Add two security hotfixes for Zope - more complex Zope internals stuff

which allows people who may edit DTML to gain higher privilege, and
those who have higher privilege in some areas of the Zope tree to gain
it in other areas.

3 files changed, 19 insertions, 2 deletions

diff --git a/www/zope28/Makefile b/www/zope28/Makefile
index 94afb15382b8..e3b06d80ce90 100644
--- a/www/zope28/Makefile
+++ b/www/zope28/Makefile
@@ -7,10 +7,16 @@
 
 PORTNAME=	zope
 PORTVERSION=	2.2.2
+PORTREVISION=	1
 CATEGORIES=	www python
-MASTER_SITES=	http://www.zope.org/Products/Zope/${PORTVERSION}/
+MASTER_SITES=	http://www.zope.org/Products/Zope/${PORTVERSION}/ \
+		http://www.zope.org/Products/Zope/Hotfix_2000-10-02/ \
+		http://www.zope.org/Products/Zope/Hotfix_2000-10-11/
 DISTNAME=	Zope-${PORTVERSION}-src
 EXTRACT_SUFX=	.tgz
+DISTFILES=	${DISTNAME}${EXTRACT_SUFX} \
+		Hotfix_2000-10-02.tar.gz \
+		Hotfix_2000-10-11.tgz
 
 MAINTAINER=	nbm@FreeBSD.org
 
@@ -18,6 +24,8 @@ BUILD_DEPENDS=	python1.5:${PORTSDIR}/lang/python15
 
 #RUN_DEPENDS=	${LOCALBASE}/sbin/apache:${PORTSDIR}/www/apache13-modssl
 
+DIST_SUBDIR=	zope
+
 # Build has to be done in the final location after installing the sources
 # there. It were a major action to fix all paths otherwise.
 do-build:	# empty, but needs to be there for the python dependency.
@@ -62,6 +70,7 @@ do-install:	#
 	@${ECHO} "===>   Please be patient, some builds need their time."
 	@${ECHO} "===>   Copying..."
 	@${CP} -Rp ${WRKSRC}/* ${ZOPEBASEDIR}/
+	@${CP} -Rp ${WRKDIR}/lib ${ZOPEBASEDIR}/
 	@#
 	@${CHMOD} -R u+w ${ZOPEBASEDIR}
 	@(cd ${ZOPEBASEDIR} && ${PYTHON15} w_pcgi.py)
@@ -97,7 +106,7 @@ do-install:	#
 	@${ECHO} "===>   Please have a look at this file and the instructions"
 	@${ECHO} "===>   therein and incorporate them to your apache.conf."
 	@${ECHO} "===>   Creating rc startup file for Zope-${PORTVERSION}..."
-	@${MKDIR} -p ${PREFIX}/etc/rc.d
+	@${MKDIR} ${PREFIX}/etc/rc.d
 	@${SED} -e "s|%%ZOPEBASEDIR%%|${ZOPEBASEDIR}|g" -e "s|%%CGIBINDIR%%|${CGIBINDIR}|g" \
 		< ${FILESDIR}/zope.sh.in > ${PREFIX}/etc/rc.d/zope.sh
 	@${CHMOD} ug+x,o-rwx ${PREFIX}/etc/rc.d/zope.sh
diff --git a/www/zope28/distinfo b/www/zope28/distinfo
index 95ec6edcb348..2498415d8f34 100644
--- a/www/zope28/distinfo
+++ b/www/zope28/distinfo
@@ -1 +1,3 @@
 MD5 (Zope-2.2.2-src.tgz) = 83c8197f18bf97ad62bf2c5e424e2b82
+MD5 (Hotfix_2000-10-02.tar.gz) = 86e4c142d4be005e427cc2ccfee381fd
+MD5 (Hotfix_2000-10-11.tgz) = a0aa11f5410e7be68d55a504c7b09392
diff --git a/www/zope28/pkg-plist b/www/zope28/pkg-plist
index 1e10200d2e63..413a89a2bc3b 100644
--- a/www/zope28/pkg-plist
+++ b/www/zope28/pkg-plist
@@ -566,6 +566,10 @@ etc/rc.d/zope.sh
 %%ZOPEBASEDIR%%/lib/python/Products/ExternalMethod/methodEdit.dtml
 %%ZOPEBASEDIR%%/lib/python/Products/ExternalMethod/version.txt
 %%ZOPEBASEDIR%%/lib/python/Products/ExternalMethod/www/function.gif
+%%ZOPEBASEDIR%%/lib/python/Products/Hotfix_2000-10-02/__init__.py
+%%ZOPEBASEDIR%%/lib/python/Products/Hotfix_2000-10-02/README.txt
+%%ZOPEBASEDIR%%/lib/python/Products/Hotfix_2000-10-11/__init__.py
+%%ZOPEBASEDIR%%/lib/python/Products/Hotfix_2000-10-11/README.txt
 %%ZOPEBASEDIR%%/lib/python/Products/MIMETools/MIMETag.py
 %%ZOPEBASEDIR%%/lib/python/Products/MIMETools/MIMETag.pyc
 %%ZOPEBASEDIR%%/lib/python/Products/MIMETools/README.txt
@@ -1306,6 +1310,8 @@ etc/rc.d/zope.sh
 @dirrm %%ZOPEBASEDIR%%/lib/python/Products/ExternalMethod/help
 @dirrm %%ZOPEBASEDIR%%/lib/python/Products/ExternalMethod/www
 @dirrm %%ZOPEBASEDIR%%/lib/python/Products/ExternalMethod
+@dirrm %%ZOPEBASEDIR%%/lib/python/Products/Hotfix_2000-10-02
+@dirrm %%ZOPEBASEDIR%%/lib/python/Products/Hotfix_2000-10-11
 @dirrm %%ZOPEBASEDIR%%/lib/python/Products/MIMETools
 @dirrm %%ZOPEBASEDIR%%/lib/python/Products/MailHost/help
 @dirrm %%ZOPEBASEDIR%%/lib/python/Products/MailHost/release