diff options
| author | junovitch <junovitch@FreeBSD.org> | 2016-06-10 09:15:58 +0800 |
|---|---|---|
| committer | junovitch <junovitch@FreeBSD.org> | 2016-06-10 09:15:58 +0800 |
| commit | 53db55a4310d9e712be21b9afa046372e39bcdad (patch) | |
| tree | ceb55c85326e3810909407351c117ac32448d9ab | |
| parent | ef456676e34367e5cecf567e01edd6b6275c31ae (diff) | |
| download | freebsd-ports-graphics-53db55a4310d9e712be21b9afa046372e39bcdad.tar.gz freebsd-ports-graphics-53db55a4310d9e712be21b9afa046372e39bcdad.tar.zst freebsd-ports-graphics-53db55a4310d9e712be21b9afa046372e39bcdad.zip | |
Apply patch from upstream for cross-site scripting vulnerability
PR: 209841
Reported by: Vladimir Krstulja <vlad-fbsd@acheronmedia.com>
Approved by: maintainer timeout (2 weeks)
Security: CVE-2016-5103
Security: https://vuxml.FreeBSD.org/freebsd/97e86d10-2ea7-11e6-ae88-002590263bf5.html
MFH: 2016Q2
| -rw-r--r-- | mail/roundcube/Makefile | 1 | ||||
| -rw-r--r-- | mail/roundcube/files/patch-CVE-2016-5103 | 19 |
2 files changed, 20 insertions, 0 deletions
diff --git a/mail/roundcube/Makefile b/mail/roundcube/Makefile index d3db1818e15..b2a712698a9 100644 --- a/mail/roundcube/Makefile +++ b/mail/roundcube/Makefile @@ -2,6 +2,7 @@ PORTNAME= roundcube DISTVERSION= 1.1.5 +PORTREVISION= 1 PORTEPOCH= 1 CATEGORIES?= mail www MASTER_SITES= https://github.com/roundcube/roundcubemail/releases/download/${DISTVERSION}/ diff --git a/mail/roundcube/files/patch-CVE-2016-5103 b/mail/roundcube/files/patch-CVE-2016-5103 new file mode 100644 index 00000000000..0014f6676fb --- /dev/null +++ b/mail/roundcube/files/patch-CVE-2016-5103 @@ -0,0 +1,19 @@ +commit 6652367d656de7e5f404935be04e10aa281add53 +Author: Aleksander Machniak <alec@alec.pl> +Date: Fri May 6 08:28:15 2016 +0200 + + Fix XSS issue in href attribute on area tag (#5240, #5241) + +diff --git a/program/lib/Roundcube/rcube_washtml.php b/program/lib/Roundcube/rcube_washtml.php +index 5938d9b..d03f04a 100644 +--- program/lib/Roundcube/rcube_washtml.php ++++ program/lib/Roundcube/rcube_washtml.php +@@ -370,7 +370,7 @@ class rcube_washtml + */ + private function is_link_attribute($tag, $attr) + { +- return $tag == 'a' && $attr == 'href'; ++ return ($tag == 'a' || $tag == 'area') && $attr == 'href'; + } + + /** |