diff options
| author | Thierry Thomas <thierry@FreeBSD.org> | 2022-10-14 08:35:37 +0000 |
|---|---|---|
| committer | Thierry Thomas <thierry@FreeBSD.org> | 2022-10-28 17:12:27 +0000 |
| commit | dfa4c773430c9297b3f54d3b1a1202e18e7f120d (patch) | |
| tree | 45fdd3f6677a19137f185181f8df251229cdd25b | |
| parent | 7918932f87a0c508fe3cdd7774482de08e23d168 (diff) | |
mail/horde-imp: address ZDI-20-1051 / ZDI-CAN-10436
PR: 267049
Approved by: maintainer’s time-out
Obtained from: https://github.com/horde/imp/pull/10/files
Fixes: Address ZDI-20-1051 / ZDI-CAN-10436
MFH: 2022Q4
Security: https://www.zerodayinitiative.com/advisories/ZDI-20-1051/
| -rw-r--r-- | mail/horde-imp/Makefile | 1 | ||||
| -rw-r--r-- | mail/horde-imp/files/patch-config_prefs.php | 6 | ||||
| -rw-r--r-- | mail/horde-imp/files/patch-lib_Prefs_Sort.php | 19 |
3 files changed, 23 insertions, 3 deletions
diff --git a/mail/horde-imp/Makefile b/mail/horde-imp/Makefile index f2cd26c90976..897a035c0b65 100644 --- a/mail/horde-imp/Makefile +++ b/mail/horde-imp/Makefile @@ -1,5 +1,6 @@ PORTNAME= imp PORTVERSION= 6.2.27 +PORTREVISION= 1 CATEGORIES= mail www pear PKGNAMEPREFIX= ${PHP_PKGNAMEPREFIX}horde- diff --git a/mail/horde-imp/files/patch-config_prefs.php b/mail/horde-imp/files/patch-config_prefs.php index de8a319f1870..e355424286ca 100644 --- a/mail/horde-imp/files/patch-config_prefs.php +++ b/mail/horde-imp/files/patch-config_prefs.php @@ -1,6 +1,6 @@ ---- config/prefs.php.orig 2011-05-03 06:27:23.000000000 -0800 -+++ config/prefs.php 2011-05-07 10:06:10.000000000 -0800 -@@ -1200,7 +1200,7 @@ +--- config/prefs.php.orig 2020-08-27 19:34:20 UTC ++++ config/prefs.php +@@ -930,7 +930,7 @@ $_prefs['sourceselect'] = array( // You can provide default values this way: // 'value' => json_encode(array('source_one', 'source_two')) $_prefs['search_sources'] = array( diff --git a/mail/horde-imp/files/patch-lib_Prefs_Sort.php b/mail/horde-imp/files/patch-lib_Prefs_Sort.php new file mode 100644 index 000000000000..c9ffce90eab1 --- /dev/null +++ b/mail/horde-imp/files/patch-lib_Prefs_Sort.php @@ -0,0 +1,19 @@ +--- lib/Prefs/Sort.php.orig 2020-08-27 19:34:20 UTC ++++ lib/Prefs/Sort.php +@@ -39,9 +39,13 @@ class IMP_Prefs_Sort implements ArrayAccess, IteratorA + { + global $prefs; + +- $sortpref = @unserialize($prefs->getValue(self::SORTPREF)); +- if (is_array($sortpref)) { +- $this->_sortpref = $sortpref; ++ $serializedPref = $prefs->getValue(self::SORTPREF); ++ // Only unserialize non-empty strings. Disallow yielding any classes. ++ if (!empty($serializedPref && is_string($serializedPref))) { ++ $sortpref = @unserialize($serializedPref, ['allowed_classes' => false]); ++ if (is_array($sortpref)) { ++ $this->_sortpref = $sortpref; ++ } + } + } + |