Wed Mar 28 15:14:43 2012 UTC ()
Add unofficial fix for CVE-2012-1297 by checking Referer as days of Contao 2.9.

Bump PKGREVISION.


(taca)
diff -r1.1.1.1 -r1.2 pkgsrc/www/contao211/MESSAGE
diff -r1.1.1.1 -r1.2 pkgsrc/www/contao211/Makefile
diff -r1.5 -r1.6 pkgsrc/www/contao211/distinfo
diff -r0 -r1.1 pkgsrc/www/contao211/patches/patch-system_initialize.php
cvs diff -r1.1.1.1 -r1.2 pkgsrc/www/contao211/Attic/MESSAGE (expand / switch to unified diff)

--- pkgsrc/www/contao211/Attic/MESSAGE 2012/02/19 10:54:07 1.1.1.1
+++ pkgsrc/www/contao211/Attic/MESSAGE 2012/03/28 15:14:43 1.2
@@ -1,13 +1,18 @@ @@ -1,13 +1,18 @@
1=========================================================================== 1===========================================================================
2$NetBSD: MESSAGE,v 1.1.1.1 2012/02/19 10:54:07 taca Exp $ 2$NetBSD: MESSAGE,v 1.2 2012/03/28 15:14:43 taca Exp $
3 3
4To complete the setup, please read: 4To complete the setup, please read:
5 5
6 ${PREFIX}/share/doc/contao${CT_VER}/README 6 ${PREFIX}/share/doc/contao${CT_VER}/README
7 7
8To use minify the HTML markup function, you'll have to install the 8To use minify the HTML markup function, you'll have to install the
9following package: 9following package:
10 10
11 www/php-tidy 11 www/php-tidy
12 12
 13This package contains unofficial fix for CVE-2012-1297. If there are any
 14problem by this fix, add a below line to system/config/localconfig.php.
 15
 16$GLOBALS['TL_CONFIG']['disableCompatRefererCheck'] = true;
 17
13=========================================================================== 18===========================================================================
cvs diff -r1.1.1.1 -r1.2 pkgsrc/www/contao211/Attic/Makefile (expand / switch to unified diff)

--- pkgsrc/www/contao211/Attic/Makefile 2012/02/19 10:54:07 1.1.1.1
+++ pkgsrc/www/contao211/Attic/Makefile 2012/03/28 15:14:43 1.2
@@ -1,18 +1,19 @@ @@ -1,18 +1,19 @@
1# $NetBSD: Makefile,v 1.1.1.1 2012/02/19 10:54:07 taca Exp $ 1# $NetBSD: Makefile,v 1.2 2012/03/28 15:14:43 taca Exp $
2# 2#
3 3
4DISTNAME= contao-${CT_VERSION} 4DISTNAME= contao-${CT_VERSION}
5PKGNAME= contao${CT_VER}-${CT_PKGVER} 5PKGNAME= contao${CT_VER}-${CT_PKGVER}
 6PKGREVISION= 1
6CATEGORIES= www 7CATEGORIES= www
7MASTER_SITES= ${MASTER_SITE_SOURCEFORGE:=contao/} 8MASTER_SITES= ${MASTER_SITE_SOURCEFORGE:=contao/}
8DIST_SUBDIR= ${CT_DIST_SUBDIR} 9DIST_SUBDIR= ${CT_DIST_SUBDIR}
9 10
10MAINTAINER= taca@NetBSD.org 11MAINTAINER= taca@NetBSD.org
11HOMEPAGE= http://www.contao.org/ 12HOMEPAGE= http://www.contao.org/
12COMMENT= Contao Open Source CMS 13COMMENT= Contao Open Source CMS
13LICENSE= gnu-lgpl-v3 14LICENSE= gnu-lgpl-v3
14 15
15DEPENDS+= ${PHP_PKG_PREFIX}-dom>=5.2.0:../../textproc/php-dom 16DEPENDS+= ${PHP_PKG_PREFIX}-dom>=5.2.0:../../textproc/php-dom
16DEPENDS+= ${PHP_PKG_PREFIX}-gd>=5.2.0:../../graphics/php-gd 17DEPENDS+= ${PHP_PKG_PREFIX}-gd>=5.2.0:../../graphics/php-gd
17DEPENDS+= ${PHP_PKG_PREFIX}-mbstring>=5.2.0:../../converters/php-mbstring 18DEPENDS+= ${PHP_PKG_PREFIX}-mbstring>=5.2.0:../../converters/php-mbstring
18DEPENDS+= ${PHP_PKG_PREFIX}-{mysql,mysqli}>=5.2.0:../../databases/php-mysqli 19DEPENDS+= ${PHP_PKG_PREFIX}-{mysql,mysqli}>=5.2.0:../../databases/php-mysqli
cvs diff -r1.5 -r1.6 pkgsrc/www/contao211/Attic/distinfo (expand / switch to unified diff)

--- pkgsrc/www/contao211/Attic/distinfo 2012/03/14 16:24:35 1.5
+++ pkgsrc/www/contao211/Attic/distinfo 2012/03/28 15:14:43 1.6
@@ -1,5 +1,6 @@ @@ -1,5 +1,6 @@
1$NetBSD: distinfo,v 1.5 2012/03/14 16:24:35 taca Exp $ 1$NetBSD: distinfo,v 1.6 2012/03/28 15:14:43 taca Exp $
2 2
3SHA1 (contao-2.11.2.tar.gz) = 0cf939e6a4c8b49a4d21a51bd50ae718dfbe024e 3SHA1 (contao-2.11.2.tar.gz) = 0cf939e6a4c8b49a4d21a51bd50ae718dfbe024e
4RMD160 (contao-2.11.2.tar.gz) = 580553e29b92ea7bc5b04e38946edb269bc2ac78 4RMD160 (contao-2.11.2.tar.gz) = 580553e29b92ea7bc5b04e38946edb269bc2ac78
5Size (contao-2.11.2.tar.gz) = 5319511 bytes 5Size (contao-2.11.2.tar.gz) = 5319511 bytes
 6SHA1 (patch-system_initialize.php) = 109f381bef4bae32617549709601eb2a30bbb01a
File Added: pkgsrc/www/contao211/patches/Attic/patch-system_initialize.php
$NetBSD: patch-system_initialize.php,v 1.1 2012/03/28 15:14:43 taca Exp $

* Unofficial fix for CVE-2012-1297 by checking Referer as days of Contao 2.9.

--- system/initialize.php.orig	2012-03-14 15:13:14.000000000 +0000
+++ system/initialize.php
@@ -168,10 +168,28 @@ if (file_exists(TL_ROOT . '/system/confi
 /**
  * Check the request token upon POST requests
  */
-if ($_POST && !$GLOBALS['TL_CONFIG']['disableRefererCheck'] && !defined('BYPASS_TOKEN_CHECK'))
+if (!$GLOBALS['TL_CONFIG']['disableRefererCheck'] &&
+    ($_POST && !defined('BYPASS_TOKEN_CHECK') ||
+     $_SERVER['REQUEST_METHOD'] == 'POST' && !$GLOBALS['TL_CONFIG']['disableCompatRefererCheck']))
 {
-	// Exit if the token cannot be validated
-	if (!$objToken->validate($objInput->post('REQUEST_TOKEN')))
+    $bad = false;
+
+	// Exit if traditional referer check is enabled.
+    if (!$GLOBALS['TL_CONFIG']['disableCompatRefererCheck'])
+    {
+        $self = parse_url($objEnvironment->url);
+        $referer = parse_url($objEnvironment->httpReferer);
+
+        $bad = (!strlen($referer['host']) || $referer['host'] != $self['host']);
+    }
+
+    if (!$bad)
+    {
+        // Exit if the token cannot be validated
+        $bad = !$objToken->validate($objInput->post('REQUEST_TOKEN'));
+    }
+    
+	if ($bad)
 	{
 		// Force JavaScript redirect upon Ajax requests (IE requires absolute link)
 		if ($objEnvironment->isAjaxRequest)