[pkgsrc/trunk]: pkgsrc/www/awstats Fix XSS (http://secunia.com/advisories/315...

[minskim <minskim%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/263d8818e71c
branches:  trunk
changeset: 546079:263d8818e71c
user:      minskim <minskim%pkgsrc.org@localhost>
date:      Wed Aug 20 21:20:33 2008 +0000

description:
Fix XSS (http://secunia.com/advisories/31519/).  Bump PKGREVISION.

diffstat:

 www/awstats/Makefile         |   3 ++-
 www/awstats/distinfo         |   3 ++-
 www/awstats/patches/patch-ac |  27 +++++++++++++++++++++++++++
 3 files changed, 31 insertions(+), 2 deletions(-)

diffs (56 lines):

diff -r fad8c1cd9747 -r 263d8818e71c www/awstats/Makefile
--- a/www/awstats/Makefile      Wed Aug 20 21:20:12 2008 +0000
+++ b/www/awstats/Makefile      Wed Aug 20 21:20:33 2008 +0000
@@ -1,6 +1,7 @@
-# $NetBSD: Makefile,v 1.37 2008/06/20 01:09:40 joerg Exp $
+# $NetBSD: Makefile,v 1.38 2008/08/20 21:20:33 minskim Exp $
 
 DISTNAME=      awstats-6.7
+PKGREVISION=   1
 CATEGORIES=    www
 MASTER_SITES=  ${MASTER_SITE_SOURCEFORGE:=awstats/}
 
diff -r fad8c1cd9747 -r 263d8818e71c www/awstats/distinfo
--- a/www/awstats/distinfo      Wed Aug 20 21:20:12 2008 +0000
+++ b/www/awstats/distinfo      Wed Aug 20 21:20:33 2008 +0000
@@ -1,7 +1,8 @@
-$NetBSD: distinfo,v 1.20 2008/04/07 07:21:00 adam Exp $
+$NetBSD: distinfo,v 1.21 2008/08/20 21:20:33 minskim Exp $
 
 SHA1 (awstats-6.7.tar.gz) = 7dab4208441bce494bf1b3937242794a2328ace1
 RMD160 (awstats-6.7.tar.gz) = 5a84327871b65cad5cb6dbaded5c223660806953
 Size (awstats-6.7.tar.gz) = 1089638 bytes
 SHA1 (patch-aa) = 78b3a3100d687f07e0bed7b677abc52b767b8598
 SHA1 (patch-ab) = df8961949160d172ab40569a414b52eb4a8b1f06
+SHA1 (patch-ac) = 2c4f26e5cdd3550f20450c3484bc1d91000bdd63
diff -r fad8c1cd9747 -r 263d8818e71c www/awstats/patches/patch-ac
--- /dev/null   Thu Jan 01 00:00:00 1970 +0000
+++ b/www/awstats/patches/patch-ac      Wed Aug 20 21:20:33 2008 +0000
@@ -0,0 +1,27 @@
+$NetBSD: patch-ac,v 1.1 2008/08/20 21:20:33 minskim Exp $
+
+XSS (http://secunia.com/advisories/31519/) fix. Not needed in 6.9.
+
+--- wwwroot/cgi-bin/awstats.pl.orig    2008-08-20 14:17:04.000000000 -0700
++++ wwwroot/cgi-bin/awstats.pl
+@@ -4380,6 +4380,7 @@ sub EncodeString {
+ sub DecodeEncodedString {
+       my $stringtodecode=shift;
+       $stringtodecode =~ tr/\+/ /s;
++      $stringtodecode =~ s/%22//g;
+       $stringtodecode =~ s/%([A-F0-9][A-F0-9])/pack("C", hex($1))/ieg;
+       return $stringtodecode;
+ }
+@@ -4432,9 +4433,12 @@ sub Sanitize {
+ #------------------------------------------------------------------------------
+ sub CleanXSS {
+       my $stringtoclean=shift;
++      # To avoid html tags and javascript
+       $stringtoclean =~ s/</&lt;/g;
+       $stringtoclean =~ s/>/&gt;/g;
+       $stringtoclean =~ s/|//g;
++      # To avoid onload="
++      $stringtoclean =~ s/onload//g;
+       return $stringtoclean;
+ }
+