From owner-freebsd-ports Fri Aug 9 0:40:24 2002 Delivered-To: freebsd-ports@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 4B15F37B400 for ; Fri, 9 Aug 2002 00:40:03 -0700 (PDT) Received: from freefall.freebsd.org (freefall.FreeBSD.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id 450AB43E72 for ; Fri, 9 Aug 2002 00:40:02 -0700 (PDT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.12.4/8.12.4) with ESMTP id g797e2JU022344 for ; Fri, 9 Aug 2002 00:40:02 -0700 (PDT) (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.12.4/8.12.4/Submit) id g797e2Ml022343; Fri, 9 Aug 2002 00:40:02 -0700 (PDT) Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 2A6C637B400 for ; Fri, 9 Aug 2002 00:30:03 -0700 (PDT) Received: from zinebar.hermans.ca (h24-65-98-95.ed.shawcable.net [24.65.98.95]) by mx1.FreeBSD.org (Postfix) with ESMTP id 1F79C43E65 for ; Fri, 9 Aug 2002 00:30:02 -0700 (PDT) (envelope-from jamie@hermans.ca) Received: by zinebar.hermans.ca (Postfix, from userid 1001) id A2ED5391; Fri, 9 Aug 2002 01:30:01 -0600 (MDT) Message-Id: <20020809073001.A2ED5391@zinebar.hermans.ca> Date: Fri, 9 Aug 2002 01:30:01 -0600 (MDT) From: Jamie Hermans Reply-To: Jamie Hermans To: FreeBSD-gnats-submit@FreeBSD.org X-Send-Pr-Version: 3.113 Subject: ports/41465: Update: www/gallery - security fixes Sender: owner-freebsd-ports@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org >Number: 41465 >Category: ports >Synopsis: Update: www/gallery - security fixes >Confidential: no >Severity: critical >Priority: medium >Responsible: freebsd-ports >State: open >Quarter: >Keywords: >Date-Required: >Class: maintainer-update >Submitter-Id: current-users >Arrival-Date: Fri Aug 09 00:40:01 PDT 2002 >Closed-Date: >Last-Modified: >Originator: Jamie Hermans >Release: FreeBSD 4.6-STABLE i386 >Organization: hermans.ca >Environment: System: FreeBSD zinebar.hermans.ca 4.6-STABLE FreeBSD 4.6-STABLE #1: Tue Jul 23 09:09:16 MDT 2002 root@zinebar.hermans.ca:/usr/obj/usr/src/sys/ZINEBAR i386 >Description: This release includes several SECURITY FIXES that address weaknesses in the Gallery code that can lead to a REMOTE EXPLOIT. Cleaned up a minor pkg-plist error as well. >How-To-Repeat: >Fix: diff -ruN gallery-old/Makefile gallery/Makefile --- gallery-old/Makefile Thu Jun 13 22:38:30 2002 +++ gallery/Makefile Fri Aug 9 01:06:58 2002 @@ -6,7 +6,7 @@ # PORTNAME= gallery -PORTVERSION= 1.3 +PORTVERSION= 1.3.1 CATEGORIES= www MASTER_SITES= ${MASTER_SITE_SOURCEFORGE} MASTER_SITE_SUBDIR= ${PORTNAME} diff -ruN gallery-old/distinfo gallery/distinfo --- gallery-old/distinfo Thu Jun 13 22:38:30 2002 +++ gallery/distinfo Fri Aug 9 01:23:22 2002 @@ -1 +1 @@ -MD5 (gallery-1.3.tar.gz) = 9922b47cf734cb55065a502a2c1324f9 +MD5 (gallery-1.3.1.tar.gz) = 0c0ef90962414cac95f28a881c80117d diff -ruN gallery-old/pkg-plist gallery/pkg-plist --- gallery-old/pkg-plist Thu Jun 13 22:38:30 2002 +++ gallery/pkg-plist Fri Aug 9 01:24:47 2002 @@ -8,17 +8,6 @@ %%GALLERYDIR%%/album_permissions.php %%GALLERYDIR%%/albums.php %%GALLERYDIR%%/captionator.php -%%GALLERYDIR%%/classes/Album.php -%%GALLERYDIR%%/classes/AlbumDB.php -%%GALLERYDIR%%/classes/AlbumItem.php -%%GALLERYDIR%%/classes/Comment.php -%%GALLERYDIR%%/classes/Database.php -%%GALLERYDIR%%/classes/EverybodyUser.php -%%GALLERYDIR%%/classes/Image.php -%%GALLERYDIR%%/classes/LoggedInUser.php -%%GALLERYDIR%%/classes/NobodyUser.php -%%GALLERYDIR%%/classes/User.php -%%GALLERYDIR%%/classes/UserDB.php %%GALLERYDIR%%/classes/database/mysql/Database.php %%GALLERYDIR%%/classes/gallery/User.php %%GALLERYDIR%%/classes/gallery/UserDB.php @@ -29,10 +18,21 @@ %%GALLERYDIR%%/classes/postnuke/UserDB.php %%GALLERYDIR%%/classes/postnuke0.7.1/User.php %%GALLERYDIR%%/classes/postnuke0.7.1/UserDB.php +%%GALLERYDIR%%/classes/Album.php +%%GALLERYDIR%%/classes/AlbumItem.php +%%GALLERYDIR%%/classes/AlbumDB.php +%%GALLERYDIR%%/classes/Database.php +%%GALLERYDIR%%/classes/Comment.php +%%GALLERYDIR%%/classes/EverybodyUser.php +%%GALLERYDIR%%/classes/Image.php +%%GALLERYDIR%%/classes/LoggedInUser.php +%%GALLERYDIR%%/classes/NobodyUser.php +%%GALLERYDIR%%/classes/User.php +%%GALLERYDIR%%/classes/UserDB.php %%GALLERYDIR%%/configure.sh %%GALLERYDIR%%/create_user.php -%%GALLERYDIR%%/css/embedded_style.css.default %%GALLERYDIR%%/css/standalone_style.css.default +%%GALLERYDIR%%/css/embedded_style.css.default %%GALLERYDIR%%/delete_album.php %%GALLERYDIR%%/delete_photo.php %%GALLERYDIR%%/delete_user.php @@ -41,22 +41,22 @@ %%GALLERYDIR%%/edit_caption.php %%GALLERYDIR%%/edit_field.php %%GALLERYDIR%%/edit_thumb.php -%%GALLERYDIR%%/errors/configmode.php %%GALLERYDIR%%/errors/configure_help.php +%%GALLERYDIR%%/errors/configmode.php %%GALLERYDIR%%/errors/configure_instructions.php %%GALLERYDIR%%/errors/needinit.php %%GALLERYDIR%%/errors/reconfigure.php %%GALLERYDIR%%/errors/unconfigured.php %%GALLERYDIR%%/gallery_remote.php -%%GALLERYDIR%%/highlight_photo.php %%GALLERYDIR%%/html/errorRow.inc %%GALLERYDIR%%/html/userData.inc +%%GALLERYDIR%%/highlight_photo.php +%%GALLERYDIR%%/html_wrap/inline_albumthumb.frame.default %%GALLERYDIR%%/html_wrap/album.footer.default %%GALLERYDIR%%/html_wrap/album.header.default %%GALLERYDIR%%/html_wrap/gallery.footer.default %%GALLERYDIR%%/html_wrap/gallery.header.default %%GALLERYDIR%%/html_wrap/inline_albumthumb.footer.default -%%GALLERYDIR%%/html_wrap/inline_albumthumb.frame.default %%GALLERYDIR%%/html_wrap/inline_albumthumb.header.default %%GALLERYDIR%%/html_wrap/inline_gallerythumb.frame.default %%GALLERYDIR%%/html_wrap/inline_moviethumb.frame.default @@ -101,10 +101,10 @@ %%GALLERYDIR%%/init.php %%GALLERYDIR%%/java/ImageTools.jar %%GALLERYDIR%%/js/client_sniff.js +%%GALLERYDIR%%/layout/commentboxbottom.inc %%GALLERYDIR%%/layout/adminbox.inc %%GALLERYDIR%%/layout/breadcrumb.inc %%GALLERYDIR%%/layout/commentbox.inc -%%GALLERYDIR%%/layout/commentboxbottom.inc %%GALLERYDIR%%/layout/commentboxtop.inc %%GALLERYDIR%%/layout/commentdraw.inc %%GALLERYDIR%%/layout/navigator.inc @@ -115,8 +115,8 @@ %%GALLERYDIR%%/modify_user.php %%GALLERYDIR%%/move_album.php %%GALLERYDIR%%/move_photo.php -%%GALLERYDIR%%/platform/fs_unix.php %%GALLERYDIR%%/platform/fs_win32.php +%%GALLERYDIR%%/platform/fs_unix.php %%GALLERYDIR%%/progress_uploading.php %%GALLERYDIR%%/rename_album.php %%GALLERYDIR%%/resize_photo.php @@ -125,9 +125,10 @@ %%GALLERYDIR%%/search.php %%GALLERYDIR%%/secure.sh %%GALLERYDIR%%/session.php +%%GALLERYDIR%%/setup/check_netpbm.php %%GALLERYDIR%%/setup/.htaccess %%GALLERYDIR%%/setup/check.inc -%%GALLERYDIR%%/setup/check_netpbm.php +%%GALLERYDIR%%/setup/mod_rewrite.template %%GALLERYDIR%%/setup/config_data.inc %%GALLERYDIR%%/setup/confirm.inc %%GALLERYDIR%%/setup/constants.inc @@ -136,12 +137,12 @@ %%GALLERYDIR%%/setup/gpl.txt %%GALLERYDIR%%/setup/index.php %%GALLERYDIR%%/setup/init.php -%%GALLERYDIR%%/setup/mod_rewrite.template %%GALLERYDIR%%/setup/php_value.template %%GALLERYDIR%%/setup/php_value_ok.php %%GALLERYDIR%%/setup/phpinfo.php %%GALLERYDIR%%/setup/session_test.php %%GALLERYDIR%%/setup/write.inc +%%GALLERYDIR%%/setup/diagnostics.php %%GALLERYDIR%%/slideshow.php %%GALLERYDIR%%/slideshow_low.php %%GALLERYDIR%%/sort_album.php @@ -153,22 +154,22 @@ %%GALLERYDIR%%/view_comments.php %%GALLERYDIR%%/view_photo.php %%GALLERYDIR%%/view_photo_properties.php -@dirrm %%GALLERYDIR%%/setup -@dirrm %%GALLERYDIR%%/platform -@dirrm %%GALLERYDIR%%/layout -@dirrm %%GALLERYDIR%%/js -@dirrm %%GALLERYDIR%%/java -@dirrm %%GALLERYDIR%%/images -@dirrm %%GALLERYDIR%%/html -@dirrm %%GALLERYDIR%%/errors -@dirrm %%GALLERYDIR%%/classes/postnuke0.7.1 -@dirrm %%GALLERYDIR%%/classes/postnuke -@dirrm %%GALLERYDIR%%/classes/nuke5 -@dirrm %%GALLERYDIR%%/classes/gallery @dirrm %%GALLERYDIR%%/classes/database/mysql @dirrm %%GALLERYDIR%%/classes/database +@dirrm %%GALLERYDIR%%/classes/gallery +@dirrm %%GALLERYDIR%%/classes/nuke5 +@dirrm %%GALLERYDIR%%/classes/postnuke +@dirrm %%GALLERYDIR%%/classes/postnuke0.7.1 @dirrm %%GALLERYDIR%%/classes -%%PORTDOCS%%@dirrm share/doc/gallery +@dirrm %%GALLERYDIR%%/errors +@dirrm %%GALLERYDIR%%/html +@dirrm %%GALLERYDIR%%/images +@dirrm %%GALLERYDIR%%/java +@dirrm %%GALLERYDIR%%/js +@dirrm %%GALLERYDIR%%/layout +@dirrm %%GALLERYDIR%%/platform +@dirrm %%GALLERYDIR%%/setup +@dirrm %%PORTDOCS%%share/doc/gallery @unexec rmdir %D/%%GALLERYDIR%%/html_wrap 2>/dev/null || true @unexec rmdir %D/%%GALLERYDIR%%/css 2>/dev/null || true @unexec rmdir %D/%%GALLERYDIR%% 2>/dev/null || true >Release-Note: >Audit-Trail: >Unformatted: To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-ports" in the body of the message