[SM-Commit] GIT changes to master grimoire by Treeve Jelbert (f02db1978864b25bce5c1dce8b8da904fecdfb13)

Treeve Jelbert scm at sourcemage.org
Wed Aug 22 11:51:52 EDT 2007


GIT changes to master grimoire by Treeve Jelbert <treeve at sourcemage.org>:

 kde-core/kdebase/DETAILS                           |    2 
 kde-core/kdebase/HISTORY                           |    5 +
 kde-core/kdebase/PRE_BUILD                         |    3 
 kde-core/kdebase/post-3.5.7-kdebase-konqueror.diff |   49 ++++++++++++
 kde-core/kdelibs/DETAILS                           |    2 
 kde-core/kdelibs/HISTORY                           |   10 ++
 kde-core/kdelibs/PRE_BUILD                         |    3 
 kde-core/kdelibs/cups.diff                         |   82 +++++++++++++++++++++
 kde-core/kdelibs/post-3.5.7-kdelibs-kdecore.diff   |   61 +++++++++++++++
 9 files changed, 212 insertions(+), 5 deletions(-)

New commits:
commit f02db1978864b25bce5c1dce8b8da904fecdfb13
Author: Treeve Jelbert <treeve at sourcemage.org>
Commit: Treeve Jelbert <treeve at sourcemage.org>

    kdebase - security fix 13950

commit 5583953903b28ebb71a239211e8181e18aaf01d3
Author: Treeve Jelbert <treeve at sourcemage.org>
Commit: Treeve Jelbert <treeve at sourcemage.org>

    kdelibs - security fix 13950

diff --git a/kde-core/kdebase/DETAILS b/kde-core/kdebase/DETAILS
index 0620370..dc439fc 100755
--- a/kde-core/kdebase/DETAILS
+++ b/kde-core/kdebase/DETAILS
@@ -13,7 +13,7 @@ if [[ $SMGL_THEME == "y" ]]; then
 fi
         WEB_SITE=http://www.kde.org
          ENTERED=20010912
-  SECURITY_PATCH=1
+  SECURITY_PATCH=2
       LICENSE[0]=GPL
         KEYWORDS="kde"
            SHORT="Base applications that form the core of KDE."
diff --git a/kde-core/kdebase/HISTORY b/kde-core/kdebase/HISTORY
index c91ef4c..4c4e521 100644
--- a/kde-core/kdebase/HISTORY
+++ b/kde-core/kdebase/HISTORY
@@ -1,3 +1,8 @@
+2007-08-22 Treeve Jelbert <treeve at sourcemage.org>
+	* DETAILS: SECURTIY_PATCH++
+	* post-3.5.7-kdebase-konqueror.diff: added
+	* PRE_BUILD: apply security patch
+
 2007-05-22 Jaka Kranjc <lynxlynxlynx at sourcemage.org>
 	* DETAILS: updated spell to 3.5.7
 
diff --git a/kde-core/kdebase/PRE_BUILD b/kde-core/kdebase/PRE_BUILD
index 07fb1e0..10c9438 100755
--- a/kde-core/kdebase/PRE_BUILD
+++ b/kde-core/kdebase/PRE_BUILD
@@ -1,7 +1,6 @@
 default_pre_build          &&
 cd $SOURCE_DIRECTORY 	   &&
-# dbus patch
-#patch  -p0 < $SPELL_DIRECTORY/dbus.patch  &&
+patch  -p0 < $SPELL_DIRECTORY/post-3.5.7-kdebase-konqueror.diff  &&
 # splashscreen patch
 if [[ $SMGL_THEME == "y" ]]; then
   unpack_file 2
diff --git a/kde-core/kdebase/post-3.5.7-kdebase-konqueror.diff b/kde-core/kdebase/post-3.5.7-kdebase-konqueror.diff
new file mode 100644
index 0000000..0d6e44e
--- /dev/null
+++ b/kde-core/kdebase/post-3.5.7-kdebase-konqueror.diff
@@ -0,0 +1,49 @@
+--- konqueror/konq_combo.cc
++++ konqueror/konq_combo.cc
+@@ -158,6 +158,9 @@ void KonqCombo::setURL( const QString& u
+         kapp->dcopClient()->send( "konqueror*", "KonquerorIface",
+                                   "addToCombo(QString,QCString)", data);
+     }
++    // important security consideration: always display the beginning
++    // of the url rather than its end to prevent spoofing attempts.
++    lineEdit()->setCursorPosition( 0 );
+ }
+ 
+ void KonqCombo::setTemporary( const QString& text )
+--- konqueror/konq_mainwindow.cc
++++ konqueror/konq_mainwindow.cc
+@@ -611,12 +611,11 @@ void KonqMainWindow::openURL( KonqView *
+   }
+   else // no known serviceType, use KonqRun
+   {
+-      if ( ( view && view == m_currentView ) ||
+-              ( !view && !req.newTab ) ) // startup with argument
++      if ( ( !view || view->url().isEmpty() ) && !req.newTab ) // startup with argument
+       {
+           // Show it for now in the location bar, but we'll need to store it in the view
+           // later on (can't do it yet since either view == 0 or updateHistoryEntry will be called).
+-          kdDebug(1202) << "setLocationBarURL : url = " << url << endl;
++          kdDebug(1202) << "setLocationBarURL (startup) : url = " << url << endl;
+           setLocationBarURL( url );
+       }
+ 
+@@ -819,8 +818,6 @@ bool KonqMainWindow::openView( QString s
+         if ( childView )
+         {
+             enableAllActions( true );
+-
+-            m_pViewManager->setActivePart( childView->part() );
+             m_currentView = childView;
+         }
+       }
+--- konqueror/konq_viewmgr.cc
++++ konqueror/konq_viewmgr.cc
+@@ -1395,6 +1395,8 @@ void KonqViewManager::slotActivePartChan
+ 
+ void KonqViewManager::emitActivePartChanged()
+ {
++    // prevent unnecessary multiple calls to slotPartActivated:
++    m_activePartChangedTimer->stop();
+     m_pMainWindow->slotPartActivated( activePart() );
+ }
+ 
diff --git a/kde-core/kdelibs/DETAILS b/kde-core/kdelibs/DETAILS
index 0cd5a79..c067ee7 100755
--- a/kde-core/kdelibs/DETAILS
+++ b/kde-core/kdelibs/DETAILS
@@ -8,7 +8,7 @@ SOURCE_DIRECTORY=$BUILD_DIRECTORY/$SPELL-$VERSION
    SOURCE_URL[0]=$KDE_URL/stable/${VERSION//.0/}/src/$SOURCE
         WEB_SITE=http://www.kde.org
          ENTERED=20020912
-  SECURITY_PATCH=3
+  SECURITY_PATCH=4
       LICENSE[0]=GPL
         KEYWORDS="kde"
            SHORT="Base applications that form the core of KDE."
diff --git a/kde-core/kdelibs/HISTORY b/kde-core/kdelibs/HISTORY
index 1ba99a6..8d37f74 100644
--- a/kde-core/kdelibs/HISTORY
+++ b/kde-core/kdelibs/HISTORY
@@ -1,3 +1,13 @@
+2007-08-21 Treeve Jelbert <treeve at sourcemage.org>
+	* DETAILS: SECURITY_PATCH++
+	* post-3.5.7-kdelibs-kdecore.diff: added
+	  cups.diff: added
+	  fix compilation with cups-1.3 (upstream patch) kde bug #148121
+	* PRE_BUILD: apply patches
+	  security fix CVE-2007-4224, CVE-2007-4225, CVE-2007-3820
+	  URL: http://www.kde.org/info/security/advisory-20070816-1.txt
+	  fixes bug #13950
+
 2007-05-22 Jaka Kranjc <lynxlynxlynx at sourcemage.org>
 	* DETAILS: updated spell to 3.5.7
 
diff --git a/kde-core/kdelibs/PRE_BUILD b/kde-core/kdelibs/PRE_BUILD
index 539ca82..0c1ab77 100755
--- a/kde-core/kdelibs/PRE_BUILD
+++ b/kde-core/kdelibs/PRE_BUILD
@@ -1,3 +1,4 @@
 default_pre_build      &&
 cd $SOURCE_DIRECTORY   &&
-true
+patch -p0 < $SPELL_DIRECTORY/post-3.5.7-kdelibs-kdecore.diff  &&
+patch -p1 < $SPELL_DIRECTORY/cups.diff
diff --git a/kde-core/kdelibs/cups.diff b/kde-core/kdelibs/cups.diff
new file mode 100644
index 0000000..124d799
--- /dev/null
+++ b/kde-core/kdelibs/cups.diff
@@ -0,0 +1,82 @@
+--- kdelibs-3.5.7/kdeprint/cups/cupsdconf2/cups-util.c.cups13	2006-10-01 12:33:43.000000000 -0500
++++ kdelibs-3.5.7/kdeprint/cups/cupsdconf2/cups-util.c	2007-07-19 15:12:48.000000000 -0500
+@@ -108,7 +108,8 @@ cupsGetConf(void)
+       * See if we should retry the current digest password...
+       */
+ 
+-      if (strncmp(cups_server->fields[HTTP_FIELD_WWW_AUTHENTICATE], "Basic", 5) == 0 ||
++      if (strncmp(httpGetField (cups_server, HTTP_FIELD_WWW_AUTHENTICATE),
++		  "Basic", 5) == 0 ||
+           digest_tries > 1 || !pwdstring[0])
+       {
+        /*
+@@ -116,7 +117,7 @@ cupsGetConf(void)
+ 	*/
+ 
+ 	snprintf(prompt, sizeof(prompt), "Password for %s on %s? ", cupsUser(),
+-        	 cups_server->hostname);
++        	 cupsServer());
+ 
+         if ((password = cupsGetPassword(prompt)) == NULL)
+ 	  break;
+@@ -135,7 +136,8 @@ cupsGetConf(void)
+       * Got a password; encode it for the server...
+       */
+ 
+-      if (strncmp(cups_server->fields[HTTP_FIELD_WWW_AUTHENTICATE], "Basic", 5) == 0)
++      if (strncmp(httpGetField (cups_server, HTTP_FIELD_WWW_AUTHENTICATE),
++		  "Basic", 5) == 0)
+       {
+        /*
+ 	* Basic authentication...
+@@ -334,7 +336,8 @@ cupsPutConf(const char *name)		/* I - Na
+       * See if we should retry the current digest password...
+       */
+ 
+-      if (strncmp(cups_server->fields[HTTP_FIELD_WWW_AUTHENTICATE], "Basic", 5) == 0 ||
++      if (strncmp(httpGetField (cups_server, HTTP_FIELD_WWW_AUTHENTICATE),
++		  "Basic", 5) == 0 ||
+           digest_tries > 1 || !pwdstring[0])
+       {
+        /*
+@@ -342,7 +345,7 @@ cupsPutConf(const char *name)		/* I - Na
+ 	*/
+ 
+ 	snprintf(prompt, sizeof(prompt), "Password for %s on %s? ", cupsUser(),
+-        	 cups_server->hostname);
++        	 cupsServer());
+ 
+         if ((password = cupsGetPassword(prompt)) == NULL)
+ 	  break;
+@@ -361,7 +364,8 @@ cupsPutConf(const char *name)		/* I - Na
+       * Got a password; encode it for the server...
+       */
+ 
+-      if (strncmp(cups_server->fields[HTTP_FIELD_WWW_AUTHENTICATE], "Basic", 5) == 0)
++      if (strncmp(httpGetField (cups_server, HTTP_FIELD_WWW_AUTHENTICATE),
++		  "Basic", 5) == 0)
+       {
+        /*
+ 	* Basic authentication...
+--- kdelibs-3.5.7/kdeprint/cups/ipprequest.cpp.cups13	2007-01-15 05:34:19.000000000 -0600
++++ kdelibs-3.5.7/kdeprint/cups/ipprequest.cpp	2007-07-19 15:15:09.000000000 -0500
+@@ -309,7 +309,8 @@ bool IppRequest::doFileRequest(const QSt
+ 		return false;
+ 	}
+ 
+-#ifdef HAVE_CUPS_NO_PWD_CACHE
++#if defined(HAVE_CUPS_NO_PWD_CACHE) && \
++    CUPS_VERSION_MAJOR == 1 && CUPS_VERSION_MINOR < 3
+ 	strncpy( HTTP->authstring, cups_authstring.data(), HTTP_MAX_VALUE );
+ #endif
+ 
+@@ -319,7 +320,8 @@ bool IppRequest::doFileRequest(const QSt
+ 	}
+ 
+ 	request_ = cupsDoFileRequest(HTTP, request_, (res.isEmpty() ? "/" : res.latin1()), (filename.isEmpty() ? NULL : filename.latin1()));
+-#ifdef HAVE_CUPS_NO_PWD_CACHE
++#if defined(HAVE_CUPS_NO_PWD_CACHE) && \
++    CUPS_VERSION_MAJOR == 1 && CUPS_VERSION_MINOR < 3
+ 	cups_authstring = HTTP->authstring;
+ #endif
+ 	httpClose(HTTP);
diff --git a/kde-core/kdelibs/post-3.5.7-kdelibs-kdecore.diff b/kde-core/kdelibs/post-3.5.7-kdelibs-kdecore.diff
new file mode 100644
index 0000000..eb7e89e
--- /dev/null
+++ b/kde-core/kdelibs/post-3.5.7-kdelibs-kdecore.diff
@@ -0,0 +1,61 @@
+------------------------------------------------------------------------
+r700053 | mueller | 2007-08-14 18:37:30 +0200 (Tue, 14 Aug 2007) | 2 lines
+
+be more robust against addressbar spoofing (CVE-2007-4225)
+
+------------------------------------------------------------------------
+--- kdecore/tests/kurltest.cpp
++++ kdecore/tests/kurltest.cpp
+@@ -288,6 +288,16 @@ int main(int argc, char *argv[])
+   check("KURL::prettyURL()", url15582.prettyURL(), "http://alain.knaff.linux.lu/bug-reports/kde/percentage%in%url.html");
+   check("KURL::url()", url15582.url(), "http://alain.knaff.linux.lu/bug-reports/kde/percentage%25in%25url.html");
+ 
++  KURL whitespaceInUser("http://www.google.com%20%20%20%20%20@foobar.com/");
++  check("KURL::prettyURL()", whitespaceInUser.prettyURL(), "http://www.google.com%20%20%20%20%20@foobar.com/");
++
++  KURL whitespaceInPath("http://www.google.com/foo%20bar/");
++  check("KURL::prettyURL()", whitespaceInPath.prettyURL(), "http://www.google.com/foo bar/");
++
++   KURL whitespaceInPath2("http://www.google.com/foo%20%20%20%20%20%20%20bar/");
++  check("KURL::prettyURL()", whitespaceInPath2.prettyURL(),
++          "http://www.google.com/foo%20%20%20%20%20%20 bar/");
++
+   KURL carsten;
+   carsten.setPath("/home/gis/src/kde/kdelibs/kfile/.#kfiledetailview.cpp.1.18");
+   check("KURL::path()", carsten.path(), "/home/gis/src/kde/kdelibs/kfile/.#kfiledetailview.cpp.1.18");
+@@ -594,6 +604,15 @@ int main(int argc, char *argv[])
+   check("http: URL with empty path string path", waba1.path(),
+         "");
+ 
++  waba1 = "http://www.meinestadt.de&url_plain=http";
++  check("http: URL with empty path string", waba1.host(),
++         "www.meinestadt.de&url_plain=http");
++  check("http: URL with empty path string", waba1.htmlURL(),
++         "http://www.meinestadt.de&amp;url_plain=http");
++ 
++  check("http: URL with empty path string", waba1.path(),
++         "");
++
+   waba1 = "http://a:389#b=c";
+   check( "http: URL with port, ref, and empty path; url", waba1.url(), "http://a:389#b=c" );
+   check( "http: URL with port, ref, and empty path; host", waba1.host(), "a" );
+--- kdecore/kurl.cpp
++++ kdecore/kurl.cpp
+@@ -183,7 +183,7 @@ static QString lazy_encode( const QStrin
+         (character == '?') || // Start of query delimiter
+         ((character == '@') && encodeAt) || // Username delimiter
+         (character == '#') || // Start of reference delimiter
+-        ((character == 32) && (i+1 == old_length))) // A trailing space
++        ((character == 32) && (i+1 == old_length || segment[i+1] == ' '))) // A trailing space
+     {
+       new_segment[ new_length++ ] = '%';
+ 
+@@ -1540,7 +1540,7 @@ QString KURL::prettyURL( int _trailing )
+     u += "//";
+     if ( hasUser() )
+     {
+-      u += lazy_encode(m_strUser);
++      u += encode(m_strUser, 0, 0);
+       // Don't show password!
+       u += "@";
+     }



More information about the SM-Commit mailing list