_file = INSTALL_PATH . '/' . $searchstr . $image_name;
-+    $img_file = '/usr/share/tinymce/www/plugins/emotions/img/' . $image_name;
+         // sanitize image name so resulting attachment doesn't leave images dir
+         $image_name = preg_replace('/[^a-zA-Z0-9_\.\-]/i', '', $image_name);
+-        $img_file = INSTALL_PATH . '/' . $searchstr . $image_name;
++        $img_file = '/usr/share/tinymce/www/plugins/emotions/img/' . $image_name;
  
-     if (! in_array($image_name, $included_images))
-       {
+         if (! in_array($image_name, $included_images)) {
+           // add the image to the MIME message