Patch for security bug #97650

Package-Manager: portage-2.0.51.19

5 files changed, 96 insertions, 2 deletions

diff --git a/www-apps/b2evolution/ChangeLog b/www-apps/b2evolution/ChangeLog
index d073f7994f3b..9a3353bb8e2d 100644
--- a/www-apps/b2evolution/ChangeLog
+++ b/www-apps/b2evolution/ChangeLog
@@ -1,6 +1,12 @@
 # ChangeLog for www-apps/b2evolution
 # Copyright 1999-2005 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/www-apps/b2evolution/ChangeLog,v 1.2 2005/06/19 21:03:25 dostrow Exp $
+# $Header: /var/cvsroot/gentoo-x86/www-apps/b2evolution/ChangeLog,v 1.3 2005/07/05 23:39:34 stuart Exp $
+
+*b2evolution-0.9.0.11-r1 (06 Jul 2005)
+
+  06 Jul 2005; Stuart Herbert <stuart@gentoo.org>
+  +files/b2evolution-0.9.0.11.xmlrpc.patch, +b2evolution-0.9.0.11-r1.ebuild:
+  Patch for security bug #97650
 
   19 Jun 2005; Daniel Ostrow <dostrow@gentoo.org>
   b2evolution-0.9.0.11.ebuild:
diff --git a/www-apps/b2evolution/Manifest b/www-apps/b2evolution/Manifest
index ef98e8d30d6e..96d2a058b368 100644
--- a/www-apps/b2evolution/Manifest
+++ b/www-apps/b2evolution/Manifest
@@ -1,5 +1,8 @@
-MD5 9c63a268dea1f61ba0065e6299f81016 ChangeLog 562
+MD5 cca9deeab6be46f2d3d94cdf13f06f80 ChangeLog 761
 MD5 b51fbfc2820333de9dc0a8c1a36670f9 b2evolution-0.9.0.11.ebuild 1446
 MD5 a87207b3b148a8e1057c02dad9d02af8 metadata.xml 247
+MD5 d9bf14b37af1e9310542a0e4319e8652 b2evolution-0.9.0.11-r1.ebuild 1503
 MD5 e57db6ef581b931b9954af9b12359894 files/digest-b2evolution-0.9.0.11 82
 MD5 d584b5d4ec8d7378cbfcc77cde85306d files/postinstall-en.txt 340
+MD5 5a1f32b5f7da0414529e5b8ef583bb44 files/b2evolution-0.9.0.11.xmlrpc.patch 1157
+MD5 e57db6ef581b931b9954af9b12359894 files/digest-b2evolution-0.9.0.11-r1 82
diff --git a/www-apps/b2evolution/b2evolution-0.9.0.11-r1.ebuild b/www-apps/b2evolution/b2evolution-0.9.0.11-r1.ebuild
new file mode 100644
index 000000000000..7ae687454eae
--- /dev/null
+++ b/www-apps/b2evolution/b2evolution-0.9.0.11-r1.ebuild
@@ -0,0 +1,55 @@
+# Copyright 1999-2005 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/www-apps/b2evolution/b2evolution-0.9.0.11-r1.ebuild,v 1.1 2005/07/05 23:39:34 stuart Exp $
+
+inherit webapp eutils
+
+MY_EXT="d-2004-09-22"
+
+DESCRIPTION="Multilingual multiuser multi-blog engine"
+HOMEPAGE="http://www.b2evolution.net"
+SRC_URI="mirror://sourceforge/evocms/${P}${MY_EXT}.zip"
+LICENSE="GPL-2"
+KEYWORDS="~ppc ~x86"
+IUSE=""
+RDEPEND=">=dev-php/mod_php-4.1
+	 >=dev-db/mysql-3.23.23"
+
+DEPEND="${DEPEND} ${RDEPEND}
+	>=net-www/webapp-config-1.10-r5
+	app-arch/unzip"
+
+S="${WORKDIR}/${PN}"
+
+src_unpack() {
+	unpack ${A}
+	cd ${S}
+
+	epatch ${FILESDIR}/b2evolution-0.9.0.11.xmlrpc.patch
+
+	# http://secunia.com/advisories/13718/
+	sed -i "s:post_urltitle = '\$title'\";:post_urltitle = \".\$DB->quote(\$title);:" \
+		blogs/b2evocore/_class_itemlist.php
+}
+
+src_install() {
+	webapp_src_preinst
+
+	einfo "Installing main files"
+	cp -r blogs/* ${D}${MY_HTDOCSDIR}
+	einfo "Done"
+
+	dodoc doc/license.txt doc/install_new.html doc/upgradefrom_b2evo.html doc/upgradefrom_b2.html \
+		doc/upgradefrom_gl.html doc/upgradefrom_miniblog.html doc/upgradefrom_mt.html
+
+	# Identify the configuration files that this app uses
+	# User can want to make changes to these!
+	webapp_serverowned ${MY_HTDOCSDIR}/conf/_config.php
+	webapp_serverowned ${MY_HTDOCSDIR}
+
+	# post-install instructions
+	webapp_postinst_txt en ${FILESDIR}/postinstall-en.txt
+
+	# now strut stuff
+	webapp_src_install
+}
diff --git a/www-apps/b2evolution/files/b2evolution-0.9.0.11.xmlrpc.patch b/www-apps/b2evolution/files/b2evolution-0.9.0.11.xmlrpc.patch
new file mode 100644
index 000000000000..513e08027eac
--- /dev/null
+++ b/www-apps/b2evolution/files/b2evolution-0.9.0.11.xmlrpc.patch
@@ -0,0 +1,29 @@
+--- b2evolution/blogs/b2evocore/_functions_xmlrpc.php.old	2005-07-05 10:34:29.000000000 +0200
++++ b2evolution/blogs/b2evocore/_functions_xmlrpc.php	2005-07-05 10:36:01.000000000 +0200
+@@ -226,7 +226,7 @@
+ 		$_xh[$parser]['qt']=0;

+ 	  break;

+ 	case "NAME":

+-	  $_xh[$parser]['st'].="'"; $_xh[$parser]['ac']="";

++	  $_xh[$parser]['st'].='"'; $_xh[$parser]['ac']="";

+ 	  break;

+ 	case "FAULT":

+ 	  $_xh[$parser]['isf']=1;

+@@ -292,7 +292,7 @@
+ 	  $_xh[$parser]['cm']--;

+ 	  break;

+ 	case "NAME":

+-	  $_xh[$parser]['st'].= $_xh[$parser]['ac'] . "' => ";

++	  $_xh[$parser]['st'].= $_xh[$parser]['ac'] . '" => ';

+ 	  break;

+ 	case "BOOLEAN":

+ 		// special case here: we translate boolean 1 or 0 into PHP

+@@ -313,7 +313,7 @@
+ 			// we use double quotes rather than single so backslashification works OK

+ 			$_xh[$parser]['st'].="\"". $_xh[$parser]['ac'] . "\""; 

+ 		} else if ($_xh[$parser]['qt']==2) {

+-			$_xh[$parser]['st'].="base64_decode('". $_xh[$parser]['ac'] . "')"; 

++			$_xh[$parser]['st'].='base64_decode("'. $_xh[$parser]['ac'] . '")'; 

+ 		} else if ($name=="BOOLEAN") {

+ 			$_xh[$parser]['st'].=$_xh[$parser]['ac'];

+ 		} else {

diff --git a/www-apps/b2evolution/files/digest-b2evolution-0.9.0.11-r1 b/www-apps/b2evolution/files/digest-b2evolution-0.9.0.11-r1
new file mode 100644
index 000000000000..ab28aea581d8
--- /dev/null
+++ b/www-apps/b2evolution/files/digest-b2evolution-0.9.0.11-r1
@@ -0,0 +1 @@
+MD5 ff1e9f440e84f206bc82b543dd42c539 b2evolution-0.9.0.11d-2004-09-22.zip 2262989