CVS commit: pkgsrc/www/ruby-actionpack32

["Takahiro Kambe" <taca%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   taca
Date:           Sun Aug 12 12:40:00 UTC 2012

Modified Files:
        pkgsrc/www/ruby-actionpack32: distinfo

Log Message:
Update ruby-actionpack32 to 3.2.8.

## Rails 3.2.8 (Aug 9, 2012) ##

* There is an XSS vulnerability in the strip_tags helper in Ruby on Rails, the
  helper doesn't correctly handle malformed html.  As a result an attacker can
  execute arbitrary javascript through the use of specially crafted malformed
  html.

  *Marek from Nethemba (www.nethemba.com) & Santiago Pastorino*

* When a "prompt" value is supplied to the `select_tag` helper, the "prompt"
  value is not escaped.
  If untrusted data is not escaped, and is supplied as the prompt value, there
  is a potential for XSS attacks.
  Vulnerable code will look something like this:

    select_tag("name", options, :prompt => UNTRUSTED_INPUT)

  *Santiago Pastorino*


To generate a diff of this commit:
cvs rdiff -u -r1.5 -r1.6 pkgsrc/www/ruby-actionpack32/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.