[pkgsrc/pkgsrc-2008Q2]: pkgsrc/www/geeklog Pullup ticket #2522 - requested by...

[tron <tron%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/f00e97c93a45
branches:  pkgsrc-2008Q2
changeset: 544316:f00e97c93a45
user:      tron <tron%pkgsrc.org@localhost>
date:      Wed Sep 10 10:30:49 2008 +0000

description:
Pullup ticket #2522 - requested by taca
geeklog: security patch

Revisions pulled up:
- www/geeklog/Makefile          1.20
- www/geeklog/distinfo          1.8
- www/geeklog/patches/patch-ai  1.1
---
Module Name:    pkgsrc
Committed By:   taca
Date:           Tue Sep  9 14:34:13 UTC 2008

Modified Files:
        pkgsrc/www/geeklog: Makefile distinfo
Added Files:
        pkgsrc/www/geeklog/patches: patch-ai

Log Message:
Add security fix of FCKeditor.

        http://www.geeklog.net/article.php/file-uploads

Bump PKGREVISION.

diffstat:

 www/geeklog/Makefile         |   4 ++--
 www/geeklog/distinfo         |   3 ++-
 www/geeklog/patches/patch-ai |  17 +++++++++++++++++
 3 files changed, 21 insertions(+), 3 deletions(-)

diffs (50 lines):

diff -r 615211e8823f -r f00e97c93a45 www/geeklog/Makefile
--- a/www/geeklog/Makefile      Sun Sep 07 11:55:20 2008 +0000
+++ b/www/geeklog/Makefile      Wed Sep 10 10:30:49 2008 +0000
@@ -1,9 +1,9 @@
-# $NetBSD: Makefile,v 1.19 2008/06/20 01:09:41 joerg Exp $
+# $NetBSD: Makefile,v 1.19.4.1 2008/09/10 10:30:49 tron Exp $
 #
 
 DISTNAME=      geeklog-${VER}
 PKGNAME=       geeklog-${VER:C/(sr|-)/./g}
-PKGREVISION=   2
+PKGREVISION=   3
 CATEGORIES=    www
 MASTER_SITES=  http://www.geeklog.net/filemgmt/upload_dir/
 
diff -r 615211e8823f -r f00e97c93a45 www/geeklog/distinfo
--- a/www/geeklog/distinfo      Sun Sep 07 11:55:20 2008 +0000
+++ b/www/geeklog/distinfo      Wed Sep 10 10:30:49 2008 +0000
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.7 2008/06/19 14:08:42 taca Exp $
+$NetBSD: distinfo,v 1.7.4.1 2008/09/10 10:30:49 tron Exp $
 
 SHA1 (geeklog-1.4.1.tar.gz) = c323c29b523598b97d7e0957435c0ec0c31cb290
 RMD160 (geeklog-1.4.1.tar.gz) = bfac9946b34d0254fedd3a54cf742b044d347a3c
@@ -8,3 +8,4 @@
 SHA1 (patch-ac) = e5523aab7a13f014ecb961a53f8d962115c4d7b4
 SHA1 (patch-ag) = 207ef0801d865ff16d2a99f0732ea0cb49ce2ad5
 SHA1 (patch-ah) = 376e1208f0ec332e9da243a9a475d5569158d6d3
+SHA1 (patch-ai) = eff7c257032feb8fcfd81a44f560e5e747d41610
diff -r 615211e8823f -r f00e97c93a45 www/geeklog/patches/patch-ai
--- /dev/null   Thu Jan 01 00:00:00 1970 +0000
+++ b/www/geeklog/patches/patch-ai      Wed Sep 10 10:30:49 2008 +0000
@@ -0,0 +1,17 @@
+$NetBSD: patch-ai,v 1.1.2.2 2008/09/10 10:30:49 tron Exp $
+
+Security fix for FCKeditor uploading files.
+
+--- public_html/fckeditor/editor/filemanager/upload/php/upload.php.orig        2006-06-18 06:25:36.000000000 +0900
++++ public_html/fckeditor/editor/filemanager/upload/php/upload.php
+@@ -18,6 +18,10 @@
+  *            Frederico Caldeira Knabben (fredck%fckeditor.net@localhost)
+  */
+ 
++if (strpos($_SERVER['PHP_SELF'], 'upload.php') !== false) {
++    die('This file can not be used on its own!');
++}
++
+ require('config.php') ;
+ require('util.php') ;
+