git: f25808f72426 - 2022Q4 - mail/horde-imp: address ZDI-20-1051 / ZDI-CAN-10436

The branch 2022Q4 has been updated by thierry:

URL: https://cgit.FreeBSD.org/ports/commit/?id=f25808f72426f5644fe9a1c0d0d037aa9c16fb29

commit f25808f72426f5644fe9a1c0d0d037aa9c16fb29
Author:     Thierry Thomas <thierry@FreeBSD.org>
AuthorDate: 2022-10-14 08:35:37 +0000
Commit:     Thierry Thomas <thierry@FreeBSD.org>
CommitDate: 2022-10-28 17:15:44 +0000

    mail/horde-imp: address ZDI-20-1051 / ZDI-CAN-10436
    
    PR:             267049
    Approved by:    maintainer’s time-out
    Obtained from:  https://github.com/horde/imp/pull/10/files
    Fixes:          Address ZDI-20-1051 / ZDI-CAN-10436
    MFH:            2022Q4
    Security:       https://www.zerodayinitiative.com/advisories/ZDI-20-1051/
    
    (cherry picked from commit dfa4c773430c9297b3f54d3b1a1202e18e7f120d)
---
 mail/horde-imp/Makefile                       |  1 +
 mail/horde-imp/files/patch-config_prefs.php   |  6 +++---
 mail/horde-imp/files/patch-lib_Prefs_Sort.php | 19 +++++++++++++++++++
 3 files changed, 23 insertions(+), 3 deletions(-)

diff --git a/mail/horde-imp/Makefile b/mail/horde-imp/Makefile
index f2cd26c90976..897a035c0b65 100644
--- a/mail/horde-imp/Makefile
+++ b/mail/horde-imp/Makefile
@@ -1,5 +1,6 @@
 PORTNAME=	imp
 PORTVERSION=	6.2.27
+PORTREVISION=	1
 CATEGORIES=	mail www pear
 PKGNAMEPREFIX=	${PHP_PKGNAMEPREFIX}horde-
 
diff --git a/mail/horde-imp/files/patch-config_prefs.php b/mail/horde-imp/files/patch-config_prefs.php
index de8a319f1870..e355424286ca 100644
--- a/mail/horde-imp/files/patch-config_prefs.php
+++ b/mail/horde-imp/files/patch-config_prefs.php
@@ -1,6 +1,6 @@
---- config/prefs.php.orig	2011-05-03 06:27:23.000000000 -0800
-+++ config/prefs.php	2011-05-07 10:06:10.000000000 -0800
-@@ -1200,7 +1200,7 @@
+--- config/prefs.php.orig	2020-08-27 19:34:20 UTC
++++ config/prefs.php
+@@ -930,7 +930,7 @@ $_prefs['sourceselect'] = array(
  // You can provide default values this way:
  //   'value' => json_encode(array('source_one', 'source_two'))
  $_prefs['search_sources'] = array(
diff --git a/mail/horde-imp/files/patch-lib_Prefs_Sort.php b/mail/horde-imp/files/patch-lib_Prefs_Sort.php
new file mode 100644
index 000000000000..c9ffce90eab1
--- /dev/null
+++ b/mail/horde-imp/files/patch-lib_Prefs_Sort.php
@@ -0,0 +1,19 @@
+--- lib/Prefs/Sort.php.orig	2020-08-27 19:34:20 UTC
++++ lib/Prefs/Sort.php
+@@ -39,9 +39,13 @@ class IMP_Prefs_Sort implements ArrayAccess, IteratorA
+     {
+         global $prefs;
+ 
+-        $sortpref = @unserialize($prefs->getValue(self::SORTPREF));
+-        if (is_array($sortpref)) {
+-            $this->_sortpref = $sortpref;
++        $serializedPref = $prefs->getValue(self::SORTPREF);
++        // Only unserialize non-empty strings. Disallow yielding any classes.
++        if (!empty($serializedPref && is_string($serializedPref))) {
++            $sortpref = @unserialize($serializedPref, ['allowed_classes' => false]);
++            if (is_array($sortpref)) {
++                $this->_sortpref = $sortpref;
++            }
+         }
+     }
+