From turbo@conversation.bsdunix.ch  Wed Jan 11 00:52:59 2006
Return-Path: <turbo@conversation.bsdunix.ch>
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id F031216A41F
	for <FreeBSD-gnats-submit@freebsd.org>; Wed, 11 Jan 2006 00:52:59 +0000 (GMT)
	(envelope-from turbo@conversation.bsdunix.ch)
Received: from conversation.bsdunix.ch (magnani.org [82.220.17.18])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 0437C43D46
	for <FreeBSD-gnats-submit@freebsd.org>; Wed, 11 Jan 2006 00:52:58 +0000 (GMT)
	(envelope-from turbo@conversation.bsdunix.ch)
Received: from conversation.bsdunix.ch (localhost.bsdunix.ch [127.0.0.1])
	by conversation.bsdunix.ch (8.13.1/8.13.1) with ESMTP id k0B0qtT8056271
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <FreeBSD-gnats-submit@freebsd.org>; Wed, 11 Jan 2006 01:52:55 +0100 (CET)
	(envelope-from turbo@conversation.bsdunix.ch)
Received: (from turbo@localhost)
	by conversation.bsdunix.ch (8.13.1/8.13.1/Submit) id k0B0qtng056270;
	Wed, 11 Jan 2006 01:52:55 +0100 (CET)
	(envelope-from turbo)
Message-Id: <200601110052.k0B0qtng056270@conversation.bsdunix.ch>
Date: Wed, 11 Jan 2006 01:52:55 +0100 (CET)
From: Thomas Vogt <thomas@bsdunix.ch>
Reply-To: Thomas Vogt <thomas@bsdunix.ch>
To: FreeBSD-gnats-submit@freebsd.org
Cc:
Subject: www/mediawiki update to 1.5.5 (security update)
X-Send-Pr-Version: 3.113
X-GNATS-Notify: tux@pinguru.net

>Number:         91617
>Category:       ports
>Synopsis:       www/mediawiki update to 1.5.5 (security update)
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-ports-bugs
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          update
>Submitter-Id:   current-users
>Arrival-Date:   Wed Jan 11 01:00:13 GMT 2006
>Closed-Date:    Sun Jan 15 02:40:48 GMT 2006
>Last-Modified:  Sun Jan 15 02:40:48 GMT 2006
>Originator:     Thomas Vogt
>Release:        FreeBSD 4.11-RELEASE-p10 i386
>Organization:
>Environment:
System: FreeBSD conversation.bsdunix.ch 4.11-RELEASE-p10 FreeBSD 4.11-RELEASE-p10 #3: Fri Jun 17 15:54:34 CEST 2005 root@conversation.bsdunix.ch:/usr/obj/usr/src/sys/CONVERSATION i386


	
>Description:
	MediaWiki 1.5.5 is a security and bugfix maintenance release.

Detection for uploads of Windows Metafile (.wmf) images has been added
to help protect against a client-side vulnerability in unpatched Microsoft
Windows operating systems.

Sites which have enabled uploads and added non-standard file types
(such as .ogg, .doc, or .pdf) should upgrade to this release to ensure
that malicious .wmf files can't be uploaded with a fake extension;
such files could put visitors to the site at risk.

For more details on this, see:
http://en.wikipedia.org/wiki/Windows_Metafile_vulnerability

Additionally, a maintenance script removeUnusedAccounts.php has been added;
this replaces an older Perl script which had not been updated for the new
schema in 1.5.
>How-To-Repeat:
	
>Fix:


--- mediawiki.orig/Makefile	Wed Jan 11 01:41:00 2006
+++ mediawiki/Makefile	Wed Jan 11 01:41:19 2006
@@ -6,7 +6,7 @@
 #
 
 PORTNAME=	mediawiki
-PORTVERSION=	1.5.4
+PORTVERSION=	1.5.5
 CATEGORIES=	www
 MASTER_SITES=	${MASTER_SITE_SOURCEFORGE}
 MASTER_SITE_SUBDIR=	wikipedia


--- mediawiki.orig/distinfo	Wed Jan 11 01:41:00 2006
+++ mediawiki/distinfo	Wed Jan 11 01:42:54 2006
@@ -1,3 +1,3 @@
-MD5 (mediawiki-1.5.4.tar.gz) = c5cff706c4d2fc8dd5aabd10f1714be0
-SHA256 (mediawiki-1.5.4.tar.gz) = 5ca27c8781ca54784e6679e9843e1e6d18563093d07f8effb61171c1aa0f23c5
-SIZE (mediawiki-1.5.4.tar.gz) = 2286643
+MD5 (mediawiki-1.5.5.tar.gz) = 4210fe8559e08bb9d1d0e6e34f68cf37
+SHA256 (mediawiki-1.5.5.tar.gz) = a811ca2730761be6b738d46c499113f4dc4aef9b8f6b3171bbc09b1656912aee
+SIZE (mediawiki-1.5.5.tar.gz) = 2287277
>Release-Note:
>Audit-Trail:
State-Changed-From-To: open->feedback 
State-Changed-By: edwin 
State-Changed-When: Wed Jan 11 01:04:09 UTC 2006 
State-Changed-Why:  
Awaiting maintainers feedback 

http://www.freebsd.org/cgi/query-pr.cgi?pr=91617 

From: Gerrit Beine <tux@pinguru.net>
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: ports/91617: www/mediawiki update to 1.5.5 (security update)
Date: Wed, 11 Jan 2006 08:05:50 +0100

 Edwin Groothuis wrote:
 > Maintainer of www/mediawiki,
 > 
 > Please note that PR ports/91617 has just been submitted.
 > 
 > If it contains a patch for an upgrade, an enhancement or a bug fix
 > you agree on, reply to this email stating that you approve the patch
 > and a committer will take care of it.
 > 
 > The full text of the PR can be found at:
 >     http://www.freebsd.org/cgi/query-pr.cgi?pr=ports/91617
 > 
 It's ok, I think.
 
 So long...
 
 Gerrit
State-Changed-From-To: feedback->open 
State-Changed-By: pav 
State-Changed-When: Sun Jan 15 02:31:03 UTC 2006 
State-Changed-Why:  
Approved 

http://www.freebsd.org/cgi/query-pr.cgi?pr=91617 
State-Changed-From-To: open->closed 
State-Changed-By: pav 
State-Changed-When: Sun Jan 15 02:40:41 UTC 2006 
State-Changed-Why:  
Committed, thanks! 

http://www.freebsd.org/cgi/query-pr.cgi?pr=91617 
>Unformatted:
