Update to 2014-09-29d.

Approved by:	ports-secteam@

5 files changed, 142 insertions, 3 deletions

diff --git a/www/dokuwiki/Makefile b/www/dokuwiki/Makefile
index 24b255956bbd..b15055218919 100644
--- a/www/dokuwiki/Makefile
+++ b/www/dokuwiki/Makefile
@@ -3,11 +3,10 @@
 
 PORTNAME=	dokuwiki
 PORTVERSION=	${DIST_VER:S/${PORTNAME}//:S/-//g}
-PORTREVISION=	1
+PORTREVISION=	4
 CATEGORIES=	www
 MASTER_SITES=	http://download.dokuwiki.org/src/dokuwiki/
 DISTNAME=	${DIST_VER}
-EXTRACT_SUFX=	.tgz
 
 MAINTAINER=	delphij@FreeBSD.org
 COMMENT=	Simple and easy to use wiki, no database required
@@ -19,6 +18,8 @@ USE_PHP=	gd mbstring openssl pcre session xml zlib
 NO_BUILD=	YES
 WANT_PHP_WEB=	YES
 
+USES=		cpe tar:tgz
+
 SUB_FILES=	pkg-message
 SUB_LIST+=	PORTNAME=${PORTNAME}
 SHAREOWN=	${WWWOWN}
diff --git a/www/dokuwiki/files/patch-2014-09-29a-to-2014-09-29c b/www/dokuwiki/files/patch-2014-09-29a-to-2014-09-29c
new file mode 100644
index 000000000000..00c40e876d4d
--- /dev/null
+++ b/www/dokuwiki/files/patch-2014-09-29a-to-2014-09-29c
@@ -0,0 +1,87 @@
+diff -u -r -N VERSION VERSION
+--- VERSION	2014-10-08 00:59:23.000000000 -0700
++++ VERSION	2015-02-24 12:01:05.000000000 -0800
+@@ -1 +1 @@
+-2014-09-29a "Hrun"
++2014-09-29c "Hrun"
+diff -u -r -N conf/mime.conf conf/mime.conf
+--- conf/mime.conf	2014-10-08 00:59:23.000000000 -0700
++++ conf/mime.conf	2015-02-24 12:01:05.000000000 -0800
+@@ -9,7 +9,6 @@
+ png     image/png
+ ico     image/vnd.microsoft.icon
+ 
+-swf     application/x-shockwave-flash
+ mp3     audio/mpeg
+ ogg     audio/ogg
+ wav     audio/wav
+@@ -66,3 +65,7 @@
+ #xml     text/xml
+ #csv     text/csv
+ 
++# Also flash may be able to execute arbitrary scripts in the website's
++# context
++#swf     application/x-shockwave-flash
++
+diff -u -r -N data/pages/playground/playground.txt data/pages/playground/playground.txt
+--- data/pages/playground/playground.txt	1969-12-31 16:00:00.000000000 -0800
++++ data/pages/playground/playground.txt	2015-02-24 12:33:06.000000000 -0800
+@@ -0,0 +1 @@
++====== PlayGround ======
+diff -u -r -N doku.php doku.php
+--- doku.php	2014-10-08 00:59:23.000000000 -0700
++++ doku.php	2015-02-24 12:01:05.000000000 -0800
+@@ -9,7 +9,7 @@
+  */
+ 
+ // update message version
+-$updateVersion = 46.1;
++$updateVersion = 46.3;
+ 
+ //  xdebug_start_profiling();
+ 
+diff -u -r -N lib/plugins/acl/remote.php lib/plugins/acl/remote.php
+--- lib/plugins/acl/remote.php	2014-10-08 00:59:23.000000000 -0700
++++ lib/plugins/acl/remote.php	2015-02-24 12:01:05.000000000 -0800
+@@ -17,12 +17,39 @@
+         );
+     }
+ 
+-    function addAcl($scope, $user, $level){
++    /**
++     * Add a new entry to ACL config
++     *
++     * @param string $scope
++     * @param string $user
++     * @param int    $level see also inc/auth.php
++     * @throws RemoteAccessDeniedException
++     * @return bool
++     */
++    public function addAcl($scope, $user, $level){
++        if(!auth_isadmin()) {
++            throw new RemoteAccessDeniedException('You are not allowed to access ACLs, superuser permission is required', 114);
++        }
++
++        /** @var admin_plugin_acl $apa */
+         $apa = plugin_load('admin', 'acl');
+         return $apa->_acl_add($scope, $user, $level);
+     }
+ 
+-    function delAcl($scope, $user){
++    /**
++     * Remove an entry from ACL config
++     *
++     * @param string $scope
++     * @param string $user
++     * @throws RemoteAccessDeniedException
++     * @return bool
++     */
++    public function delAcl($scope, $user){
++        if(!auth_isadmin()) {
++            throw new RemoteAccessDeniedException('You are not allowed to access ACLs, superuser permission is required', 114);
++        }
++
++        /** @var admin_plugin_acl $apa */
+         $apa = plugin_load('admin', 'acl');
+         return $apa->_acl_del($scope, $user);
+     }
diff --git a/www/dokuwiki/files/patch-2014-09-29c-to-2014-09-29d b/www/dokuwiki/files/patch-2014-09-29c-to-2014-09-29d
new file mode 100644
index 000000000000..108b947a5019
--- /dev/null
+++ b/www/dokuwiki/files/patch-2014-09-29c-to-2014-09-29d
@@ -0,0 +1,50 @@
+diff -ur VERSION VERSION
+--- VERSION	2015-02-24 12:01:05.000000000 -0800
++++ VERSION	2015-03-19 12:29:53.000000000 -0700
+@@ -1 +1 @@
+-2014-09-29c "Hrun"
++2014-09-29d "Hrun"
+diff -ur doku.php doku.php
+--- doku.php	2015-02-24 12:01:05.000000000 -0800
++++ doku.php	2015-03-19 12:29:53.000000000 -0700
+@@ -9,7 +9,7 @@
+  */
+ 
+ // update message version
+-$updateVersion = 46.3;
++$updateVersion = 46.4;
+ 
+ //  xdebug_start_profiling();
+ 
+diff -ur lib/plugins/usermanager/admin.php lib/plugins/usermanager/admin.php
+--- lib/plugins/usermanager/admin.php	2015-02-24 12:01:05.000000000 -0800
++++ lib/plugins/usermanager/admin.php	2015-03-19 12:29:53.000000000 -0700
+@@ -191,9 +191,9 @@
+                  */
+                 $groups = join(', ',$grps);
+                 ptln("    <tr class=\"user_info\">");
+-                ptln("      <td class=\"centeralign\"><input type=\"checkbox\" name=\"delete[".$user."]\" ".$delete_disable." /></td>");
++                ptln("      <td class=\"centeralign\"><input type=\"checkbox\" name=\"delete[".hsc($user)."]\" ".$delete_disable." /></td>");
+                 if ($editable) {
+-                    ptln("    <td><a href=\"".wl($ID,array('fn[edit]['.hsc($user).']' => 1,
++                    ptln("    <td><a href=\"".wl($ID,array('fn[edit]['.$user.']' => 1,
+                                                            'do' => 'admin',
+                                                            'page' => 'usermanager',
+                                                            'sectok' => getSecurityToken())).
+@@ -325,7 +325,7 @@
+ 
+         // save current $user, we need this to access details if the name is changed
+         if ($user)
+-          ptln("          <input type=\"hidden\" name=\"userid_old\"  value=\"".$user."\" />",$indent);
++          ptln("          <input type=\"hidden\" name=\"userid_old\"  value=\"".hsc($user)."\" />",$indent);
+ 
+         $this->_htmlFilterSettings($indent+10);
+ 
+@@ -370,6 +370,7 @@
+             $fieldtype = 'text';
+             $autocomp  = '';
+         }
++        $value = hsc($value);
+ 
+         echo "<tr $class>";
+         echo "<td><label for=\"$id\" >$label: </label></td>";
diff --git a/www/dokuwiki/pkg-descr b/www/dokuwiki/pkg-descr
index c988d5c4ec87..ab1860d6ddba 100644
--- a/www/dokuwiki/pkg-descr
+++ b/www/dokuwiki/pkg-descr
@@ -5,4 +5,4 @@ makes sure the datafiles remain readable outside the Wiki and eases the
 creation of structured texts.
 All data is stored in plain text files - no database is required.
 
-WWW: https://wiki.splitbrain.org/wiki:dokuwiki
+WWW: https://www.dokuwiki.org/
diff --git a/www/dokuwiki/pkg-plist b/www/dokuwiki/pkg-plist
index 70bab690246a..cb123ee1be7f 100644
--- a/www/dokuwiki/pkg-plist
+++ b/www/dokuwiki/pkg-plist
@@ -36,6 +36,7 @@
 %%WWWDIR%%/data/media_attic/_dummy
 %%WWWDIR%%/data/media_meta/_dummy
 %%WWWDIR%%/data/meta/_dummy
+%%WWWDIR%%/data/pages/playground/playground.txt
 %%WWWDIR%%/data/pages/wiki/dokuwiki.txt
 %%WWWDIR%%/data/pages/wiki/syntax.txt
 %%WWWDIR%%/data/pages/wiki/welcome.txt