Request 1790 (accepted)

We truncated the diff of some files because they were too big. If you want to see the full diff for every file, click here.

Overview

Request 1790 (accepted)

update to roundcube 1.2.2

Created by tpokorra over 7 years ago
In state accepted
Open review for Admin

Submit roundcubemail

Submit package home:tpokorr...hes:Kolab:16 / roundcubemail to package Kolab:16 / roundcubemail

roundcubemail.spec Changed

@@ -41,9 +41,9 @@
 %global tmpdir /var/lib/roundcubemail
 
 Name:           roundcubemail
-Version: 1.2
+Version:        1.2.2
 
-Release: 0.20160119.git1%{?dist}
+Release:        1%{?dist}
 
 Summary:        Round Cube Webmail is a browser-based multilingual IMAP client
 
@@ -51,8 +51,7 @@
 License:        GPLv2
 URL:            http://www.roundcube.net
 
-# From df10bd5f2c98831bc20fae9c579967109345fdab
-Source0:        roundcubemail-1.2.tar.gz
+Source0:        roundcubemail-1.2.2.tar.gz
 Source1:        comm.py
 
 Source20:       roundcubemail.conf
@@ -61,8 +60,6 @@
 Patch201:       ticket-466-changes.patch
 Patch202:       default-configuration.patch
 
-Patch203:       CVE-2016-5103.patch
-
 BuildArch:      noarch
 BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root%(%{__id_u} -n)
 
@@ -1292,7 +1289,6 @@
 
 %patch201 -p1
 %patch202 -p1
-%patch203 -p1
 
 # Remove the results of patching when there's an incidental offset
 find . -type f -name "*.orig" -delete
@@ -3119,6 +3115,9 @@
 %defattr(-,root,root,-)
 
 %changelog
+* Thu Sep 29 2016 Timotheus Pokorra <tp@tbits.net> - 1.2.2-1
+- upgrade to upstream Roundcube 1.2.2 release
+
 * Fri May 27 2016 Timotheus Pokorra <tp@tbits.net>
 - apply security patch for XSS vulnerability CVE-2016-5103

CVE-2016-5103.patch Deleted

@@ -1,64 +0,0 @@
-From 12b7d5f1b5a8be70a34844685993843456db5f46 Mon Sep 17 00:00:00 2001
-From: Aleksander Machniak <alec@alec.pl>
-Date: Fri, 6 May 2016 08:28:15 +0200
-Subject: [PATCH] Fix XSS issue in href attribute on area tag (#5240, #5241)
-
----
- CHANGELOG                               |  1 +
- program/lib/Roundcube/rcube_washtml.php |  2 +-
- tests/Framework/Washtml.php             | 17 +++++++++++++++++
- 3 files changed, 19 insertions(+), 1 deletion(-)
-
-diff --git a/CHANGELOG b/CHANGELOG
-index 71ac25a..0e41baf 100644
---- a/CHANGELOG
-+++ b/CHANGELOG
-@@ -14,6 +14,7 @@
- - Fix PHP7 warning "session_start(): Session callback expects true/false return value" (#1490624)
- - Fix XSS issue in SVG images handling (#1490625)
- - Fix missing language name in "Add to Dictionary" request in HTML mode (#1490634)
-+- Fix XSS issue in href attribute on area tag (#5240)
- 
- RELEASE 1.2-beta
- ----------------
-diff --git a/program/lib/Roundcube/rcube_washtml.php b/program/lib/Roundcube/rcube_washtml.php
-index 5938d9b..d03f04a 100644
---- a/program/lib/Roundcube/rcube_washtml.php
-+++ b/program/lib/Roundcube/rcube_washtml.php
-@@ -370,7 +370,7 @@ private function wash_uri($uri, $blocked_source = false)
-      */
-     private function is_link_attribute($tag, $attr)
-     {
--        return $tag == 'a' && $attr == 'href';
-+        return ($tag == 'a' || $tag == 'area') && $attr == 'href';
-     }
- 
-     /**
-diff --git a/tests/Framework/Washtml.php b/tests/Framework/Washtml.php
-index 9515f0d..2e68179 100644
---- a/tests/Framework/Washtml.php
-+++ b/tests/Framework/Washtml.php
-@@ -38,6 +38,23 @@ function test_href()
-     }
- 
-     /**
-+     * Test XSS in area's href (#5240)
-+     */
-+    function test_href_area()
-+    {
-+        $html = '<p><area href="data:text/html,&lt;script&gt;alert(document.cookie)&lt;/script&gt;">'
-+            . '<area href="vbscript:alert(document.cookie)">Internet Explorer</p>'
-+            . '<area href="javascript:alert(document.domain)" shape=default>';
-+
-+        $washer = new rcube_washtml;
-+        $washed = $washer->wash($html);
-+
-+        $this->assertNotRegExp('/data:text/', $washed, "data:text/html in area href");
-+        $this->assertNotRegExp('/vbscript:/', $washed, "vbscript: in area href");
-+        $this->assertNotRegExp('/javascript:/', $washed, "javascript: in area href");
-+    }
-+
-+    /**
-      * Test handling HTML comments
-      */
-     function test_comments()