Thu May 26 23:22:17 2016 UTC ()
Update security path for CVE-2016-5103 (XSS) from upstream.

Bump PKGREVISION.


(taca)
diff -r1.81 -r1.82 pkgsrc/mail/roundcube/Makefile
diff -r1.49 -r1.50 pkgsrc/mail/roundcube/distinfo
diff -r0 -r1.3 pkgsrc/mail/roundcube/patches/patch-program_lib_Roundcube_rcube__washtml.php
cvs diff -r1.81 -r1.82 pkgsrc/mail/roundcube/Makefile (expand / switch to unified diff)

--- pkgsrc/mail/roundcube/Makefile 2016/05/26 03:20:37 1.81
+++ pkgsrc/mail/roundcube/Makefile 2016/05/26 23:22:17 1.82
@@ -1,17 +1,18 @@ @@ -1,17 +1,18 @@
1# $NetBSD: Makefile,v 1.81 2016/05/26 03:20:37 taca Exp $ 1# $NetBSD: Makefile,v 1.82 2016/05/26 23:22:17 taca Exp $
2 2
3DISTNAME= roundcubemail-1.1.5 3DISTNAME= roundcubemail-1.1.5
4PKGNAME= ${PHP_PKG_PREFIX}-${DISTNAME:S/mail-/-/} 4PKGNAME= ${PHP_PKG_PREFIX}-${DISTNAME:S/mail-/-/}
 5PKGREVISION= 1
5CATEGORIES= mail 6CATEGORIES= mail
6MASTER_SITES= ${MASTER_SITE_SOURCEFORGE:=roundcubemail/} 7MASTER_SITES= ${MASTER_SITE_SOURCEFORGE:=roundcubemail/}
7 8
8MAINTAINER= taca@NetBSD.org 9MAINTAINER= taca@NetBSD.org
9HOMEPAGE= http://roundcube.net/ 10HOMEPAGE= http://roundcube.net/
10COMMENT= Browser-based multilingual IMAP client 11COMMENT= Browser-based multilingual IMAP client
11LICENSE= gnu-gpl-v3 12LICENSE= gnu-gpl-v3
12 13
13DEPENDS+= ${PHP_PKG_PREFIX}-mbstring>=${PHP_BASE_VERS}:../../converters/php-mbstring 14DEPENDS+= ${PHP_PKG_PREFIX}-mbstring>=${PHP_BASE_VERS}:../../converters/php-mbstring
14DEPENDS+= ${PHP_PKG_PREFIX}-dom>=${PHP_BASE_VERS}:../../textproc/php-dom 15DEPENDS+= ${PHP_PKG_PREFIX}-dom>=${PHP_BASE_VERS}:../../textproc/php-dom
15DEPENDS+= ${PHP_PKG_PREFIX}-exif>=${PHP_BASE_VERS}:../../graphics/php-exif 16DEPENDS+= ${PHP_PKG_PREFIX}-exif>=${PHP_BASE_VERS}:../../graphics/php-exif
16DEPENDS+= ${PHP_PKG_PREFIX}-intl>=${PHP_BASE_VERS}:../../textproc/php-intl 17DEPENDS+= ${PHP_PKG_PREFIX}-intl>=${PHP_BASE_VERS}:../../textproc/php-intl
17DEPENDS+= ${PHP_PKG_PREFIX}-json>=${PHP_BASE_VERS}:../../textproc/php-json 18DEPENDS+= ${PHP_PKG_PREFIX}-json>=${PHP_BASE_VERS}:../../textproc/php-json
cvs diff -r1.49 -r1.50 pkgsrc/mail/roundcube/distinfo (expand / switch to unified diff)

--- pkgsrc/mail/roundcube/distinfo 2016/05/26 03:20:37 1.49
+++ pkgsrc/mail/roundcube/distinfo 2016/05/26 23:22:17 1.50
@@ -1,10 +1,11 @@ @@ -1,10 +1,11 @@
1$NetBSD: distinfo,v 1.49 2016/05/26 03:20:37 taca Exp $ 1$NetBSD: distinfo,v 1.50 2016/05/26 23:22:17 taca Exp $
2 2
3SHA1 (roundcubemail-1.1.5.tar.gz) = d0843b592a810435dff49aa615fd3075691ca18d 3SHA1 (roundcubemail-1.1.5.tar.gz) = d0843b592a810435dff49aa615fd3075691ca18d
4RMD160 (roundcubemail-1.1.5.tar.gz) = b716851dc55fa88553ad06c21e8c8080416303f1 4RMD160 (roundcubemail-1.1.5.tar.gz) = b716851dc55fa88553ad06c21e8c8080416303f1
5SHA512 (roundcubemail-1.1.5.tar.gz) = 7723746c4c1959460adb9f157fed6ebf78720ee84640791e0501b6c2adb5c60a58fa93e4e244dfad1998f3595cc31ca3dc48e7e111e69e5a0444d96d6cf04289 5SHA512 (roundcubemail-1.1.5.tar.gz) = 7723746c4c1959460adb9f157fed6ebf78720ee84640791e0501b6c2adb5c60a58fa93e4e244dfad1998f3595cc31ca3dc48e7e111e69e5a0444d96d6cf04289
6Size (roundcubemail-1.1.5.tar.gz) = 3147385 bytes 6Size (roundcubemail-1.1.5.tar.gz) = 3147385 bytes
7SHA1 (patch-ac) = 235116580665d5d58edc218c063b41171a2d9227 7SHA1 (patch-ac) = 235116580665d5d58edc218c063b41171a2d9227
8SHA1 (patch-af) = 1f95a7005569207469563aa37ff48da0383b7668 8SHA1 (patch-af) = 1f95a7005569207469563aa37ff48da0383b7668
9SHA1 (patch-plugins_password_helpers_passwd-expect) = 9e0082f23e37bbab26e8bb1439668132d5aacca2 9SHA1 (patch-plugins_password_helpers_passwd-expect) = 9e0082f23e37bbab26e8bb1439668132d5aacca2
 10SHA1 (patch-program_lib_Roundcube_rcube__washtml.php) = 3a38804d81ead4cd0271befaacc370e78c103b7a
10SHA1 (patch-rcube_mime_default) = fe6ff1bea0a2c4223b34e44a6d0ca76e6476d2aa 11SHA1 (patch-rcube_mime_default) = fe6ff1bea0a2c4223b34e44a6d0ca76e6476d2aa
File Added: pkgsrc/mail/roundcube/patches/Attic/patch-program_lib_Roundcube_rcube__washtml.php
$NetBSD: patch-program_lib_Roundcube_rcube__washtml.php,v 1.3 2016/05/26 23:22:17 taca Exp $

Fix CVE-2016-5103, XSS from upstream.

--- program/lib/Roundcube/rcube_washtml.php.orig	2016-04-17 16:22:20.000000000 +0000
+++ program/lib/Roundcube/rcube_washtml.php
@@ -370,7 +370,7 @@ class rcube_washtml
      */
     private function is_link_attribute($tag, $attr)
     {
-        return $tag == 'a' && $attr == 'href';
+        return ($tag == 'a' || $tag == 'area') && $attr == 'href';
     }
 
     /**