diff options
| author | Yen-Ming Lee <leeym@FreeBSD.org> | 2002-12-20 18:15:44 +0000 |
|---|---|---|
| committer | Yen-Ming Lee <leeym@FreeBSD.org> | 2002-12-20 18:15:44 +0000 |
| commit | d3a9a80ea4fad08f22f6a7a58e2f4bc8320c268c (patch) | |
| tree | 2b8572c41e3da312bd9fb7ecb2248465dd5df856 /mail/openwebmail/files | |
| parent | Patch to fix build on beast (diff) | |
1. disable sending report and unforbid openwebmail
2. add security patch
3. clear pkg-plist
Submitted by: 2. http://openwebmail.org/openwebmail/download/cert/advisories/SA-02:01.txt
Reviewed by: portmgr, tung@turtle.ee.ncku.edu.tw (author)
Approved by: 1. Steve Price (portmgr)
Notes
Notes:
svn path=/head/; revision=71744
Diffstat (limited to 'mail/openwebmail/files')
| -rw-r--r-- | mail/openwebmail/files/patch-cgi-bin::openwebmail::openwebmail-tool.pl | 10 | ||||
| -rw-r--r-- | mail/openwebmail/files/patch-cgi-bin::openwebmail::ow-shared.pl | 24 |
2 files changed, 34 insertions, 0 deletions
diff --git a/mail/openwebmail/files/patch-cgi-bin::openwebmail::openwebmail-tool.pl b/mail/openwebmail/files/patch-cgi-bin::openwebmail::openwebmail-tool.pl new file mode 100644 index 000000000000..1024d05e1b65 --- /dev/null +++ b/mail/openwebmail/files/patch-cgi-bin::openwebmail::openwebmail-tool.pl @@ -0,0 +1,10 @@ +--- cgi-bin/openwebmail/openwebmail-tool.pl.orig Wed Dec 18 21:10:06 2002 ++++ cgi-bin/openwebmail/openwebmail-tool.pl Wed Dec 18 21:14:14 2002 +@@ -325,6 +325,7 @@ + print "done.\n"; + } + ++ return 0; + my $id = $ENV{'USER'} || $ENV{'LOGNAME'} || getlogin || (getpwuid($>))[0]; + my $hostname=hostname(); + my $realname=(getpwnam($id))[6]||$id; diff --git a/mail/openwebmail/files/patch-cgi-bin::openwebmail::ow-shared.pl b/mail/openwebmail/files/patch-cgi-bin::openwebmail::ow-shared.pl new file mode 100644 index 000000000000..9ec111e8cf83 --- /dev/null +++ b/mail/openwebmail/files/patch-cgi-bin::openwebmail::ow-shared.pl @@ -0,0 +1,24 @@ +--- cgi-bin/openwebmail/ow-shared.pl.orig Tue Nov 26 20:20:51 2002 ++++ cgi-bin/openwebmail/ow-shared.pl Sat Dec 21 01:07:47 2002 +@@ -231,6 +231,9 @@ + sub readconf { + my ($r_config, $r_config_raw, $configfile)=@_; + ++ if ($configfile=~/\.\./) { # .. in path is not allowed for higher security ++ openwebmailerror("Invalid config file path $configfile"); ++ } + # read config + open(CONFIG, $configfile) or + openwebmailerror("Couldn't open config file $configfile"); +@@ -340,6 +343,11 @@ + } + } + ++ # remove / and .. from variables that will be used in require statement for security ++ foreach $key ( 'default_language', 'auth_module') { ++ ${$r_config}{$key} =~ s|/||g; ++ ${$r_config}{$key} =~ s|\.\.||g; ++ } + # untaint pathname variable defined in openwebmail.conf + foreach $key ( 'smtpserver', 'auth_module', 'virtusertable', + 'mailspooldir', 'homedirspoolname', 'homedirfolderdirname', |