Pullup ticket #6845 - requested by taca
www/php-concrete-cms: security fix

Revisions pulled up:
- www/php-concrete-cms/Makefile                                 1.3
- www/php-concrete-cms/PLIST                                    1.2
- www/php-concrete-cms/distinfo                                 1.3

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Sun Apr  7 13:59:05 UTC 2024

   Modified Files:
   	pkgsrc/www/php-concrete-cms: Makefile PLIST distinfo

   Log Message:
   www/php-concrete-cms: update to 9.2.8

   9.2.8 (2024-04-02)

   Bug Fixes

   * Fixed bug where c5:info console command would fail when run on a Concrete
     webroot if that webroot was not yet an installed Concrete site.

   * Fixed bug where logout link in toolbar would not work when user was logged
     in as an editor who could not view the Dashboard (thanks ounziw)

   Security Updates

   * Created CVE-2024-2753 Stored XSS on the calendar color settings screen and
     fixed it with commit 11988 Prior to the fix, a rogue administrator could
     put malicious javascript on the Concrete CMS color setting screen which
     would have would have been triggered by and affected users who accessed
     the color settings screen.  The Concrete CMS security team gave this
     vulnerability a CVSS v3.1 score of 2.0 with a vector of
     AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N

     Thank you Rikuto Tauchi for reporting HackerOne 2433383.

   * Created CVE-2024-3178 Cross-site Scripting (XSS) - Advanced File Search
     Filter and fixed it with commit 11988 for version 9 and commit 11989 for
     version 8.  Prior to the fix, a rogue administrator could add malicious
     code in the file manager because of insufficient validation of
     administrator provided data.  All administrators have access to the File
     Manager and hence could create a search filter with the malicious code
     attached.  The Concrete CMS security team gave this vulnerability a CVSS
     v3.1 score of 3.1 with a vector of AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L

     Thank you Guram (javakhishvili) for reporting HackerOne 949443

   * Created CVE-2024-3179 Stored XSS in the Custom Class page editing and
     fixed it with commit 11988 for version 9 and commit 11989 for version 8.
     Prior to the fix, a rogue administrator could insert malicious code in the
     custom class field due to insufficient validation of administrator
     provided data.  Concrete CMS version 9.2.8 and 8.5.13 no longer allow any
     non alphanumeric characters in this CSS class.  The Concrete CMS security
     team gave this vulnerability a CVSS v3.1 score of 3.1 with a vector of
     AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L Thank you Alexey Solovyev for
     reporting HackerOne 918129.

   * Created and fixed [CVE-2024-3180]
     (https://nvd.nist.gov/vuln/detail/CVE-2024-3180) Prior to fix, stored XSS
     could be executed by a rogue administrator adding malicious code to the
     link-text field when creating a block of type file.  Fixed with commit
     11988 for version 9 and commit 11989 for version 8.  The Concrete CMS
     security team gave this vulnerability a CVSS v3.1 sore of 3.1 with a
     vector of AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L Thank you Alexey Solovyev
     for reporting HackerOne 903356

   * Created CVE-2024-3181 Stored XSS in the Search Field.  Prior to the fix,
     stored XSS could be executed by an administrator changing a filter to
     which a rogue administrator had previously added malicious code.  The
     Concrete Team fixed this with commit 11988 for version 9 and commit 11989
     for version 8. Thank you Alexey Solovyev for reporting HackerOne 918142


(bsiegert)