ports/103798: [MAINTAINER] www/dokuwiki: Fix security issue(Image resize DOS-Attack)

chinsan chinsan.tw at gmail.com
Fri Sep 29 05:10:19 UTC 2006


>Number:         103798
>Category:       ports
>Synopsis:       [MAINTAINER] www/dokuwiki: Fix security issue(Image resize DOS-Attack)
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-ports-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          maintainer-update
>Submitter-Id:   current-users
>Arrival-Date:   Fri Sep 29 05:10:18 GMT 2006
>Closed-Date:
>Last-Modified:
>Originator:     chinsan
>Release:        FreeBSD 6.2-PRERELEASE i386
>Organization:
Taiwan
>Environment:
System: FreeBSD BSD6.giga.hgc.com.tw 6.2-PRERELEASE FreeBSD 6.2-PRERELEASE #6: Thu Sep 14 09:46:10 CST 2006
>Description:
- Fix security issue(Image resize DOS-Attack in fetch.php)
 http://bugs.splitbrain.org/?do=details&id=924

Notified by simon@, thanks.

Added file(s):
- files/patch-lib-exe-fetch.php

Generated with FreeBSD Port Tools 0.77
>How-To-Repeat:
>Fix:

--- dokuwiki-20060309_5.patch begins here ---
diff -ruN --exclude=CVS /usr/ports/www/dokuwiki/Makefile /usr/home/chinsan/project/dokuwiki/Makefile
--- /usr/ports/www/dokuwiki/Makefile	Sat Jun 24 05:09:31 2006
+++ /usr/home/chinsan/project/dokuwiki/Makefile	Fri Sep 29 12:57:49 2006
@@ -7,7 +7,7 @@
 
 PORTNAME=	dokuwiki
 PORTVERSION=	${DIST_VER:S/${PORTNAME}//:S/-//g}
-PORTREVISION=	4
+PORTREVISION=	5
 CATEGORIES=	www
 MASTER_SITES=	http://www.splitbrain.org/_media/projects/dokuwiki/ \
 		http://dev.splitbrain.org/browse/snapshots/
@@ -83,6 +83,9 @@
 		${WRKSRC}/conf/dokuwiki.php
 	@${FIND} ${WRKSRC}/conf -name "*.php.bak" -delete
 .endif
+
+post-patch:
+	@${FIND} ${WRKSRC}/lib/exe -name "*.orig" -delete
 
 pre-install:
 	@${TOUCH} ${WRKSRC}/data/changes.log
diff -ruN --exclude=CVS /usr/ports/www/dokuwiki/files/patch-lib-exe-fetch.php /usr/home/chinsan/project/dokuwiki/files/patch-lib-exe-fetch.php
--- /usr/ports/www/dokuwiki/files/patch-lib-exe-fetch.php	Thu Jan  1 08:00:00 1970
+++ /usr/home/chinsan/project/dokuwiki/files/patch-lib-exe-fetch.php	Fri Sep 29 12:55:39 2006
@@ -0,0 +1,24 @@
+--- lib/exe/fetch.php.bak	Fri Mar 10 04:32:34 2006
++++ lib/exe/fetch.php	Fri Sep 29 12:54:09 2006
+@@ -21,8 +21,8 @@
+   //get input
+   $MEDIA  = getID('media',false); // no cleaning - maybe external
+   $CACHE  = calc_cache($_REQUEST['cache']);
+-  $WIDTH  = $_REQUEST['w'];
+-  $HEIGHT = $_REQUEST['h'];
++  $WIDTH  = (int) $_REQUEST['w'];
++  $HEIGHT = (int) $_REQUEST['h'];
+   list($EXT,$MIME) = mimetype($MEDIA);
+   if($EXT === false){
+     $EXT  = 'unknown';
+@@ -198,6 +198,10 @@
+   $info  = getimagesize($file);
+   if(!$h) $h = round(($w * $info[1]) / $info[0]);
+ 
++  /*
++   * This is the fix for http://bugs.splitbrain.org/?do=details&id=924
++   */
++  if($w > 2000 || $h > 2000) return $file;
+ 
+   //cache
+   $local = getCacheName($file,'.media.'.$w.'x'.$h.'.'.$ext);
--- dokuwiki-20060309_5.patch ends here ---

>Release-Note:
>Audit-Trail:
>Unformatted:



More information about the freebsd-ports-bugs mailing list