From 92480f1db34288cbac02a5b0b0b28c6114e63951 Mon Sep 17 00:00:00 2001
From: "Lev A. Serebryakov" <lev@FreeBSD.org>
Date: Tue, 3 Jan 2006 17:26:17 +0000
Subject:   Fix CAN-2005-3352
 (http://www.FreeBSD.org/ports/portaudit/9fff8dc8-7aa7-11da-bf72-00123f589060.html).
   Patch was borrowed from `www/apache13' port.

---
 russian/apache13/Makefile                         |  1 +
 russian/apache13/files/patch-secfix-CAN-2005-3352 | 35 +++++++++++++++++++++++
 2 files changed, 36 insertions(+)
 create mode 100644 russian/apache13/files/patch-secfix-CAN-2005-3352

(limited to 'russian/apache13')

diff --git a/russian/apache13/Makefile b/russian/apache13/Makefile
index 1a656389b4bc..d7219b2df157 100644
--- a/russian/apache13/Makefile
+++ b/russian/apache13/Makefile
@@ -7,6 +7,7 @@
 
 PORTNAME=	apache
 PORTVERSION=	${APACHE_VERSION}+${RA_VERSION}
+PORTREVISION?=	1
 CATEGORIES=	russian www
 MASTER_SITES=	${MASTER_SITE_APACHE_HTTPD}
 DISTNAME=	${PORTNAME}_${APACHE_VERSION}
diff --git a/russian/apache13/files/patch-secfix-CAN-2005-3352 b/russian/apache13/files/patch-secfix-CAN-2005-3352
new file mode 100644
index 000000000000..8febc0e58935
--- /dev/null
+++ b/russian/apache13/files/patch-secfix-CAN-2005-3352
@@ -0,0 +1,35 @@
+--- src/main/util.c (original)
++++ src/main/util.c Mon Dec 12 08:36:54 2005
+@@ -1722,6 +1722,8 @@
+ 	    j += 3;
+ 	else if (s[i] == '&')
+ 	    j += 4;
++	else if (s[i] == '"')
++	    j += 5;
+ 
+     if (j == 0)
+ 	return ap_pstrndup(p, s, i);
+@@ -1739,6 +1741,10 @@
+ 	else if (s[i] == '&') {
+ 	    memcpy(&x[j], "&amp;", 5);
+ 	    j += 4;
++	}
++	else if (s[i] == '"') {
++	    memcpy(&x[j], "&quot;", 6);
++	    j += 5;
+ 	}
+ 	else
+ 	    x[j] = s[i];
+
+--- src/modules/standard/mod_imap.c (original)
++++ src/modules/standard/mod_imap.c Mon Dec 12 08:36:54 2005
+@@ -328,7 +328,7 @@
+     if (!strcasecmp(value, "referer")) {
+         referer = ap_table_get(r->headers_in, "Referer");
+         if (referer && *referer) {
+-	    return ap_pstrdup(r->pool, referer);
++	    return ap_escape_html(r->pool, referer);
+         }
+         else {
+ 	    /* XXX:  This used to do *value = '\0'; ... which is totally bogus
+
-- 
cgit v1.2.3