Add an install-time warning about insecurity of this port - it has local

exploits yielding user uucp, but due to the nature of the software probably
isn't going to be widely used on multi-user systems.

2 files changed, 14 insertions, 0 deletions

diff --git a/graphics/camediaplay/Makefile b/graphics/camediaplay/Makefile
index dc8e2c949309..104bbb635b21 100644
--- a/graphics/camediaplay/Makefile
+++ b/graphics/camediaplay/Makefile
@@ -19,6 +19,11 @@ MAN1=	camediaplay.1
 
 DOC=	README.english README.japanese PROTOCOL
 
+pre-fetch:
+.if !defined(BATCH) && !defined(PACKAGE_BUILDING)
+	${SH} pkg-install
+.endif
+
 post-install:
 	${MKDIR} ${PREFIX}/share/doc/camediaplay
 	for i in ${DOC}; do \
diff --git a/graphics/camediaplay/pkg-install b/graphics/camediaplay/pkg-install
new file mode 100644
index 000000000000..564aa6f6de4b
--- /dev/null
+++ b/graphics/camediaplay/pkg-install
@@ -0,0 +1,9 @@
+#!/bin/sh
+
+if [ "$2" = "POST-INSTALL" -o -n "${PACKAGE_BUILDING}" ]; then
+  exit 0
+fi
+
+/usr/bin/dialog --yesno "SECURITY NOTE: This port is not safe to install on multi-user systems containing untrusted users - it is vulnerable to a local buffer overflow and format string vulnerability which allow an attacker to obtain access to the uucp user.  Do you wish to proceed with the installation of the software anyway?" 9 70 || /usr/bin/false
+
+