Skip to Content.
Sympa Menu

sm-commit - [SM-Commit] GIT changes to master grimoire by Treeve Jelbert (f02db1978864b25bce5c1dce8b8da904fecdfb13)

sm-commit AT lists.ibiblio.org

Subject: Source Mage code commit list

List archive

Chronological Thread  
  • From: Treeve Jelbert <scm AT sourcemage.org>
  • To: sm-commit AT lists.ibiblio.org
  • Subject: [SM-Commit] GIT changes to master grimoire by Treeve Jelbert (f02db1978864b25bce5c1dce8b8da904fecdfb13)
  • Date: Wed, 22 Aug 2007 10:51:52 -0500

GIT changes to master grimoire by Treeve Jelbert <treeve AT sourcemage.org>:

kde-core/kdebase/DETAILS | 2
kde-core/kdebase/HISTORY | 5 +
kde-core/kdebase/PRE_BUILD | 3
kde-core/kdebase/post-3.5.7-kdebase-konqueror.diff | 49 ++++++++++++
kde-core/kdelibs/DETAILS | 2
kde-core/kdelibs/HISTORY | 10 ++
kde-core/kdelibs/PRE_BUILD | 3
kde-core/kdelibs/cups.diff | 82
+++++++++++++++++++++
kde-core/kdelibs/post-3.5.7-kdelibs-kdecore.diff | 61 +++++++++++++++
9 files changed, 212 insertions(+), 5 deletions(-)

New commits:
commit f02db1978864b25bce5c1dce8b8da904fecdfb13
Author: Treeve Jelbert <treeve AT sourcemage.org>
Commit: Treeve Jelbert <treeve AT sourcemage.org>

kdebase - security fix 13950

commit 5583953903b28ebb71a239211e8181e18aaf01d3
Author: Treeve Jelbert <treeve AT sourcemage.org>
Commit: Treeve Jelbert <treeve AT sourcemage.org>

kdelibs - security fix 13950

diff --git a/kde-core/kdebase/DETAILS b/kde-core/kdebase/DETAILS
index 0620370..dc439fc 100755
--- a/kde-core/kdebase/DETAILS
+++ b/kde-core/kdebase/DETAILS
@@ -13,7 +13,7 @@ if [[ $SMGL_THEME == "y" ]]; then
fi
WEB_SITE=http://www.kde.org
ENTERED=20010912
- SECURITY_PATCH=1
+ SECURITY_PATCH=2
LICENSE[0]=GPL
KEYWORDS="kde"
SHORT="Base applications that form the core of KDE."
diff --git a/kde-core/kdebase/HISTORY b/kde-core/kdebase/HISTORY
index c91ef4c..4c4e521 100644
--- a/kde-core/kdebase/HISTORY
+++ b/kde-core/kdebase/HISTORY
@@ -1,3 +1,8 @@
+2007-08-22 Treeve Jelbert <treeve AT sourcemage.org>
+ * DETAILS: SECURTIY_PATCH++
+ * post-3.5.7-kdebase-konqueror.diff: added
+ * PRE_BUILD: apply security patch
+
2007-05-22 Jaka Kranjc <lynxlynxlynx AT sourcemage.org>
* DETAILS: updated spell to 3.5.7

diff --git a/kde-core/kdebase/PRE_BUILD b/kde-core/kdebase/PRE_BUILD
index 07fb1e0..10c9438 100755
--- a/kde-core/kdebase/PRE_BUILD
+++ b/kde-core/kdebase/PRE_BUILD
@@ -1,7 +1,6 @@
default_pre_build &&
cd $SOURCE_DIRECTORY &&
-# dbus patch
-#patch -p0 < $SPELL_DIRECTORY/dbus.patch &&
+patch -p0 < $SPELL_DIRECTORY/post-3.5.7-kdebase-konqueror.diff &&
# splashscreen patch
if [[ $SMGL_THEME == "y" ]]; then
unpack_file 2
diff --git a/kde-core/kdebase/post-3.5.7-kdebase-konqueror.diff
b/kde-core/kdebase/post-3.5.7-kdebase-konqueror.diff
new file mode 100644
index 0000000..0d6e44e
--- /dev/null
+++ b/kde-core/kdebase/post-3.5.7-kdebase-konqueror.diff
@@ -0,0 +1,49 @@
+--- konqueror/konq_combo.cc
++++ konqueror/konq_combo.cc
+@@ -158,6 +158,9 @@ void KonqCombo::setURL( const QString& u
+ kapp->dcopClient()->send( "konqueror*", "KonquerorIface",
+ "addToCombo(QString,QCString)", data);
+ }
++ // important security consideration: always display the beginning
++ // of the url rather than its end to prevent spoofing attempts.
++ lineEdit()->setCursorPosition( 0 );
+ }
+
+ void KonqCombo::setTemporary( const QString& text )
+--- konqueror/konq_mainwindow.cc
++++ konqueror/konq_mainwindow.cc
+@@ -611,12 +611,11 @@ void KonqMainWindow::openURL( KonqView *
+ }
+ else // no known serviceType, use KonqRun
+ {
+- if ( ( view && view == m_currentView ) ||
+- ( !view && !req.newTab ) ) // startup with argument
++ if ( ( !view || view->url().isEmpty() ) && !req.newTab ) // startup
with argument
+ {
+ // Show it for now in the location bar, but we'll need to store
it in the view
+ // later on (can't do it yet since either view == 0 or
updateHistoryEntry will be called).
+- kdDebug(1202) << "setLocationBarURL : url = " << url << endl;
++ kdDebug(1202) << "setLocationBarURL (startup) : url = " << url <<
endl;
+ setLocationBarURL( url );
+ }
+
+@@ -819,8 +818,6 @@ bool KonqMainWindow::openView( QString s
+ if ( childView )
+ {
+ enableAllActions( true );
+-
+- m_pViewManager->setActivePart( childView->part() );
+ m_currentView = childView;
+ }
+ }
+--- konqueror/konq_viewmgr.cc
++++ konqueror/konq_viewmgr.cc
+@@ -1395,6 +1395,8 @@ void KonqViewManager::slotActivePartChan
+
+ void KonqViewManager::emitActivePartChanged()
+ {
++ // prevent unnecessary multiple calls to slotPartActivated:
++ m_activePartChangedTimer->stop();
+ m_pMainWindow->slotPartActivated( activePart() );
+ }
+
diff --git a/kde-core/kdelibs/DETAILS b/kde-core/kdelibs/DETAILS
index 0cd5a79..c067ee7 100755
--- a/kde-core/kdelibs/DETAILS
+++ b/kde-core/kdelibs/DETAILS
@@ -8,7 +8,7 @@ SOURCE_DIRECTORY=$BUILD_DIRECTORY/$SPELL-$VERSION
SOURCE_URL[0]=$KDE_URL/stable/${VERSION//.0/}/src/$SOURCE
WEB_SITE=http://www.kde.org
ENTERED=20020912
- SECURITY_PATCH=3
+ SECURITY_PATCH=4
LICENSE[0]=GPL
KEYWORDS="kde"
SHORT="Base applications that form the core of KDE."
diff --git a/kde-core/kdelibs/HISTORY b/kde-core/kdelibs/HISTORY
index 1ba99a6..8d37f74 100644
--- a/kde-core/kdelibs/HISTORY
+++ b/kde-core/kdelibs/HISTORY
@@ -1,3 +1,13 @@
+2007-08-21 Treeve Jelbert <treeve AT sourcemage.org>
+ * DETAILS: SECURITY_PATCH++
+ * post-3.5.7-kdelibs-kdecore.diff: added
+ cups.diff: added
+ fix compilation with cups-1.3 (upstream patch) kde bug #148121
+ * PRE_BUILD: apply patches
+ security fix CVE-2007-4224, CVE-2007-4225, CVE-2007-3820
+ URL: http://www.kde.org/info/security/advisory-20070816-1.txt
+ fixes bug #13950
+
2007-05-22 Jaka Kranjc <lynxlynxlynx AT sourcemage.org>
* DETAILS: updated spell to 3.5.7

diff --git a/kde-core/kdelibs/PRE_BUILD b/kde-core/kdelibs/PRE_BUILD
index 539ca82..0c1ab77 100755
--- a/kde-core/kdelibs/PRE_BUILD
+++ b/kde-core/kdelibs/PRE_BUILD
@@ -1,3 +1,4 @@
default_pre_build &&
cd $SOURCE_DIRECTORY &&
-true
+patch -p0 < $SPELL_DIRECTORY/post-3.5.7-kdelibs-kdecore.diff &&
+patch -p1 < $SPELL_DIRECTORY/cups.diff
diff --git a/kde-core/kdelibs/cups.diff b/kde-core/kdelibs/cups.diff
new file mode 100644
index 0000000..124d799
--- /dev/null
+++ b/kde-core/kdelibs/cups.diff
@@ -0,0 +1,82 @@
+--- kdelibs-3.5.7/kdeprint/cups/cupsdconf2/cups-util.c.cups13 2006-10-01
12:33:43.000000000 -0500
++++ kdelibs-3.5.7/kdeprint/cups/cupsdconf2/cups-util.c 2007-07-19
15:12:48.000000000 -0500
+@@ -108,7 +108,8 @@ cupsGetConf(void)
+ * See if we should retry the current digest password...
+ */
+
+- if (strncmp(cups_server->fields[HTTP_FIELD_WWW_AUTHENTICATE],
"Basic", 5) == 0 ||
++ if (strncmp(httpGetField (cups_server, HTTP_FIELD_WWW_AUTHENTICATE),
++ "Basic", 5) == 0 ||
+ digest_tries > 1 || !pwdstring[0])
+ {
+ /*
+@@ -116,7 +117,7 @@ cupsGetConf(void)
+ */
+
+ snprintf(prompt, sizeof(prompt), "Password for %s on %s? ",
cupsUser(),
+- cups_server->hostname);
++ cupsServer());
+
+ if ((password = cupsGetPassword(prompt)) == NULL)
+ break;
+@@ -135,7 +136,8 @@ cupsGetConf(void)
+ * Got a password; encode it for the server...
+ */
+
+- if (strncmp(cups_server->fields[HTTP_FIELD_WWW_AUTHENTICATE],
"Basic", 5) == 0)
++ if (strncmp(httpGetField (cups_server, HTTP_FIELD_WWW_AUTHENTICATE),
++ "Basic", 5) == 0)
+ {
+ /*
+ * Basic authentication...
+@@ -334,7 +336,8 @@ cupsPutConf(const char *name) /* I - Na
+ * See if we should retry the current digest password...
+ */
+
+- if (strncmp(cups_server->fields[HTTP_FIELD_WWW_AUTHENTICATE],
"Basic", 5) == 0 ||
++ if (strncmp(httpGetField (cups_server, HTTP_FIELD_WWW_AUTHENTICATE),
++ "Basic", 5) == 0 ||
+ digest_tries > 1 || !pwdstring[0])
+ {
+ /*
+@@ -342,7 +345,7 @@ cupsPutConf(const char *name) /* I - Na
+ */
+
+ snprintf(prompt, sizeof(prompt), "Password for %s on %s? ",
cupsUser(),
+- cups_server->hostname);
++ cupsServer());
+
+ if ((password = cupsGetPassword(prompt)) == NULL)
+ break;
+@@ -361,7 +364,8 @@ cupsPutConf(const char *name) /* I - Na
+ * Got a password; encode it for the server...
+ */
+
+- if (strncmp(cups_server->fields[HTTP_FIELD_WWW_AUTHENTICATE],
"Basic", 5) == 0)
++ if (strncmp(httpGetField (cups_server, HTTP_FIELD_WWW_AUTHENTICATE),
++ "Basic", 5) == 0)
+ {
+ /*
+ * Basic authentication...
+--- kdelibs-3.5.7/kdeprint/cups/ipprequest.cpp.cups13 2007-01-15
05:34:19.000000000 -0600
++++ kdelibs-3.5.7/kdeprint/cups/ipprequest.cpp 2007-07-19 15:15:09.000000000
-0500
+@@ -309,7 +309,8 @@ bool IppRequest::doFileRequest(const QSt
+ return false;
+ }
+
+-#ifdef HAVE_CUPS_NO_PWD_CACHE
++#if defined(HAVE_CUPS_NO_PWD_CACHE) && \
++ CUPS_VERSION_MAJOR == 1 && CUPS_VERSION_MINOR < 3
+ strncpy( HTTP->authstring, cups_authstring.data(), HTTP_MAX_VALUE );
+ #endif
+
+@@ -319,7 +320,8 @@ bool IppRequest::doFileRequest(const QSt
+ }
+
+ request_ = cupsDoFileRequest(HTTP, request_, (res.isEmpty() ? "/" :
res.latin1()), (filename.isEmpty() ? NULL : filename.latin1()));
+-#ifdef HAVE_CUPS_NO_PWD_CACHE
++#if defined(HAVE_CUPS_NO_PWD_CACHE) && \
++ CUPS_VERSION_MAJOR == 1 && CUPS_VERSION_MINOR < 3
+ cups_authstring = HTTP->authstring;
+ #endif
+ httpClose(HTTP);
diff --git a/kde-core/kdelibs/post-3.5.7-kdelibs-kdecore.diff
b/kde-core/kdelibs/post-3.5.7-kdelibs-kdecore.diff
new file mode 100644
index 0000000..eb7e89e
--- /dev/null
+++ b/kde-core/kdelibs/post-3.5.7-kdelibs-kdecore.diff
@@ -0,0 +1,61 @@
+------------------------------------------------------------------------
+r700053 | mueller | 2007-08-14 18:37:30 +0200 (Tue, 14 Aug 2007) | 2 lines
+
+be more robust against addressbar spoofing (CVE-2007-4225)
+
+------------------------------------------------------------------------
+--- kdecore/tests/kurltest.cpp
++++ kdecore/tests/kurltest.cpp
+@@ -288,6 +288,16 @@ int main(int argc, char *argv[])
+ check("KURL::prettyURL()", url15582.prettyURL(),
"http://alain.knaff.linux.lu/bug-reports/kde/percentage%in%url.html";);
+ check("KURL::url()", url15582.url(),
"http://alain.knaff.linux.lu/bug-reports/kde/percentage%25in%25url.html";);
+
++ KURL whitespaceInUser("http://www.google.com%20%20%20%20%20 AT foobar.com/";);
++ check("KURL::prettyURL()", whitespaceInUser.prettyURL(),
"http://www.google.com%20%20%20%20%20 AT foobar.com/";);
++
++ KURL whitespaceInPath("http://www.google.com/foo%20bar/";);
++ check("KURL::prettyURL()", whitespaceInPath.prettyURL(),
"http://www.google.com/foo bar/");
++
++ KURL
whitespaceInPath2("http://www.google.com/foo%20%20%20%20%20%20%20bar/";);
++ check("KURL::prettyURL()", whitespaceInPath2.prettyURL(),
++ "http://www.google.com/foo%20%20%20%20%20%20 bar/");
++
+ KURL carsten;
+
carsten.setPath("/home/gis/src/kde/kdelibs/kfile/.#kfiledetailview.cpp.1.18");
+ check("KURL::path()", carsten.path(),
"/home/gis/src/kde/kdelibs/kfile/.#kfiledetailview.cpp.1.18");
+@@ -594,6 +604,15 @@ int main(int argc, char *argv[])
+ check("http: URL with empty path string path", waba1.path(),
+ "");
+
++ waba1 = "http://www.meinestadt.de&url_plain=http";;
++ check("http: URL with empty path string", waba1.host(),
++ "www.meinestadt.de&url_plain=http");
++ check("http: URL with empty path string", waba1.htmlURL(),
++ "http://www.meinestadt.de&amp;url_plain=http";);
++
++ check("http: URL with empty path string", waba1.path(),
++ "");
++
+ waba1 = "http://a:389#b=c";;
+ check( "http: URL with port, ref, and empty path; url", waba1.url(),
"http://a:389#b=c"; );
+ check( "http: URL with port, ref, and empty path; host", waba1.host(),
"a" );
+--- kdecore/kurl.cpp
++++ kdecore/kurl.cpp
+@@ -183,7 +183,7 @@ static QString lazy_encode( const QStrin
+ (character == '?') || // Start of query delimiter
+ ((character == '@') && encodeAt) || // Username delimiter
+ (character == '#') || // Start of reference delimiter
+- ((character == 32) && (i+1 == old_length))) // A trailing space
++ ((character == 32) && (i+1 == old_length || segment[i+1] == ' ')))
// A trailing space
+ {
+ new_segment[ new_length++ ] = '%';
+
+@@ -1540,7 +1540,7 @@ QString KURL::prettyURL( int _trailing )
+ u += "//";
+ if ( hasUser() )
+ {
+- u += lazy_encode(m_strUser);
++ u += encode(m_strUser, 0, 0);
+ // Don't show password!
+ u += "@";
+ }



  • [SM-Commit] GIT changes to master grimoire by Treeve Jelbert (f02db1978864b25bce5c1dce8b8da904fecdfb13), Treeve Jelbert, 08/22/2007

Archive powered by MHonArc 2.6.24.

Top of Page