[Pkg-bugzilla-commits] r99 - in trunk/bugzilla-2.18/debian: . patches

[Alexis Sukrieh]

Author: sukria-guest
Date: 2005-06-11 13:11:11 +0000 (Sat, 11 Jun 2005)
New Revision: 99

Added:
   trunk/bugzilla-2.18/debian/patches/00_security_287436.dpatch
Modified:
   trunk/bugzilla-2.18/debian/bugzilla.postinst
   trunk/bugzilla-2.18/debian/patches/00list
Log:
Adding the upstream patch for cloing Bugzilla's #287436

Modified: trunk/bugzilla-2.18/debian/bugzilla.postinst
===================================================================
--- trunk/bugzilla-2.18/debian/bugzilla.postinst	2005-06-11 12:40:33 UTC (rev 98)
+++ trunk/bugzilla-2.18/debian/bugzilla.postinst	2005-06-11 13:11:11 UTC (rev 99)
@@ -43,7 +43,6 @@
 			ucf --debconf-ok $file_source $file_dest || exit 11
 		fi
 		chown www-data:www-data $file_dest
-		#rm -f $file_source
 	fi
 }
 
@@ -72,10 +71,11 @@
 	$postinst_db || exit 2
 
 	# The answer file has been generated by $postinst_db before
+	# if not, we propably choose not to install bugzilla now.
 	answerfile=/usr/share/bugzilla/debian/checksetup-answer.conf.pl
 	if [ ! -f $answerfile ]; then
-		echo "Cannot find answer file for checksetup.pl" >&2
-		exit 3
+		debug "Cannot find answer file for checksetup.pl" 
+		exit 0
 	fi
 	
 	# We want checksetup.pl to write the new params file in params.new

Added: trunk/bugzilla-2.18/debian/patches/00_security_287436.dpatch
===================================================================
--- trunk/bugzilla-2.18/debian/patches/00_security_287436.dpatch	2005-06-11 12:40:33 UTC (rev 98)
+++ trunk/bugzilla-2.18/debian/patches/00_security_287436.dpatch	2005-06-11 13:11:11 UTC (rev 99)
@@ -0,0 +1,57 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 00_security_287436.dpatch by Alexis Sukrieh <sukria@sukria.net>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Upstream security fix of #287436 - After having logged in, links to change the report type contain username and password
+
+@DPATCH@
+diff -urNad bugzilla-2.18/Bugzilla/Auth/CGI.pm /tmp/dpep.bohyzB/bugzilla-2.18/Bugzilla/Auth/CGI.pm
+--- bugzilla-2.18/Bugzilla/Auth/CGI.pm	2005-02-10 09:09:52.000000000 +0100
++++ /tmp/dpep.bohyzB/bugzilla-2.18/Bugzilla/Auth/CGI.pm	2005-06-11 15:02:14.000000000 +0200
+@@ -48,6 +48,8 @@
+     # First, try the actual login method against form variables
+     my $username = $cgi->param("Bugzilla_login");
+     my $passwd = $cgi->param("Bugzilla_password");
++    
++    $cgi->delete('Bugzilla_login', 'Bugzilla_password');
+ 
+     my $authmethod = Param("loginmethod");
+     my ($authres, $userid, $extra, $info) =
+diff -urNad bugzilla-2.18/chart.cgi /tmp/dpep.bohyzB/bugzilla-2.18/chart.cgi
+--- bugzilla-2.18/chart.cgi	2005-06-11 15:01:07.000000000 +0200
++++ /tmp/dpep.bohyzB/bugzilla-2.18/chart.cgi	2005-06-11 15:02:14.000000000 +0200
+@@ -284,8 +284,7 @@
+     $vars->{'time'} = time();
+ 
+     $vars->{'imagebase'} = $cgi->canonicalise_query(
+-                "action", "action-wrap", "ctype", "format", "width", "height",
+-                "Bugzilla_login", "Bugzilla_password");
++                "action", "action-wrap", "ctype", "format", "width", "height");
+ 
+     print $cgi->header();
+     $template->process("reports/chart.html.tmpl", $vars)
+diff -urNad bugzilla-2.18/userprefs.cgi /tmp/dpep.bohyzB/bugzilla-2.18/userprefs.cgi
+--- bugzilla-2.18/userprefs.cgi	2005-06-11 15:01:07.000000000 +0200
++++ /tmp/dpep.bohyzB/bugzilla-2.18/userprefs.cgi	2005-06-11 15:02:14.000000000 +0200
+@@ -327,12 +327,19 @@
+ # Live code (not subroutine definitions) starts here
+ ###############################################################################
+ 
++my $cgi = Bugzilla->cgi;
++
++# This script needs direct access to the username and password CGI variables,
++# so we save them before their removal in Bugzilla->login
++my $bugzilla_login    = $cgi->param('Bugzilla_login');
++my $bugzilla_password = $cgi->param('Bugzilla_password');
++
+ Bugzilla->login(LOGIN_REQUIRED);
++$cgi->param('Bugzilla_login', $bugzilla_login);
++$cgi->param('Bugzilla_password', $bugzilla_password);
+ 
+ GetVersionTable();
+ 
+-my $cgi = Bugzilla->cgi;
+-
+ $vars->{'changes_saved'} = $cgi->param('dosave');
+ 
+ my $current_tab_name = $cgi->param('tab') || "account";


Property changes on: trunk/bugzilla-2.18/debian/patches/00_security_287436.dpatch
___________________________________________________________________
Name: svn:executable
   + *

Modified: trunk/bugzilla-2.18/debian/patches/00list
===================================================================
--- trunk/bugzilla-2.18/debian/patches/00list	2005-06-11 12:40:33 UTC (rev 98)
+++ trunk/bugzilla-2.18/debian/patches/00list	2005-06-11 13:11:11 UTC (rev 99)
@@ -1,3 +1,4 @@
+00_security_287436
 01_libpath
 01_datadir
 02_checksetup