- Update to 2.0.8a

PR:		ports/64939
Submitted by:	Kang Liu <liukang@bjpu.edu.cn> (maintainer)
This commit is contained in:
Pav Lucistnik 2004-03-30 21:33:26 +00:00
parent a8ade8504e
commit cd168f5792
Notes: svn2git 2021-03-31 03:12:20 +00:00
svn path=/head/; revision=105732
3 changed files with 4 additions and 26 deletions

View file

@ -7,11 +7,11 @@
PORTNAME= phpbb
PORTVERSION= 2.0.8
PORTREVISION= 1
PORTREVISION= 2
CATEGORIES= www
MASTER_SITES= ${MASTER_SITE_SOURCEFORGE}
MASTER_SITE_SUBDIR= ${PORTNAME}
DISTNAME= phpBB-${PORTVERSION}
DISTNAME= phpBB-${PORTVERSION}a
MAINTAINER= liukang@bjpu.edu.cn
COMMENT= A PHP-based bulletin board / discussion forum system
@ -61,7 +61,6 @@ pre-everything::
post-patch:
@ ${REINPLACE_CMD} -e "s#\.\./templates#/${PHPBBURL}/templates#" \
${WRKSRC}/docs/*.html
@ ${RM} ${WRKSRC}/*.orig
post-configure:
@ ${SED} \

View file

@ -1,2 +1,2 @@
MD5 (phpBB-2.0.8.tar.bz2) = 20d9e163e3f3b575639c2a1fbd9e8690
SIZE (phpBB-2.0.8.tar.bz2) = 456585
MD5 (phpBB-2.0.8a.tar.bz2) = 44d33a5851800f8f278d3c100fb2fcb3
SIZE (phpBB-2.0.8a.tar.bz2) = 457308

View file

@ -1,21 +0,0 @@
--- privmsg.php 2004-03-18 19:51:32.000000000 +0000
+++ privmsg.1.php 2004-03-26 19:51:07.000000000 +0000
@@ -212,7 +212,17 @@
break;
case 'savebox':
$l_box_name = $lang['Savebox'];
- $pm_sql_user .= "AND ( ( pm.privmsgs_to_userid = " . $userdata['user_id'] . "
+
+ //
+ // For some obscure reason, the assignment
+ // concatenation operator was coded below, which
+ // allowed an attacker to append arbitrary SQL code
+ // to the end of the $pm_sql_user variable.
+ // This is fixed below.
+ //
+ // -shaun2k2
+ //
+ $pm_sql_user = "AND ( ( pm.privmsgs_to_userid = " . $userdata['user_id'] . "
AND pm.privmsgs_type = " . PRIVMSGS_SAVED_IN_MAIL . " )
OR ( pm.privmsgs_from_userid = " . $userdata['user_id'] . "
AND pm.privmsgs_type = " . PRIVMSGS_SAVED_OUT_MAIL . " )