diff options
Diffstat (limited to 'mail/roundcube')
| -rw-r--r-- | mail/roundcube/Makefile | 1 | ||||
| -rw-r--r-- | mail/roundcube/files/patch-CVE-2016-5103 | 19 |
2 files changed, 20 insertions, 0 deletions
diff --git a/mail/roundcube/Makefile b/mail/roundcube/Makefile index d3db1818e15..b2a712698a9 100644 --- a/mail/roundcube/Makefile +++ b/mail/roundcube/Makefile @@ -2,6 +2,7 @@ PORTNAME= roundcube DISTVERSION= 1.1.5 +PORTREVISION= 1 PORTEPOCH= 1 CATEGORIES?= mail www MASTER_SITES= https://github.com/roundcube/roundcubemail/releases/download/${DISTVERSION}/ diff --git a/mail/roundcube/files/patch-CVE-2016-5103 b/mail/roundcube/files/patch-CVE-2016-5103 new file mode 100644 index 00000000000..0014f6676fb --- /dev/null +++ b/mail/roundcube/files/patch-CVE-2016-5103 @@ -0,0 +1,19 @@ +commit 6652367d656de7e5f404935be04e10aa281add53 +Author: Aleksander Machniak <alec@alec.pl> +Date: Fri May 6 08:28:15 2016 +0200 + + Fix XSS issue in href attribute on area tag (#5240, #5241) + +diff --git a/program/lib/Roundcube/rcube_washtml.php b/program/lib/Roundcube/rcube_washtml.php +index 5938d9b..d03f04a 100644 +--- program/lib/Roundcube/rcube_washtml.php ++++ program/lib/Roundcube/rcube_washtml.php +@@ -370,7 +370,7 @@ class rcube_washtml + */ + private function is_link_attribute($tag, $attr) + { +- return $tag == 'a' && $attr == 'href'; ++ return ($tag == 'a' || $tag == 'area') && $attr == 'href'; + } + + /** |