diff options
| author | junovitch <junovitch@FreeBSD.org> | 2016-06-10 01:15:58 +0000 |
|---|---|---|
| committer | junovitch <junovitch@FreeBSD.org> | 2016-06-10 01:15:58 +0000 |
| commit | adb7d3258d44bb86397167aa69b8ca9fd48dee57 (patch) | |
| tree | ceb55c85326e3810909407351c117ac32448d9ab | |
| parent | dbe6a98999db88c2940f470c8e97a2b9e60ada3a (diff) | |
| download | FreeBSD-ports-adb7d3258d44bb86397167aa69b8ca9fd48dee57.zip FreeBSD-ports-adb7d3258d44bb86397167aa69b8ca9fd48dee57.tar.gz | |
Apply patch from upstream for cross-site scripting vulnerability
PR: 209841
Reported by: Vladimir Krstulja <vlad-fbsd@acheronmedia.com>
Approved by: maintainer timeout (2 weeks)
Security: CVE-2016-5103
Security: https://vuxml.FreeBSD.org/freebsd/97e86d10-2ea7-11e6-ae88-002590263bf5.html
MFH: 2016Q2
| -rw-r--r-- | mail/roundcube/Makefile | 1 | ||||
| -rw-r--r-- | mail/roundcube/files/patch-CVE-2016-5103 | 19 |
2 files changed, 20 insertions, 0 deletions
diff --git a/mail/roundcube/Makefile b/mail/roundcube/Makefile index d3db181..b2a7126 100644 --- a/mail/roundcube/Makefile +++ b/mail/roundcube/Makefile @@ -2,6 +2,7 @@ PORTNAME= roundcube DISTVERSION= 1.1.5 +PORTREVISION= 1 PORTEPOCH= 1 CATEGORIES?= mail www MASTER_SITES= https://github.com/roundcube/roundcubemail/releases/download/${DISTVERSION}/ diff --git a/mail/roundcube/files/patch-CVE-2016-5103 b/mail/roundcube/files/patch-CVE-2016-5103 new file mode 100644 index 0000000..0014f66 --- /dev/null +++ b/mail/roundcube/files/patch-CVE-2016-5103 @@ -0,0 +1,19 @@ +commit 6652367d656de7e5f404935be04e10aa281add53 +Author: Aleksander Machniak <alec@alec.pl> +Date: Fri May 6 08:28:15 2016 +0200 + + Fix XSS issue in href attribute on area tag (#5240, #5241) + +diff --git a/program/lib/Roundcube/rcube_washtml.php b/program/lib/Roundcube/rcube_washtml.php +index 5938d9b..d03f04a 100644 +--- program/lib/Roundcube/rcube_washtml.php ++++ program/lib/Roundcube/rcube_washtml.php +@@ -370,7 +370,7 @@ class rcube_washtml + */ + private function is_link_attribute($tag, $attr) + { +- return $tag == 'a' && $attr == 'href'; ++ return ($tag == 'a' || $tag == 'area') && $attr == 'href'; + } + + /** |
