svn commit: r371858 - in head/www/twiki: . files

[Eygene Ryabinkin]

Author: rea
Date: Fri Oct 31 15:40:27 2014
New Revision: 371858
URL: https://svnweb.freebsd.org/changeset/ports/371858
QAT: https://qat.redports.org/buildarchive/r371858/

Log:
  TWiki: fix CVE-2014-7236
  
  This is remote Perl code execution via crafted GET variable "debugenableplugins",
    http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2014-7236
  
  MFH:		2014Q4
  Security:	21ce1840-6107-11e4-9e84-0022156e8794

Added:
  head/www/twiki/files/patch-cve-2014-7236   (contents, props changed)
Modified:
  head/www/twiki/Makefile

Modified: head/www/twiki/Makefile
==============================================================================
--- head/www/twiki/Makefile	Fri Oct 31 15:40:00 2014	(r371857)
+++ head/www/twiki/Makefile	Fri Oct 31 15:40:27 2014	(r371858)
@@ -3,6 +3,7 @@
 
 PORTNAME=	twiki
 PORTVERSION=	5.1.4
+PORTREVISION=	1
 PORTEPOCH=	1
 CATEGORIES=	www
 MASTER_SITES=	SF/${PORTNAME}/TWiki%20for%20all%20Platforms/${DISTNAME} \
@@ -29,6 +30,8 @@ RUN_DEPENDS=	\
 USES=		perl5 tar:tgz
 WRKSRC=	${WRKDIR}/twiki
 
+USES+=		cpe
+
 post-extract:
 	@${RM} -rf ${WRKSRC}/lib/CPAN
 	@${CAT} ${.CURDIR}/../twiki-*/pkg-plist |\

Added: head/www/twiki/files/patch-cve-2014-7236
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ head/www/twiki/files/patch-cve-2014-7236	Fri Oct 31 15:40:27 2014	(r371858)
@@ -0,0 +1,17 @@
+Obtained-from: http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2014-7236
+--- lib/TWiki/Plugins.pm.save1   2014-01-09 02:10:56.000000000 -0500
++++ lib/TWiki/Plugins.pm   2014-10-01 20:30:36.000000000 -0400
+@@ -186,8 +186,11 @@
+ 
+     unless( $allDisabled ) {
+         if ( $query && defined( $query->param( 'debugenableplugins' ))) {
+-            @pluginList = split( /[,\s]+/,
+-                                 $query->param( 'debugenableplugins' ));
++            @pluginList =
++              grep { /Plugin$/ }
++              map { s/[^a-zA-Z0-9]//go; $_ } # Item7558: Sanitize parameter
++              split( /[,\s]+/, $query->param( 'debugenableplugins' ));
++
+         } else {
+             if( $TWiki::cfg{PluginsOrder} ) {
+                 foreach my $plugin( split( /[,\s]+/,