diff options
| author | Renato Botelho <garga@FreeBSD.org> | 2019-08-21 19:22:03 +0000 |
|---|---|---|
| committer | Renato Botelho <garga@FreeBSD.org> | 2019-08-21 19:22:03 +0000 |
| commit | 52892ad53d85fe4e874040b75d88be562175cc5d (patch) | |
| tree | a6e9559c64524c8a70d355bbcefb3d41fe80af25 /mail/dma/files/fix-security-hole.patch | |
| parent | x11-wm/fvwm-crystal: force python to 2.7, change MASTER_SITE (diff) | |
mail/dma: Update to 0.12
Sponsored by: Rubicon Communications, LLC (Netgate)
Diffstat (limited to 'mail/dma/files/fix-security-hole.patch')
| -rw-r--r-- | mail/dma/files/fix-security-hole.patch | 34 |
1 files changed, 0 insertions, 34 deletions
diff --git a/mail/dma/files/fix-security-hole.patch b/mail/dma/files/fix-security-hole.patch deleted file mode 100644 index 9efd7bd76985..000000000000 --- a/mail/dma/files/fix-security-hole.patch +++ /dev/null @@ -1,34 +0,0 @@ -From f249aa412dd4a09881cb450390d1003815bd0013 Mon Sep 17 00:00:00 2001 -From: Zach Crownover <zachary.crownover@gmail.com> -Date: Fri, 5 Aug 2016 15:24:27 -0700 -Subject: [PATCH] dma - Fix security hole (#46) - -Affecting DragonFly 4.6 and earlier, Matt Dillon fixed this in base after -finding out from BSDNow Episode 152. Comments following were from his commit -which explains better than I. Just taking his change and putting it here as well. - -* dma makes an age-old mistake of not properly checking whether a file - owned by a user is a symlink or not, a bug which the original mail.local - also had. - -* Add O_NOFOLLOW to disallow symlinks. - -Thanks-to: BSDNow Episode 152, made me dive dma to check when they talked - about the mail.local bug. ---- - dma-mbox-create.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/dma-mbox-create.c b/dma-mbox-create.c -index 532a7af..45a4792 100644 ---- a/dma-mbox-create.c -+++ b/dma-mbox-create.c -@@ -142,7 +142,7 @@ main(int argc, char **argv) - logfail(EX_CANTCREAT, "cannot build mbox path for `%s/%s'", _PATH_MAILDIR, user); - } - -- f = open(fn, O_RDONLY|O_CREAT, 0600); -+ f = open(fn, O_RDONLY|O_CREAT|O_NOFOLLOW, 0600); - if (f < 0) - logfail(EX_NOINPUT, "cannt open mbox `%s'", fn); - |
