From m.seaman@infracaninophile.co.uk  Sun Nov 11 13:48:52 2007
Return-Path: <m.seaman@infracaninophile.co.uk>
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id E58E516A469;
	Sun, 11 Nov 2007 13:48:52 +0000 (UTC)
	(envelope-from m.seaman@infracaninophile.co.uk)
Received: from smtp.infracaninophile.co.uk (ns0.infracaninophile.co.uk [IPv6:2001:8b0:151:1::1])
	by mx1.freebsd.org (Postfix) with ESMTP id 3807F13C48A;
	Sun, 11 Nov 2007 13:48:51 +0000 (UTC)
	(envelope-from m.seaman@infracaninophile.co.uk)
Received: from happy-idiot-talk.infracaninophile.co.uk (localhost.infracaninophile.co.uk [IPv6:::1])
	by smtp.infracaninophile.co.uk (8.14.1/8.14.1) with ESMTP id lABDmjNO067705;
	Sun, 11 Nov 2007 13:48:45 GMT
	(envelope-from matthew@happy-idiot-talk.infracaninophile.co.uk)
Received: (from matthew@localhost)
	by happy-idiot-talk.infracaninophile.co.uk (8.14.1/8.14.1/Submit) id lABDmjtg067704;
	Sun, 11 Nov 2007 13:48:45 GMT
	(envelope-from matthew)
Message-Id: <200711111348.lABDmjtg067704@happy-idiot-talk.infracaninophile.co.uk>
Date: Sun, 11 Nov 2007 13:48:45 GMT
From: Matthew Seaman <m.seaman@infracaninophile.co.uk>
Reply-To: Matthew Seaman <m.seaman@infracaninophile.co.uk>
To: FreeBSD-gnats-submit@freebsd.org
Cc: secteam@freebsd.org
Subject: [maintainer] databases/phpmyadmin -- security update to 2.11.2.1
X-Send-Pr-Version: 3.113
X-GNATS-Notify:

>Number:         117974
>Category:       ports
>Synopsis:       [maintainer] databases/phpmyadmin -- security update to 2.11.2.1
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    miwi
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          maintainer-update
>Submitter-Id:   current-users
>Arrival-Date:   Sun Nov 11 13:50:00 UTC 2007
>Closed-Date:    Sun Nov 11 16:12:38 UTC 2007
>Last-Modified:  Sun Nov 11 16:20:02 UTC 2007
>Originator:     Matthew Seaman
>Release:        FreeBSD 7.0-BETA1 i386
>Organization:
Infracaninophile
>Environment:
System: FreeBSD happy-idiot-talk.infracaninophile.co.uk 7.0-BETA1 FreeBSD 7.0-BETA1 #14: Thu Nov 1 23:25:45 GMT 2007 root@happy-idiot-talk.infracaninophile.co.uk:/usr/obj/usr/src/sys/HAPPY-IDIOT-TALK i386


	
>Description:

phpmyadmin-2.11.2.1 has been released in response to a security
problem.  Details are in:

    http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-7

References:

    http://www.digitrustgroup.com/advisories/tdg-advisory071108a.html






>How-To-Repeat:
	
>Fix:

	

--- phpmyadmin.diff begins here ---
diff -Nur /usr/ports/databases/phpmyadmin/Makefile phpmyadmin/Makefile
--- /usr/ports/databases/phpmyadmin/Makefile	2007-10-31 19:02:05.000000000 +0000
+++ phpmyadmin/Makefile	2007-11-11 13:37:13.000000000 +0000
@@ -6,7 +6,7 @@
 #
 
 PORTNAME=	phpMyAdmin
-DISTVERSION=	2.11.2
+DISTVERSION=	2.11.2.1
 CATEGORIES=	databases www
 MASTER_SITES=	${MASTER_SITE_SOURCEFORGE}
 MASTER_SITE_SUBDIR=	phpmyadmin
diff -Nur /usr/ports/databases/phpmyadmin/Makefile~ phpmyadmin/Makefile~
--- /usr/ports/databases/phpmyadmin/Makefile~	1970-01-01 01:00:00.000000000 +0100
+++ phpmyadmin/Makefile~	2007-10-31 19:02:05.000000000 +0000
@@ -0,0 +1,162 @@
+# New ports collection makefile for: phpMyAdmin
+# Date created:		19 Jan 2001
+# Whom:			nbm
+#
+# $FreeBSD: ports/databases/phpmyadmin/Makefile,v 1.77 2007/10/30 09:24:24 miwi Exp $
+#
+
+PORTNAME=	phpMyAdmin
+DISTVERSION=	2.11.2
+CATEGORIES=	databases www
+MASTER_SITES=	${MASTER_SITE_SOURCEFORGE}
+MASTER_SITE_SUBDIR=	phpmyadmin
+DISTNAME=	${PORTNAME}-${PORTVERSION}-all-languages
+
+MAINTAINER=	m.seaman@infracaninophile.co.uk
+COMMENT=	A set of PHP-scripts to manage MySQL over the web
+
+USE_BZIP2=	yes
+NO_BUILD=	yes
+.if !defined(WITHOUT_PHP_DEPENDS)
+USE_PHP=	ctype mysql pcre session
+.endif
+
+SUB_LIST+=	"MYADMDIR=${MYADMDIR}" \
+		"PKGNAME=${PKGNAME}"
+SUB_FILES=	pkg-message
+
+# Unfortunately can't make WITH_SUPHP part of the OPTIONS selection,
+# since it has to be processed before just about anything else.
+
+.if defined(WITH_SUPHP) && !defined(WITHOUT_SUPHP)
+
+PKGNAMESUFFIX=	-suphp
+RUN_DEPENDS+=	${LOCALBASE}/sbin/suphp:${PORTSDIR}/www/suphp
+WANT_PHP_CGI=	yes
+
+MYADMUSR?=	phpmyadm
+
+SUB_LIST+=	"MYADMUSR=${MYADMUSR}" \
+		"MYADMGRP=${MYADMGRP}"
+SUB_FILES+=	pkg-install pkg-deinstall
+
+.else
+
+WANT_PHP_WEB=	yes
+
+.endif
+
+# Copy the way lang/php{4,5}-extensions deals with its OPTIONS -- avoids
+# problems with include of bsd.port.pre.mk
+
+OPTIONS=	BZ2	 "bzip2 library support" on \
+		GD	 "GD library support" on \
+		MYSQLI	 "Improved MySQL support" off \
+		OPENSSL	 "OpenSSL support" on \
+		PDF	 "PDFlib support (implies GD)" on \
+		ZLIB	 "ZLIB support" on \
+		MCRYPT   "MCrypt library support" on \
+		MBSTRING "Multi-byte character-set string support" on
+
+PORT_DBDIR?=	/var/db/ports
+LATEST_LINK=	${PORTNAME}${PKGNAMESUFFIX}
+OPTIONSFILE?=	${PORT_DBDIR}/${LATEST_LINK}/options
+
+.if exists(${OPTIONSFILE})
+.include "${OPTIONSFILE}"
+.endif
+
+.if !defined(WITHOUT_PHP_DEPENDS)
+# Options that default to on:
+.for opt in BZ2 GD OPENSSL PDF ZLIB MCRYPT MBSTRING
+.    if !defined(WITHOUT_${opt}) || defined(WITH_${opt})
+USE_PHP+=	${opt:L}
+.    endif
+.endfor
+
+# Options that default to off:
+.for opt in MYSQLI
+.    if defined(WITH_${opt}) && !defined(WITHOUT_${opt})
+USE_PHP+=	${opt:L}
+.    endif
+.endfor
+.endif
+
+# MYADMUSR is only used WITH_SUPHP
+MYADMDIR?=	www/phpMyAdmin
+MYADMGRP?=	${WWWGRP}
+CFGFILE=	config.inc.php
+
+PLIST=		${WRKDIR}/plist
+PLIST_SUB+=	MYADMDIR=${MYADMDIR} MYADMGRP=${MYADMGRP}
+
+.SILENT:
+
+do-build:
+	@${DO_NADA}
+
+pre-everything::
+	${ECHO_MSG} ""
+	${ECHO_MSG} "You may use the following additional build option:"
+	${ECHO_MSG} ""
+	${ECHO_MSG} "    WITH_SUPHP=yes   Install appropriately for use with"
+	${ECHO_MSG} "                     the www/suphp port [default: no]"
+	${ECHO_MSG} ""
+	${ECHO_MSG} "Note that selecting the MYSQLI option will only work"
+	${ECHO_MSG} "with PHP5 and MySQL 4.1.x"
+	${ECHO_MSG} ""
+	${ECHO_MSG} "If you want to use PHP4, for best results, please"
+	${ECHO_MSG} "install lang/php4 before attempting to install"
+	${ECHO_MSG} "databases/phpmyadmin"
+	${ECHO_MSG} ""
+
+# When creating a package, empty directories will not be generated
+# from the pkg tarball.  Therefore make sure no directories are empty.
+
+post-patch:
+	cd ${WRKSRC} ; \
+	for emptydir in $$( ${FIND} . -type d -empty -print ) ; do \
+	    ${TOUCH} $${emptydir}/.keep-me ; \
+	done
+	${CP} ${FILESDIR}/${CFGFILE}.sample ${WRKSRC}/${CFGFILE}.sample
+	cd ${WRKSRC} ; \
+	${FIND} . ! -type d ! -name ${CFGFILE}.sample | ${SORT} | \
+	    ${SED} -e "s,^\.,%%MYADMDIR%%,"           >${PLIST} ; \
+	${CAT} ${PKGDIR}/pkg-plist-chunk             >>${PLIST} ; \
+	${FIND} . -type d | ${SORT} -r | ${SED} \
+	     -e "s,^\.$$,@dirrmtry %%MYADMDIR%%," \
+	     -e "s,^\.,@dirrm %%MYADMDIR%%,"         >>${PLIST}
+
+pre-install:
+.if defined(WITH_SUPHP)
+	${SETENV} ${SCRIPTS_ENV} ${SH} ${PKGINSTALL} ${PKGNAME} PRE-INSTALL
+.endif
+
+do-install: install-app install-conf
+
+install-app:
+	cd ${WRKSRC} ; \
+	for src in $$( ${FIND} . ! -name .cvsignore ) ; do \
+	    dst=${PREFIX}/${MYADMDIR}$${src#.} ; \
+	    if ${TEST} -d $$src ; then \
+	        ${MKDIR} $$dst ; \
+	    else \
+	        ${INSTALL_DATA} $$src $$dst ; \
+	    fi \
+	done
+
+install-conf: install-app
+	cd ${PREFIX}/${MYADMDIR} ; \
+	${CHMOD} 0640 ${CFGFILE}.sample ; \
+	${CHGRP} ${MYADMGRP} ${CFGFILE}.sample ; \
+	if ${TEST} ! -f ${CFGFILE} ; then \
+	    ${CP} -p ${CFGFILE}.sample ${CFGFILE} ; \
+	fi
+
+post-install:
+.if defined(WITH_SUPHP)
+	${SETENV} ${SCRIPTS_ENV} ${SH} ${PKGINSTALL} ${PKGNAME} POST-INSTALL
+.endif
+	${CAT} ${PKGMESSAGE}
+
+.include <bsd.port.mk>
diff -Nur /usr/ports/databases/phpmyadmin/distinfo phpmyadmin/distinfo
--- /usr/ports/databases/phpmyadmin/distinfo	2007-10-31 19:02:05.000000000 +0000
+++ phpmyadmin/distinfo	2007-11-11 13:38:05.000000000 +0000
@@ -1,3 +1,3 @@
-MD5 (phpMyAdmin-2.11.2-all-languages.tar.bz2) = d7d521085c54c82e728cecb64a33b494
-SHA256 (phpMyAdmin-2.11.2-all-languages.tar.bz2) = 6fe12176e5093b1696f765675706af9c916558f52fc5de40416e90045753f635
-SIZE (phpMyAdmin-2.11.2-all-languages.tar.bz2) = 3083211
+MD5 (phpMyAdmin-2.11.2.1-all-languages.tar.bz2) = 12b3625013822c784ce373ca908decf8
+SHA256 (phpMyAdmin-2.11.2.1-all-languages.tar.bz2) = 9fb46ccf7722ab1019ea0a0747f2c5613f95835e9db36887f4f9bbeea7838690
+SIZE (phpMyAdmin-2.11.2.1-all-languages.tar.bz2) = 3083390
--- phpmyadmin.diff ends here ---


>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-ports-bugs->miwi 
Responsible-Changed-By: miwi 
Responsible-Changed-When: Sun Nov 11 15:35:03 UTC 2007 
Responsible-Changed-Why:  
I'll take it. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=117974 
State-Changed-From-To: open->closed 
State-Changed-By: miwi 
State-Changed-When: Sun Nov 11 16:12:37 UTC 2007 
State-Changed-Why:  
Committed. Thanks! 

http://www.freebsd.org/cgi/query-pr.cgi?pr=117974 

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: ports/117974: commit references a PR
Date: Sun, 11 Nov 2007 16:12:31 +0000 (UTC)

 miwi        2007-11-11 16:12:24 UTC
 
   FreeBSD ports repository
 
   Modified files:
     databases/phpmyadmin Makefile distinfo 
   Log:
   - Update to 2.11.2.1
   
   PR:             117974
   Submitted by:   Matthew Seaman <m.seaman@infracaninophile.co.uk> (maintainer)
   Approved by:    portmgr (erwin)
   Security:       http://www.vuxml.org/freebsd/2d2dcbb4-906c-11dc-a951-0016179b2dd5.html
   
   Revision  Changes    Path
   1.78      +1 -1      ports/databases/phpmyadmin/Makefile
   1.62      +3 -3      ports/databases/phpmyadmin/distinfo
 _______________________________________________
 cvs-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/cvs-all
 To unsubscribe, send any mail to "cvs-all-unsubscribe@freebsd.org"
 
>Unformatted:
