From owner-freebsd-ports-bugs@FreeBSD.ORG Mon Apr 2 01:20:09 2007 Return-Path: X-Original-To: freebsd-ports-bugs@hub.freebsd.org Delivered-To: freebsd-ports-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 66B9416A401 for ; Mon, 2 Apr 2007 01:20:09 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [69.147.83.40]) by mx1.freebsd.org (Postfix) with ESMTP id 30F8913C45E for ; Mon, 2 Apr 2007 01:20:09 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.13.4/8.13.4) with ESMTP id l321K98W005922 for ; Mon, 2 Apr 2007 01:20:09 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.13.4/8.13.4/Submit) id l321K9wA005920; Mon, 2 Apr 2007 01:20:09 GMT (envelope-from gnats) Resent-Date: Mon, 2 Apr 2007 01:20:09 GMT Resent-Message-Id: <200704020120.l321K9wA005920@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-ports-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Yasushi Hayashi Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 9D63916A403 for ; Mon, 2 Apr 2007 01:12:22 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (www.freebsd.org [69.147.83.33]) by mx1.freebsd.org (Postfix) with ESMTP id 8E72B13C4B0 for ; Mon, 2 Apr 2007 01:12:22 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.13.1/8.13.1) with ESMTP id l321CM2Y091541 for ; Mon, 2 Apr 2007 01:12:22 GMT (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.13.1/8.13.1/Submit) id l3217Kxv090966; Mon, 2 Apr 2007 01:07:21 GMT (envelope-from nobody) Message-Id: <200704020107.l3217Kxv090966@www.freebsd.org> Date: Mon, 2 Apr 2007 01:07:21 GMT From: Yasushi Hayashi To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-3.0 Cc: Subject: ports/111119: [update] www/zope change to FORBIDDEN X-BeenThere: freebsd-ports-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Ports bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 02 Apr 2007 01:20:09 -0000 >Number: 111119 >Category: ports >Synopsis: [update] www/zope change to FORBIDDEN >Confidential: no >Severity: serious >Priority: low >Responsible: freebsd-ports-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: change-request >Submitter-Id: current-users >Arrival-Date: Mon Apr 02 01:20:08 GMT 2007 >Closed-Date: >Last-Modified: >Originator: Yasushi Hayashi >Release: FreeBSD 6.2-STABLE i386 >Organization: >Environment: FreeBSD www.yasi.to 6.2-STABLE FreeBSD 6.2-STABLE #5: Fri Mar 30 14:25:55 JST 2007 yasi@www.yasi.to:/usr/obj/usr/src/sys/GENERIC i386 >Description: Zope.org announced cross-site scripting vulnerability in Zope 2.7.x. But there is no Hotfix supported offcially. See: http://www.zope.org/Products/Zope/Hotfix-2007-03-20/Hotfix-20070320/README.txt The time has come that Zope 2.7.x should be FORBIDDEN. Next, I MUST change Mk/bsd.python.mk to remove Zope 2.7.x. But I don't have certain idea for it. >How-To-Repeat: >Fix: Patch attached with submission follows: diff -urN /usr/ports/www/zope.old/Makefile /usr/ports/www/zope/Makefile --- /usr/ports/www/zope.old/Makefile Mon Apr 2 09:15:40 2007 +++ /usr/ports/www/zope/Makefile Mon Apr 2 09:21:00 2007 @@ -17,6 +17,8 @@ MAINTAINER= estartu@augusta.de COMMENT= An object-based web application platform +FORBIDDEN= There is NO official supported HotFix for cross-site-scripting vulnerability. + WRKSRC= ${WRKDIR}/Zope-${PORTVERSION}-final USE_PYTHON= 2.3 USE_RC_SUBR= yes >Release-Note: >Audit-Trail: >Unformatted: