[Pkg-drupal-commits] r1997 - in /branches/drupal6/debian: changelog patches/00list patches/13_SA-CORE-2009-001.dpatch

luigi at users.alioth.debian.org luigi at users.alioth.debian.org
Fri Jan 16 00:50:35 UTC 2009


Author: luigi
Date: Fri Jan 16 00:50:34 2009
New Revision: 1997

URL: http://svn.debian.org/wsvn/pkg-drupal/?sc=1&rev=1997
Log:
Added upstream patch fixing multiple vulnerabilities (Ref: SA-CORE-2009-001, CVE-TBD)

Added:
    branches/drupal6/debian/patches/13_SA-CORE-2009-001.dpatch   (with props)
Modified:
    branches/drupal6/debian/changelog
    branches/drupal6/debian/patches/00list

Modified: branches/drupal6/debian/changelog
URL: http://svn.debian.org/wsvn/pkg-drupal/branches/drupal6/debian/changelog?rev=1997&op=diff
==============================================================================
--- branches/drupal6/debian/changelog (original)
+++ branches/drupal6/debian/changelog Fri Jan 16 00:50:34 2009
@@ -1,6 +1,10 @@
 drupal6 (6.6-3) UNRELEASED; urgency=low
 
   * NOT RELEASED YET
+
+  * debian/patches/13_SA-CORE-2009-001
+    - Added upstream patch fixing multiple vulnerabilities
+      (Ref: SA-CORE-2009-001, CVE-TBD)
 
  -- Luigi Gangitano <luigi at debian.org>  Fri, 16 Jan 2009 01:49:58 +0100
 

Modified: branches/drupal6/debian/patches/00list
URL: http://svn.debian.org/wsvn/pkg-drupal/branches/drupal6/debian/patches/00list?rev=1997&op=diff
==============================================================================
--- branches/drupal6/debian/patches/00list (original)
+++ branches/drupal6/debian/patches/00list Fri Jan 16 00:50:34 2009
@@ -1,2 +1,3 @@
 10_cronjob
 12_SA-2008-073
+13_SA-CORE-2009-001

Added: branches/drupal6/debian/patches/13_SA-CORE-2009-001.dpatch
URL: http://svn.debian.org/wsvn/pkg-drupal/branches/drupal6/debian/patches/13_SA-CORE-2009-001.dpatch?rev=1997&op=file
==============================================================================
--- branches/drupal6/debian/patches/13_SA-CORE-2009-001.dpatch (added)
+++ branches/drupal6/debian/patches/13_SA-CORE-2009-001.dpatch Fri Jan 16 00:50:34 2009
@@ -1,0 +1,84 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 13_SA-CORE-2009-001.dpatch by Luigi Gangitano <luigi at debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Upstream patch fixing SQL Injection vulnerability (SA-CORE-2009-001)
+
+ at DPATCH@
+diff -urNad drupal6~/modules/node/node.module drupal6/modules/node/node.module
+--- drupal6~/modules/node/node.module	2008-08-11 19:12:42.000000000 +0200
++++ drupal6/modules/node/node.module	2009-01-16 01:46:45.000000000 +0100
+@@ -1979,7 +1979,9 @@
+ function node_access($op, $node, $account = NULL) {
+   global $user;
+ 
+-  if (!$node) {
++  if (!$node || !in_array($op, array('view', 'update', 'delete', 'create'), TRUE)) {
++    // If there was no node to check against, or the $op was not one of the
++    // supported ones, we return access denied.
+     return FALSE;
+   }
+   // Convert the node to an object if necessary:
+diff -urNad drupal6~/modules/translation/translation.module drupal6/modules/translation/translation.module
+--- drupal6~/modules/translation/translation.module	2008-10-24 23:07:18.000000000 +0200
++++ drupal6/modules/translation/translation.module	2009-01-16 01:46:56.000000000 +0100
+@@ -76,10 +76,7 @@
+  * all languages).
+  */
+ function _translation_tab_access($node) {
+-  if (!empty($node->language) && translation_supported_type($node->type)) {
+-    return user_access('translate content');
+-  }
+-  return FALSE;
++  return !empty($node->language) && translation_supported_type($node->type) && node_access('view', $node) && user_access('translate content');
+ }
+ 
+ /**
+@@ -192,15 +189,27 @@
+ 
+   switch ($op) {
+     case 'prepare':
+-      if (empty($node->nid) && isset($_GET['translation']) && isset($_GET['language']) &&
+-          ($source_nid = $_GET['translation']) && ($language = $_GET['language']) &&
+-          (user_access('translate content'))) {
+-        // We are translating a node from a source node, so
+-        // load the node to be translated and populate fields.
+-        $node->language = $language;
+-        $node->translation_source = node_load($source_nid);
+-        $node->title = $node->translation_source->title;
+-        $node->body = $node->translation_source->body;
++      if (empty($node->nid) && user_access('translate content') && isset($_GET['translation']) && isset($_GET['language']) && is_numeric($_GET['translation'])) {
++        $translation_source = node_load($_GET['translation']);
++        if (empty($translation_source) || !node_access('view', $translation_source)) {
++          // Source node not found or no access to view. We should not check
++          // for edit access, since the translator might not have permissions
++          // to edit the source node but should still be able to translate.
++          return;
++        }
++        $language_list = language_list();
++        if (!isset($language_list[$_GET['language']]) || ($translation_source->language == $_GET['language'])) {
++          // If not supported language, or same language as source node, break.
++          return;
++        }
++        // Populate fields based on source node.
++        $node->language = $_GET['language'];
++        $node->translation_source = $translation_source;
++        $node->title = $translation_source->title;
++        // If user has no access to the filter used for the body, Drupal core
++        // does not let the edit form to appear, so we should avoid exposing
++        // the source text here too.
++        $node->body = filter_access($translation_source->format) ? $translation_source->body : '';
+         // Let every module add custom translated fields.
+         node_invoke_nodeapi($node, 'prepare translation');
+       }
+diff -urNad drupal6~/modules/user/user.module drupal6/modules/user/user.module
+--- drupal6~/modules/user/user.module	2008-10-21 00:00:36.000000000 +0200
++++ drupal6/modules/user/user.module	2009-01-16 01:47:05.000000000 +0100
+@@ -1532,6 +1532,7 @@
+       $form['picture']['picture_delete'] = array('#type' => 'hidden');
+     }
+     $form['picture']['picture_upload'] = array('#type' => 'file', '#title' => t('Upload picture'), '#size' => 48, '#description' => t('Your virtual face or picture. Maximum dimensions are %dimensions and the maximum size is %size kB.', array('%dimensions' => variable_get('user_picture_dimensions', '85x85'), '%size' => variable_get('user_picture_file_size', '30'))) .' '. variable_get('user_picture_guidelines', ''));
++    $form['#validate'][] = 'user_profile_form_validate';
+     $form['#validate'][] = 'user_validate_picture';
+   }
+   $form['#uid'] = $uid;

Propchange: branches/drupal6/debian/patches/13_SA-CORE-2009-001.dpatch
------------------------------------------------------------------------------
    svn:executable = *




More information about the Pkg-drupal-commits mailing list