Update to 3.20161229. From the changelog: * Security: force CGI::FormBuilder->field to scalar context where necessary, avoiding unintended function argument injection analogous to CVE-2014-1572. In ikiwiki this could be used to forge commit metadata, but thankfully nothing more serious. (CVE-2016-9646) * Security: try revert operations in a temporary working tree before approving them. Previously, automatic rename detection could result in a revert writing outside the wiki srcdir or altering a file that the reverting user should not be able to alter, an authorization bypass. (CVE-2016-10026 represents the original vulnerability.) The incomplete fix released in 3.20161219 was not effective for git versions prior to 2.8.0rc0. (CVE-2016-9645 represents that incomplete solution.) * Add CVE references for CVE-2016-10026 * Add automated test for using the CGI with git, including CVE-2016-10026 - Build-depend on libipc-run-perl for better build-time test coverage * Add missing ikiwiki.setup for the manual test for CVE-2016-10026 * git: don't issue a warning if the rcsinfo CGI parameter is undefined * git: do not fail to commit changes with a recent git version and an anonymous committerdiff -r1.144 -r1.145 pkgsrc/www/ikiwiki/Makefile
(schmonz)
@@ -1,17 +1,17 @@ | @@ -1,17 +1,17 @@ | |||
1 | # $NetBSD: Makefile,v 1.144 2016/12/21 00:52:59 schmonz Exp $ | 1 | # $NetBSD: Makefile,v 1.145 2016/12/30 03:21:11 schmonz Exp $ | |
2 | # | 2 | # | |
3 | 3 | |||
4 | DISTNAME= ikiwiki_3.20161219 | 4 | DISTNAME= ikiwiki_3.20161229 | |
5 | PKGNAME= ${DISTNAME:S/_/-/} | 5 | PKGNAME= ${DISTNAME:S/_/-/} | |
6 | CATEGORIES= www textproc | 6 | CATEGORIES= www textproc | |
7 | MASTER_SITES= ${MASTER_SITE_DEBIAN:=pool/main/i/ikiwiki/} | 7 | MASTER_SITES= ${MASTER_SITE_DEBIAN:=pool/main/i/ikiwiki/} | |
8 | 8 | |||
9 | MAINTAINER= schmonz@NetBSD.org | 9 | MAINTAINER= schmonz@NetBSD.org | |
10 | HOMEPAGE= http://ikiwiki.info/ | 10 | HOMEPAGE= http://ikiwiki.info/ | |
11 | COMMENT= Flexible static site generator with dynamic features | 11 | COMMENT= Flexible static site generator with dynamic features | |
12 | LICENSE= gnu-gpl-v2 | 12 | LICENSE= gnu-gpl-v2 | |
13 | 13 | |||
14 | # ./pm_filter /usr/pkg 3.20141016 /usr/pkg/lib/perl5/vendor_perl/5.20.0 < ikiwiki.in > ikiwiki.out | 14 | # ./pm_filter /usr/pkg 3.20141016 /usr/pkg/lib/perl5/vendor_perl/5.20.0 < ikiwiki.in > ikiwiki.out | |
15 | # sh: ./pm_filter: not found | 15 | # sh: ./pm_filter: not found | |
16 | MAKE_JOBS_SAFE= no | 16 | MAKE_JOBS_SAFE= no | |
17 | 17 |
@@ -1,6 +1,6 @@ | @@ -1,6 +1,6 @@ | |||
1 | $NetBSD: distinfo,v 1.116 2016/12/21 00:52:59 schmonz Exp $ | 1 | $NetBSD: distinfo,v 1.117 2016/12/30 03:21:11 schmonz Exp $ | |
2 | 2 | |||
3 | SHA1 (ikiwiki_3.20161219.tar.gz) = b4ea2d1f162290aca7e6e658462d679a5a0e2498 | 3 | SHA1 (ikiwiki_3.20161229.tar.gz) = f2727e5594354974c22f83b89388c71d1fa4596f | |
4 | RMD160 (ikiwiki_3.20161219.tar.gz) = fd3f313f0ef79dc8f6f13624f12075af626f8b5b | 4 | RMD160 (ikiwiki_3.20161229.tar.gz) = f0a68c45cde83be6a12bf7e699de293df6632a40 | |
5 | SHA512 (ikiwiki_3.20161219.tar.gz) = 2b544c7fcbc878a344f03fa403de784e33a61397d58cc42356ac99ae134bf0b633d63154a9ffac01bc8cca69cdb8e2d23360b95be56d0cd8999264cdb5b7dc3e | 5 | SHA512 (ikiwiki_3.20161229.tar.gz) = dc03450e5f07823d2c8c2fcd0fed9785295b85d9b5c1c0bfc53fde0a11bb9ad0e805b38dd443424d93d5f660551436d52cffe6315b64e2b97f3f8a158afa1b5b | |
6 | Size (ikiwiki_3.20161219.tar.gz) = 3471888 bytes | 6 | Size (ikiwiki_3.20161229.tar.gz) = 3477477 bytes |