Add two security hotfixes for Zope - more complex Zope internals stuff

which allows people who may edit DTML to gain higher privilege, and
those who have higher privilege in some areas of the Zope tree to gain
it in other areas.

3 files changed, 19 insertions, 2 deletions

diff --git a/www/zope28/Makefile b/www/zope28/Makefile
index 94afb15..e3b06d8 100644
--- a/www/zope28/Makefile
+++ b/www/zope28/Makefile
@@ -7,10 +7,16 @@
 
 PORTNAME=	zope
 PORTVERSION=	2.2.2
+PORTREVISION=	1
 CATEGORIES=	www python
-MASTER_SITES=	http://www.zope.org/Products/Zope/${PORTVERSION}/
+MASTER_SITES=	http://www.zope.org/Products/Zope/${PORTVERSION}/ \
+		http://www.zope.org/Products/Zope/Hotfix_2000-10-02/ \
+		http://www.zope.org/Products/Zope/Hotfix_2000-10-11/
 DISTNAME=	Zope-${PORTVERSION}-src
 EXTRACT_SUFX=	.tgz
+DISTFILES=	${DISTNAME}${EXTRACT_SUFX} \
+		Hotfix_2000-10-02.tar.gz \
+		Hotfix_2000-10-11.tgz
 
 MAINTAINER=	nbm@FreeBSD.org
 
@@ -18,6 +24,8 @@ BUILD_DEPENDS=	python1.5:${PORTSDIR}/lang/python15
 
 #RUN_DEPENDS=	${LOCALBASE}/sbin/apache:${PORTSDIR}/www/apache13-modssl
 
+DIST_SUBDIR=	zope
+
 # Build has to be done in the final location after installing the sources
 # there. It were a major action to fix all paths otherwise.
 do-build:	# empty, but needs to be there for the python dependency.
@@ -62,6 +70,7 @@ do-install:	#
 	@${ECHO} "===>   Please be patient, some builds need their time."
 	@${ECHO} "===>   Copying..."
 	@${CP} -Rp ${WRKSRC}/* ${ZOPEBASEDIR}/
+	@${CP} -Rp ${WRKDIR}/lib ${ZOPEBASEDIR}/
 	@#
 	@${CHMOD} -R u+w ${ZOPEBASEDIR}
 	@(cd ${ZOPEBASEDIR} && ${PYTHON15} w_pcgi.py)
@@ -97,7 +106,7 @@ do-install:	#
 	@${ECHO} "===>   Please have a look at this file and the instructions"
 	@${ECHO} "===>   therein and incorporate them to your apache.conf."
 	@${ECHO} "===>   Creating rc startup file for Zope-${PORTVERSION}..."
-	@${MKDIR} -p ${PREFIX}/etc/rc.d
+	@${MKDIR} ${PREFIX}/etc/rc.d
 	@${SED} -e "s|%%ZOPEBASEDIR%%|${ZOPEBASEDIR}|g" -e "s|%%CGIBINDIR%%|${CGIBINDIR}|g" \
 		< ${FILESDIR}/zope.sh.in > ${PREFIX}/etc/rc.d/zope.sh
 	@${CHMOD} ug+x,o-rwx ${PREFIX}/etc/rc.d/zope.sh
diff --git a/www/zope28/distinfo b/www/zope28/distinfo
index 95ec6ed..2498415 100644
--- a/www/zope28/distinfo
+++ b/www/zope28/distinfo
@@ -1 +1,3 @@
 MD5 (Zope-2.2.2-src.tgz) = 83c8197f18bf97ad62bf2c5e424e2b82
+MD5 (Hotfix_2000-10-02.tar.gz) = 86e4c142d4be005e427cc2ccfee381fd
+MD5 (Hotfix_2000-10-11.tgz) = a0aa11f5410e7be68d55a504c7b09392
diff --git a/www/zope28/pkg-plist b/www/zope28/pkg-plist
index 1e10200..413a89a 100644
--- a/www/zope28/pkg-plist
+++ b/www/zope28/pkg-plist
@@ -566,6 +566,10 @@ etc/rc.d/zope.sh
 %%ZOPEBASEDIR%%/lib/python/Products/ExternalMethod/methodEdit.dtml
 %%ZOPEBASEDIR%%/lib/python/Products/ExternalMethod/version.txt
 %%ZOPEBASEDIR%%/lib/python/Products/ExternalMethod/www/function.gif
+%%ZOPEBASEDIR%%/lib/python/Products/Hotfix_2000-10-02/__init__.py
+%%ZOPEBASEDIR%%/lib/python/Products/Hotfix_2000-10-02/README.txt
+%%ZOPEBASEDIR%%/lib/python/Products/Hotfix_2000-10-11/__init__.py
+%%ZOPEBASEDIR%%/lib/python/Products/Hotfix_2000-10-11/README.txt
 %%ZOPEBASEDIR%%/lib/python/Products/MIMETools/MIMETag.py
 %%ZOPEBASEDIR%%/lib/python/Products/MIMETools/MIMETag.pyc
 %%ZOPEBASEDIR%%/lib/python/Products/MIMETools/README.txt
@@ -1306,6 +1310,8 @@ etc/rc.d/zope.sh
 @dirrm %%ZOPEBASEDIR%%/lib/python/Products/ExternalMethod/help
 @dirrm %%ZOPEBASEDIR%%/lib/python/Products/ExternalMethod/www
 @dirrm %%ZOPEBASEDIR%%/lib/python/Products/ExternalMethod
+@dirrm %%ZOPEBASEDIR%%/lib/python/Products/Hotfix_2000-10-02
+@dirrm %%ZOPEBASEDIR%%/lib/python/Products/Hotfix_2000-10-11
 @dirrm %%ZOPEBASEDIR%%/lib/python/Products/MIMETools
 @dirrm %%ZOPEBASEDIR%%/lib/python/Products/MailHost/help
 @dirrm %%ZOPEBASEDIR%%/lib/python/Products/MailHost/release