svn commit: r416648 - in head/mail/roundcube: . files
Jason Unovitch
junovitch at FreeBSD.org
Fri Jun 10 01:15:59 UTC 2016
Author: junovitch
Date: Fri Jun 10 01:15:58 2016
New Revision: 416648
URL: https://svnweb.freebsd.org/changeset/ports/416648
Log:
Apply patch from upstream for cross-site scripting vulnerability
PR: 209841
Reported by: Vladimir Krstulja <vlad-fbsd at acheronmedia.com>
Approved by: maintainer timeout (2 weeks)
Security: CVE-2016-5103
Security: https://vuxml.FreeBSD.org/freebsd/97e86d10-2ea7-11e6-ae88-002590263bf5.html
MFH: 2016Q2
Added:
head/mail/roundcube/files/patch-CVE-2016-5103 (contents, props changed)
Modified:
head/mail/roundcube/Makefile
Modified: head/mail/roundcube/Makefile
==============================================================================
--- head/mail/roundcube/Makefile Fri Jun 10 01:15:07 2016 (r416647)
+++ head/mail/roundcube/Makefile Fri Jun 10 01:15:58 2016 (r416648)
@@ -2,6 +2,7 @@
PORTNAME= roundcube
DISTVERSION= 1.1.5
+PORTREVISION= 1
PORTEPOCH= 1
CATEGORIES?= mail www
MASTER_SITES= https://github.com/roundcube/roundcubemail/releases/download/${DISTVERSION}/
Added: head/mail/roundcube/files/patch-CVE-2016-5103
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ head/mail/roundcube/files/patch-CVE-2016-5103 Fri Jun 10 01:15:58 2016 (r416648)
@@ -0,0 +1,19 @@
+commit 6652367d656de7e5f404935be04e10aa281add53
+Author: Aleksander Machniak <alec at alec.pl>
+Date: Fri May 6 08:28:15 2016 +0200
+
+ Fix XSS issue in href attribute on area tag (#5240, #5241)
+
+diff --git a/program/lib/Roundcube/rcube_washtml.php b/program/lib/Roundcube/rcube_washtml.php
+index 5938d9b..d03f04a 100644
+--- program/lib/Roundcube/rcube_washtml.php
++++ program/lib/Roundcube/rcube_washtml.php
+@@ -370,7 +370,7 @@ class rcube_washtml
+ */
+ private function is_link_attribute($tag, $attr)
+ {
+- return $tag == 'a' && $attr == 'href';
++ return ($tag == 'a' || $tag == 'area') && $attr == 'href';
+ }
+
+ /**
More information about the svn-ports-head
mailing list