From nobody Fri Oct 28 17:12:30 2022 X-Original-To: dev-commits-ports-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4MzTct369rz4gbRp; Fri, 28 Oct 2022 17:12:30 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4MzTct2XvCz41Wt; Fri, 28 Oct 2022 17:12:30 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1666977150; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=R/zt4AhQaj9gK/23MyYfl1z2DMR0ZRk44djAdnh/kF0=; b=rvM5VLnvnc8QaGAvmZl4UASOLTxXbQc8Z5a0TqkZcFdbSEgJJSDbkzqVXtKfDV/xx0KnOw Do0k2SHTo8EepPT8Q1UOzf+zn+Tn/mse9C6Lim8VZY/KDEH2HidE6eb02XWDCeRs7+N+BT vyQ9l7GsF7fMQuUHNssN95LWm87hw7hY6sVmt0lTF+KQvqJtHo7IkkW2tf1MvJ+xjTRjJQ QLO9k4s3nceAuX1BF66WHv5aK7iFohyBCYJ0xMitQGwRAOv6SSr5F2fmbcGG9EaI9wnRid yFZdFiyn78XJWzZdK7KUYId4XgQCbrA3j9WEyD+L7atciwaOBN1gNst9YgLhuA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4MzTct1JH9zlBd; Fri, 28 Oct 2022 17:12:30 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 29SHCUqN096481; Fri, 28 Oct 2022 17:12:30 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 29SHCUL9096480; Fri, 28 Oct 2022 17:12:30 GMT (envelope-from git) Date: Fri, 28 Oct 2022 17:12:30 GMT Message-Id: <202210281712.29SHCUL9096480@gitrepo.freebsd.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org From: Thierry Thomas Subject: git: dfa4c773430c - main - mail/horde-imp: address ZDI-20-1051 / ZDI-CAN-10436 List-Id: Commits to the main branch of the FreeBSD ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-ports-main@freebsd.org X-BeenThere: dev-commits-ports-main@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: thierry X-Git-Repository: ports X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: dfa4c773430c9297b3f54d3b1a1202e18e7f120d Auto-Submitted: auto-generated ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1666977150; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=R/zt4AhQaj9gK/23MyYfl1z2DMR0ZRk44djAdnh/kF0=; b=LUNKhcDVkLxS7eBFCGcnBYpD23f4qHuWApGfTSRojIfXG9EbklvIahr67cBV9Pq5/9+Hbf SJeW2/BkAzjwzpOmzgdy/XqOWe9D8VsiQB45uWKvNXf8IMMKEyO5xFu090E0SR0tMMrp4G 8HtUewGH8xDXnrEvcX6GrlXb2ZkdpzUwReFYnhb59u3yUbTwppZ/WjevxkGA9lP4Hj44j8 xvW75+5vyhIy+kwtwmM3odI0IvGDT/5EAtef1tWldlXoYslWw8R4nGuj9oeUk3yoQIg4Yt y4zO95ekUy6xuS75lsecpvFJGazZcdaHUuYFd2zZIi2IJQqNABeJI5kryK2HmA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1666977150; a=rsa-sha256; cv=none; b=jHrqgFpTVcdHE1x9J2+ICDnwYhihzvYa6UmPCh+Za6LR//gJp8AlSMFhQDbTf9CoSJkBCe m54OmwY0jREWIHS+lQDezYVDBcRwXgMbXz2cz8/qaCuFuNg7T6+EQ3tQRsXWbLHDGuV31s gaRfimGtm9AEHgzLlgRXrjHwwf1Uha9+ZggClSdkK1wzM71s9h1H+Idp8agLqlnlSH0vrt So6YjHlkco6mNx+sCmIZvxneaNehASYH8Stn5hOJgJIlh9s5sBOxmFGY8EvrXpOlC6OspI rp+Kumb5YpvFBF/qeMDJ8DgEHfzd+5NJhrFoDs9ehi41z7Sfw524OJrdDexuQw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N The branch main has been updated by thierry: URL: https://cgit.FreeBSD.org/ports/commit/?id=dfa4c773430c9297b3f54d3b1a1202e18e7f120d commit dfa4c773430c9297b3f54d3b1a1202e18e7f120d Author: Thierry Thomas AuthorDate: 2022-10-14 08:35:37 +0000 Commit: Thierry Thomas CommitDate: 2022-10-28 17:12:27 +0000 mail/horde-imp: address ZDI-20-1051 / ZDI-CAN-10436 PR: 267049 Approved by: maintainer’s time-out Obtained from: https://github.com/horde/imp/pull/10/files Fixes: Address ZDI-20-1051 / ZDI-CAN-10436 MFH: 2022Q4 Security: https://www.zerodayinitiative.com/advisories/ZDI-20-1051/ --- mail/horde-imp/Makefile | 1 + mail/horde-imp/files/patch-config_prefs.php | 6 +++--- mail/horde-imp/files/patch-lib_Prefs_Sort.php | 19 +++++++++++++++++++ 3 files changed, 23 insertions(+), 3 deletions(-) diff --git a/mail/horde-imp/Makefile b/mail/horde-imp/Makefile index f2cd26c90976..897a035c0b65 100644 --- a/mail/horde-imp/Makefile +++ b/mail/horde-imp/Makefile @@ -1,5 +1,6 @@ PORTNAME= imp PORTVERSION= 6.2.27 +PORTREVISION= 1 CATEGORIES= mail www pear PKGNAMEPREFIX= ${PHP_PKGNAMEPREFIX}horde- diff --git a/mail/horde-imp/files/patch-config_prefs.php b/mail/horde-imp/files/patch-config_prefs.php index de8a319f1870..e355424286ca 100644 --- a/mail/horde-imp/files/patch-config_prefs.php +++ b/mail/horde-imp/files/patch-config_prefs.php @@ -1,6 +1,6 @@ ---- config/prefs.php.orig 2011-05-03 06:27:23.000000000 -0800 -+++ config/prefs.php 2011-05-07 10:06:10.000000000 -0800 -@@ -1200,7 +1200,7 @@ +--- config/prefs.php.orig 2020-08-27 19:34:20 UTC ++++ config/prefs.php +@@ -930,7 +930,7 @@ $_prefs['sourceselect'] = array( // You can provide default values this way: // 'value' => json_encode(array('source_one', 'source_two')) $_prefs['search_sources'] = array( diff --git a/mail/horde-imp/files/patch-lib_Prefs_Sort.php b/mail/horde-imp/files/patch-lib_Prefs_Sort.php new file mode 100644 index 000000000000..c9ffce90eab1 --- /dev/null +++ b/mail/horde-imp/files/patch-lib_Prefs_Sort.php @@ -0,0 +1,19 @@ +--- lib/Prefs/Sort.php.orig 2020-08-27 19:34:20 UTC ++++ lib/Prefs/Sort.php +@@ -39,9 +39,13 @@ class IMP_Prefs_Sort implements ArrayAccess, IteratorA + { + global $prefs; + +- $sortpref = @unserialize($prefs->getValue(self::SORTPREF)); +- if (is_array($sortpref)) { +- $this->_sortpref = $sortpref; ++ $serializedPref = $prefs->getValue(self::SORTPREF); ++ // Only unserialize non-empty strings. Disallow yielding any classes. ++ if (!empty($serializedPref && is_string($serializedPref))) { ++ $sortpref = @unserialize($serializedPref, ['allowed_classes' => false]); ++ if (is_array($sortpref)) { ++ $this->_sortpref = $sortpref; ++ } + } + } +