From chinsan.tw@gmail.com  Fri Sep 29 05:06:05 2006
Return-Path: <chinsan.tw@gmail.com>
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id BDB1616A40F;
	Fri, 29 Sep 2006 05:06:05 +0000 (UTC)
	(envelope-from chinsan.tw@gmail.com)
Received: from smtp2.bc.hgc.com.tw (smtp2.bc.hgc.com.tw [203.133.1.156])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 6D9ED43D4C;
	Fri, 29 Sep 2006 05:06:05 +0000 (GMT)
	(envelope-from chinsan.tw@gmail.com)
Received: from smtp2.bc.hgc.com.tw (61-63-0-host123.kbtelecom.net.tw [61.63.0.123])
	by smtp2.bc.hgc.com.tw (Postfix) with SMTP id 5265B2E9DF;
	Fri, 29 Sep 2006 13:06:05 +0800 (CST)
Received: by smtp2.bc.hgc.com.tw (sSMTP sendmail emulation); Fri, 29 Sep 2006 13:01:32 +0800
Message-Id: <20060929050605.5265B2E9DF@smtp2.bc.hgc.com.tw>
Date: Fri, 29 Sep 2006 13:01:32 +0800
From: chinsan <chinsan.tw@gmail.com>
To: FreeBSD-gnats-submit@freebsd.org
Cc: simon@FreeBSD.org
Subject: [MAINTAINER] www/dokuwiki: Fix security issue(Image resize DOS-Attack)
X-Send-Pr-Version: 3.113
X-GNATS-Notify:

>Number:         103798
>Category:       ports
>Synopsis:       [MAINTAINER] www/dokuwiki: Fix security issue(Image resize DOS-Attack)
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    clsung
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          maintainer-update
>Submitter-Id:   current-users
>Arrival-Date:   Fri Sep 29 05:10:18 GMT 2006
>Closed-Date:    Sat Sep 30 05:36:36 GMT 2006
>Last-Modified:  Sat Sep 30 05:40:19 GMT 2006
>Originator:     chinsan
>Release:        FreeBSD 6.2-PRERELEASE i386
>Organization:
Taiwan
>Environment:
System: FreeBSD BSD6.giga.hgc.com.tw 6.2-PRERELEASE FreeBSD 6.2-PRERELEASE #6: Thu Sep 14 09:46:10 CST 2006
>Description:
- Fix security issue(Image resize DOS-Attack in fetch.php)
 http://bugs.splitbrain.org/?do=details&id=924

Notified by simon@, thanks.

Added file(s):
- files/patch-lib-exe-fetch.php

Generated with FreeBSD Port Tools 0.77
>How-To-Repeat:
>Fix:

--- dokuwiki-20060309_5.patch begins here ---
diff -ruN --exclude=CVS /usr/ports/www/dokuwiki/Makefile /usr/home/chinsan/project/dokuwiki/Makefile
--- /usr/ports/www/dokuwiki/Makefile	Sat Jun 24 05:09:31 2006
+++ /usr/home/chinsan/project/dokuwiki/Makefile	Fri Sep 29 12:57:49 2006
@@ -7,7 +7,7 @@
 
 PORTNAME=	dokuwiki
 PORTVERSION=	${DIST_VER:S/${PORTNAME}//:S/-//g}
-PORTREVISION=	4
+PORTREVISION=	5
 CATEGORIES=	www
 MASTER_SITES=	http://www.splitbrain.org/_media/projects/dokuwiki/ \
 		http://dev.splitbrain.org/browse/snapshots/
@@ -83,6 +83,9 @@
 		${WRKSRC}/conf/dokuwiki.php
 	@${FIND} ${WRKSRC}/conf -name "*.php.bak" -delete
 .endif
+
+post-patch:
+	@${FIND} ${WRKSRC}/lib/exe -name "*.orig" -delete
 
 pre-install:
 	@${TOUCH} ${WRKSRC}/data/changes.log
diff -ruN --exclude=CVS /usr/ports/www/dokuwiki/files/patch-lib-exe-fetch.php /usr/home/chinsan/project/dokuwiki/files/patch-lib-exe-fetch.php
--- /usr/ports/www/dokuwiki/files/patch-lib-exe-fetch.php	Thu Jan  1 08:00:00 1970
+++ /usr/home/chinsan/project/dokuwiki/files/patch-lib-exe-fetch.php	Fri Sep 29 12:55:39 2006
@@ -0,0 +1,24 @@
+--- lib/exe/fetch.php.bak	Fri Mar 10 04:32:34 2006
++++ lib/exe/fetch.php	Fri Sep 29 12:54:09 2006
+@@ -21,8 +21,8 @@
+   //get input
+   $MEDIA  = getID('media',false); // no cleaning - maybe external
+   $CACHE  = calc_cache($_REQUEST['cache']);
+-  $WIDTH  = $_REQUEST['w'];
+-  $HEIGHT = $_REQUEST['h'];
++  $WIDTH  = (int) $_REQUEST['w'];
++  $HEIGHT = (int) $_REQUEST['h'];
+   list($EXT,$MIME) = mimetype($MEDIA);
+   if($EXT === false){
+     $EXT  = 'unknown';
+@@ -198,6 +198,10 @@
+   $info  = getimagesize($file);
+   if(!$h) $h = round(($w * $info[1]) / $info[0]);
+ 
++  /*
++   * This is the fix for http://bugs.splitbrain.org/?do=details&id=924
++   */
++  if($w > 2000 || $h > 2000) return $file;
+ 
+   //cache
+   $local = getCacheName($file,'.media.'.$w.'x'.$h.'.'.$ext);
--- dokuwiki-20060309_5.patch ends here ---

>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-ports-bugs->clsung 
Responsible-Changed-By: clsung 
Responsible-Changed-When: Fri Sep 29 07:14:20 UTC 2006 
Responsible-Changed-Why:  
I'll take it. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=103798 
State-Changed-From-To: open->closed 
State-Changed-By: clsung 
State-Changed-When: Sat Sep 30 05:36:35 UTC 2006 
State-Changed-Why:  
Committed. Thank You. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=103798 

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: ports/103798: commit references a PR
Date: Sat, 30 Sep 2006 05:36:30 +0000 (UTC)

 clsung      2006-09-30 05:36:26 UTC
 
   FreeBSD ports repository
 
   Modified files:
     www/dokuwiki         Makefile 
   Added files:
     www/dokuwiki/files   patch-lib-exe-fetch.php 
   Log:
   - Fix security issue(Image resize DOS-Attack in fetch.php)
   - bump PORTREVISION
   
   PR:             ports/103798
   Security:       http://bugs.splitbrain.org/?do=details&id=924
   
   Revision  Changes    Path
   1.25      +4 -1      ports/www/dokuwiki/Makefile
   1.1       +24 -0     ports/www/dokuwiki/files/patch-lib-exe-fetch.php (new)
 _______________________________________________
 cvs-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/cvs-all
 To unsubscribe, send any mail to "cvs-all-unsubscribe@freebsd.org"
 
>Unformatted:
