[pkgsrc/trunk]: pkgsrc/www/geeklog Add security fix of FCKeditor.

[taca <taca%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/ff88b8b4ff89
branches:  trunk
changeset: 546927:ff88b8b4ff89
user:      taca <taca%pkgsrc.org@localhost>
date:      Tue Sep 09 14:34:13 2008 +0000

description:
Add security fix of FCKeditor.

        http://www.geeklog.net/article.php/file-uploads

Bump PKGREVISION.

diffstat:

 www/geeklog/Makefile         |   4 ++--
 www/geeklog/distinfo         |   3 ++-
 www/geeklog/patches/patch-ai |  17 +++++++++++++++++
 3 files changed, 21 insertions(+), 3 deletions(-)

diffs (50 lines):

diff -r d72ef41fa1b3 -r ff88b8b4ff89 www/geeklog/Makefile
--- a/www/geeklog/Makefile      Tue Sep 09 14:01:46 2008 +0000
+++ b/www/geeklog/Makefile      Tue Sep 09 14:34:13 2008 +0000
@@ -1,9 +1,9 @@
-# $NetBSD: Makefile,v 1.19 2008/06/20 01:09:41 joerg Exp $
+# $NetBSD: Makefile,v 1.20 2008/09/09 14:34:13 taca Exp $
 #
 
 DISTNAME=      geeklog-${VER}
 PKGNAME=       geeklog-${VER:C/(sr|-)/./g}
-PKGREVISION=   2
+PKGREVISION=   3
 CATEGORIES=    www
 MASTER_SITES=  http://www.geeklog.net/filemgmt/upload_dir/
 
diff -r d72ef41fa1b3 -r ff88b8b4ff89 www/geeklog/distinfo
--- a/www/geeklog/distinfo      Tue Sep 09 14:01:46 2008 +0000
+++ b/www/geeklog/distinfo      Tue Sep 09 14:34:13 2008 +0000
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.7 2008/06/19 14:08:42 taca Exp $
+$NetBSD: distinfo,v 1.8 2008/09/09 14:34:13 taca Exp $
 
 SHA1 (geeklog-1.4.1.tar.gz) = c323c29b523598b97d7e0957435c0ec0c31cb290
 RMD160 (geeklog-1.4.1.tar.gz) = bfac9946b34d0254fedd3a54cf742b044d347a3c
@@ -8,3 +8,4 @@
 SHA1 (patch-ac) = e5523aab7a13f014ecb961a53f8d962115c4d7b4
 SHA1 (patch-ag) = 207ef0801d865ff16d2a99f0732ea0cb49ce2ad5
 SHA1 (patch-ah) = 376e1208f0ec332e9da243a9a475d5569158d6d3
+SHA1 (patch-ai) = eff7c257032feb8fcfd81a44f560e5e747d41610
diff -r d72ef41fa1b3 -r ff88b8b4ff89 www/geeklog/patches/patch-ai
--- /dev/null   Thu Jan 01 00:00:00 1970 +0000
+++ b/www/geeklog/patches/patch-ai      Tue Sep 09 14:34:13 2008 +0000
@@ -0,0 +1,17 @@
+$NetBSD: patch-ai,v 1.1 2008/09/09 14:34:13 taca Exp $
+
+Security fix for FCKeditor uploading files.
+
+--- public_html/fckeditor/editor/filemanager/upload/php/upload.php.orig        2006-06-18 06:25:36.000000000 +0900
++++ public_html/fckeditor/editor/filemanager/upload/php/upload.php
+@@ -18,6 +18,10 @@
+  *            Frederico Caldeira Knabben (fredck%fckeditor.net@localhost)
+  */
+ 
++if (strpos($_SERVER['PHP_SELF'], 'upload.php') !== false) {
++    die('This file can not be used on its own!');
++}
++
+ require('config.php') ;
+ require('util.php') ;
+