git: f25808f72426 - 2022Q4 - mail/horde-imp: address ZDI-20-1051 / ZDI-CAN-10436
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Fri, 28 Oct 2022 17:16:07 UTC
The branch 2022Q4 has been updated by thierry: URL: https://cgit.FreeBSD.org/ports/commit/?id=f25808f72426f5644fe9a1c0d0d037aa9c16fb29 commit f25808f72426f5644fe9a1c0d0d037aa9c16fb29 Author: Thierry Thomas <thierry@FreeBSD.org> AuthorDate: 2022-10-14 08:35:37 +0000 Commit: Thierry Thomas <thierry@FreeBSD.org> CommitDate: 2022-10-28 17:15:44 +0000 mail/horde-imp: address ZDI-20-1051 / ZDI-CAN-10436 PR: 267049 Approved by: maintainer’s time-out Obtained from: https://github.com/horde/imp/pull/10/files Fixes: Address ZDI-20-1051 / ZDI-CAN-10436 MFH: 2022Q4 Security: https://www.zerodayinitiative.com/advisories/ZDI-20-1051/ (cherry picked from commit dfa4c773430c9297b3f54d3b1a1202e18e7f120d) --- mail/horde-imp/Makefile | 1 + mail/horde-imp/files/patch-config_prefs.php | 6 +++--- mail/horde-imp/files/patch-lib_Prefs_Sort.php | 19 +++++++++++++++++++ 3 files changed, 23 insertions(+), 3 deletions(-) diff --git a/mail/horde-imp/Makefile b/mail/horde-imp/Makefile index f2cd26c90976..897a035c0b65 100644 --- a/mail/horde-imp/Makefile +++ b/mail/horde-imp/Makefile @@ -1,5 +1,6 @@ PORTNAME= imp PORTVERSION= 6.2.27 +PORTREVISION= 1 CATEGORIES= mail www pear PKGNAMEPREFIX= ${PHP_PKGNAMEPREFIX}horde- diff --git a/mail/horde-imp/files/patch-config_prefs.php b/mail/horde-imp/files/patch-config_prefs.php index de8a319f1870..e355424286ca 100644 --- a/mail/horde-imp/files/patch-config_prefs.php +++ b/mail/horde-imp/files/patch-config_prefs.php @@ -1,6 +1,6 @@ ---- config/prefs.php.orig 2011-05-03 06:27:23.000000000 -0800 -+++ config/prefs.php 2011-05-07 10:06:10.000000000 -0800 -@@ -1200,7 +1200,7 @@ +--- config/prefs.php.orig 2020-08-27 19:34:20 UTC ++++ config/prefs.php +@@ -930,7 +930,7 @@ $_prefs['sourceselect'] = array( // You can provide default values this way: // 'value' => json_encode(array('source_one', 'source_two')) $_prefs['search_sources'] = array( diff --git a/mail/horde-imp/files/patch-lib_Prefs_Sort.php b/mail/horde-imp/files/patch-lib_Prefs_Sort.php new file mode 100644 index 000000000000..c9ffce90eab1 --- /dev/null +++ b/mail/horde-imp/files/patch-lib_Prefs_Sort.php @@ -0,0 +1,19 @@ +--- lib/Prefs/Sort.php.orig 2020-08-27 19:34:20 UTC ++++ lib/Prefs/Sort.php +@@ -39,9 +39,13 @@ class IMP_Prefs_Sort implements ArrayAccess, IteratorA + { + global $prefs; + +- $sortpref = @unserialize($prefs->getValue(self::SORTPREF)); +- if (is_array($sortpref)) { +- $this->_sortpref = $sortpref; ++ $serializedPref = $prefs->getValue(self::SORTPREF); ++ // Only unserialize non-empty strings. Disallow yielding any classes. ++ if (!empty($serializedPref && is_string($serializedPref))) { ++ $sortpref = @unserialize($serializedPref, ['allowed_classes' => false]); ++ if (is_array($sortpref)) { ++ $this->_sortpref = $sortpref; ++ } + } + } +