CVE-2011-3201

.gitignore

@@ -1 +1,19 @@
-/evolution-*.tar.xz
+evolution-2.31.5.tar.bz2
+/evolution-2.31.91.tar.bz2
+/evolution-2.31.92.tar.bz2
+/evolution-2.91.0.tar.bz2
+/evolution-2.91.1.tar.bz2
+/evolution-2.91.2.tar.bz2
+/evolution-2.91.3.tar.bz2
+/evolution-2.91.4.tar.bz2
+/evolution-2.91.5.tar.bz2
+/evolution-2.91.6.tar.bz2
+/evolution-2.91.6.1.tar.bz2
+/evolution-2.91.6.2.tar.bz2
+/evolution-2.91.90.tar.bz2
+/evolution-2.91.91.tar.bz2
+/evolution-2.91.92.tar.bz2
+/evolution-3.0.0.tar.bz2
+/evolution-3.0.1.tar.bz2
+/evolution-3.0.2.tar.bz2
+/evolution-3.0.3.tar.bz2

configurable-dbus-prefix.patch

@@ -1,42 +0,0 @@
-diff -up evolution-3.48.1 evolution-3.48
-diff -up evolution-3.48.1/docs/evolution.1 evolution-3.48.1/docs/evolution
-diff -up evolution-3.48.1/src/modules/backup-restore/evolution-backup-tool.c.1 evolution-3.48.1/src/modules/backup-restore/evolution-backup-tool.c
---- evolution-3.48.1/src/modules/backup-restore/evolution-backup-tool.c.1	2023-11-27 13:12:25.099463743 -0500
-+++ evolution-3.48.1/src/modules/backup-restore/evolution-backup-tool.c	2023-11-27 13:14:38.640243434 -0500
-@@ -674,7 +674,7 @@ get_source_manager_reload_command (void)
- 			g_string_free (tmp, TRUE);
- 			tmp = NULL;
- 
--			base_filename = g_strdup (EDS_SOURCES_DBUS_SERVICE_NAME);
-+			base_filename = g_ascii_strdown (EDS_SOURCES_DBUS_SERVICE_NAME, -1);
- 
- 			if (!base_filename || !*base_filename) {
- 				g_free (base_filename);
-@@ -690,14 +690,16 @@ get_source_manager_reload_command (void)
- 
- 			while (!tmp) {
- 				const gchar *name;
-+				gchar *name_down;
- 
- 				name = g_dir_read_name (dir);
-+				name_down = g_ascii_strdown (name, -1);
- 
- 				if (!name)
- 					break;
- 
--				if (g_ascii_strncasecmp (name, base_filename, base_filename_len) == 0 &&
--				    g_ascii_strncasecmp (name + strlen (name) - 8, ".service", 8) == 0) {
-+				if (strstr (name_down, base_filename) != NULL &&
-+				    strncmp (name_down + strlen (name) - 8, ".service", 8) == 0) {
- 					gchar *filename;
- 
- 					filename = g_strconcat ("$DBUSDATADIR", G_DIR_SEPARATOR_S, name, NULL);
-@@ -724,6 +726,8 @@ get_source_manager_reload_command (void)
- 						g_free (str);
- 					}
- 				}
-+
-+				g_free (name_down);
- 			}
- 
- 			g_free (base_filename);

evolution-1.4.4-ldap-x86_64-hack.patch

@@ -0,0 +1,21 @@
+diff -up evolution-2.31.1/configure.ldaphack evolution-2.31.1/configure
+--- evolution-2.31.1/configure.ldaphack	2010-05-03 12:43:34.000000000 +0200
++++ evolution-2.31.1/configure	2010-05-03 19:22:55.000000000 +0200
+@@ -15797,7 +15797,7 @@ if test "${ac_cv_lib_ldap_ldap_open+set}
+   $as_echo_n "(cached) " >&6
+ else
+   ac_check_lib_save_LIBS=$LIBS
+-LIBS="-lldap $LDAP_LDFLAGS $LDAP_LIBS $LIBS"
++LIBS="-lldap -lresolv $LDAP_LDFLAGS $LDAP_LIBS $LIBS"
+ cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ /* end confdefs.h.  */
+ 
+@@ -16129,7 +16129,7 @@ if test "${ac_cv_lib_ldap_ldap_open+set}
+   $as_echo_n "(cached) " >&6
+ else
+   ac_check_lib_save_LIBS=$LIBS
+-LIBS="-lldap $LDAP_LDFLAGS $LDAP_LIBS $LIBS"
++LIBS="-lldap -lresolv $LDAP_LDFLAGS $LDAP_LIBS $LIBS"
+ cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ /* end confdefs.h.  */
+ 

evolution-2.30.1-help-contents.patch

@@ -0,0 +1,18 @@
+diff -up evolution-2.30.1.2/shell/e-shell-window-actions.c.help-contents evolution-2.30.1.2/shell/e-shell-window-actions.c
+--- evolution-2.30.1.2/shell/e-shell-window-actions.c.help-contents	2010-04-26 09:13:18.000000000 -0400
++++ evolution-2.30.1.2/shell/e-shell-window-actions.c	2010-05-07 21:29:06.269059830 -0400
+@@ -2001,6 +2001,14 @@ e_shell_window_actions_init (EShellWindo
+ 	if (path == NULL)
+ 		gtk_action_set_visible (ACTION (SUBMIT_BUG), FALSE);
+ 	g_free (path);
++
++	/* Viewing user documentation requires the evolution-help
++	 * Fedora package.  Look for one of the files it installs. */
++	path = g_build_filename (
++		EVOLUTION_DATADIR, "omf", PACKAGE, "evolution-C.omf", NULL);
++	if (!g_file_test (path, G_FILE_TEST_IS_REGULAR))
++		gtk_action_set_visible (ACTION (CONTENTS), FALSE);
++	g_free (path);
+ }
+ 
+ static GList *

evolution-3.0.3-CVE-2011-3201.patch

@@ -0,0 +1,56 @@
+diff -up evolution-3.0.3/composer/e-msg-composer.c.CVE-2011-3201 evolution-3.0.3/composer/e-msg-composer.c
+--- evolution-3.0.3/composer/e-msg-composer.c.CVE-2011-3201	2011-07-15 02:42:06.000000000 -0500
++++ evolution-3.0.3/composer/e-msg-composer.c	2011-11-30 07:32:33.485560137 -0600
+@@ -3893,6 +3893,35 @@ add_recipients (GList *list, const gchar
+ 	return list;
+ }
+ 
++static const gchar *blacklist[] = { ".", "etc", ".." };
++
++static gboolean
++file_is_blacklisted (const gchar *filename)
++{
++	gboolean blacklisted = FALSE;
++	guint ii, jj, n_parts;
++	gchar **parts;
++
++	parts = g_strsplit (filename, G_DIR_SEPARATOR_S, -1);
++	n_parts = g_strv_length (parts);
++
++	for (ii = 0; ii < G_N_ELEMENTS (blacklist); ii++) {
++		for (jj = 0; jj < n_parts; jj++) {
++			if (g_str_has_prefix (parts[jj], blacklist[ii])) {
++				blacklisted = TRUE;
++				break;
++			}
++		}
++	}
++
++	g_strfreev (parts);
++
++	if (blacklisted)
++		g_message ("Skipping suspicious attachment: %s", filename);
++
++	return blacklisted;
++}
++
+ static void
+ handle_mailto (EMsgComposer *composer, const gchar *mailto)
+ {
+@@ -3985,6 +4014,8 @@ handle_mailto (EMsgComposer *composer, c
+ 				EAttachment *attachment;
+ 
+ 				camel_url_decode (content);
++				if (file_is_blacklisted (content))
++					goto next;
+ 				if (g_ascii_strncasecmp (content, "file:", 5) == 0)
+ 					attachment = e_attachment_new_for_uri (content);
+ 				else
+@@ -4004,6 +4035,7 @@ handle_mailto (EMsgComposer *composer, c
+ 				e_msg_composer_add_header (composer, header, content);
+ 			}
+ 
++next:
+ 			g_free (content);
+ 
+ 			p += clen;

evolution-help-gl.patch

@@ -0,0 +1,12 @@
+diff -up evolution-2.91.6.1/help/Makefile.in.gl evolution-2.91.6.1/help/Makefile.in
+--- evolution-2.91.6.1/help/Makefile.in.gl	2011-02-11 10:34:44.753102344 -0500
++++ evolution-2.91.6.1/help/Makefile.in	2011-02-11 10:35:07.402819183 -0500
+@@ -590,7 +590,7 @@ DOC_FIGURES = \
+ 	figures/stock_search.png 		\
+ 	figures/ver_view_a.png
+ 
+-DOC_LINGUAS = cs de el en_GB es eu fr gl oc ru sl sv mk zh_CN
++DOC_LINGUAS = cs de el en_GB es eu fr oc ru sl sv mk zh_CN
+ all: all-recursive
+ 
+ .SUFFIXES:

flatpak-evolution-fix-service-names.sh

@@ -1,10 +0,0 @@
-#!/bin/bash
-
-# see https://gitlab.gnome.org/GNOME/glib/issues/1737
-# previous versions used milliseconds instead of seconds as the timeout argument",
-(`pkg-config --atleast-version 2.60.1 gio-2.0` || `pkg-config --atleast-version 2.61.0 gio-2.0`) && TIMEOUTMULT= || TIMEOUTMULT=000
-
-sed -e "s|\@SOURCES_SERVICE\@|$(pkg-config --variable=sourcesdbusservicename evolution-data-server-1.2)|" \
-    -e "s|\@ADDRESSBOOK_SERVICE\@|$(pkg-config --variable=addressbookdbusservicename evolution-data-server-1.2)|" \
-    -e "s|\@CALENDAR_SERVICE\@|$(pkg-config --variable=calendardbusservicename evolution-data-server-1.2)|" \
-    -e "s|\@TIMEOUTMULT\@|${TIMEOUTMULT}|"

flatpak-evolution-wrapper.sh.in

@@ -1,29 +0,0 @@
-#!/bin/bash
-
-if [ "$1" = "--quit" -o "$1" = "--force-shutdown" ]; then
-   /app/bin/evolution.bin "$@"
-else
-   export BOGOFILTER_DIR="${XDG_DATA_HOME}/bogofilter/"
-   export GIO_USE_NETWORK_MONITOR=base
-   gsettings reset org.gnome.evolution-data-server network-monitor-gio-name
-
-   LINES=$(gdbus call --session --dest org.freedesktop.DBus --object-path /org/freedesktop/DBus --method org.freedesktop.DBus.ListNames | grep @SOURCES_SERVICE@ | wc -l)
-   if [ "${LINES}" = "0" ]; then
-      /app/libexec/evolution-source-registry &
-      gdbus wait --session --timeout=1@TIMEOUTMULT@ @SOURCES_SERVICE@
-   fi
-
-   LINES=$(gdbus call --session --dest org.freedesktop.DBus --object-path /org/freedesktop/DBus --method org.freedesktop.DBus.ListNames | grep @ADDRESSBOOK_SERVICE@ | wc -l)
-   if [ "${LINES}" = "0" ]; then
-      /app/libexec/evolution-addressbook-factory -r &
-      gdbus wait --session --timeout=1@TIMEOUTMULT@ @ADDRESSBOOK_SERVICE@
-   fi
-
-   LINES=$(gdbus call --session --dest org.freedesktop.DBus --object-path /org/freedesktop/DBus --method org.freedesktop.DBus.ListNames | grep @CALENDAR_SERVICE@ | wc -l)
-   if [ "${LINES}" = "0" ]; then
-      /app/libexec/evolution-calendar-factory -r &
-      gdbus wait --session --timeout=1@TIMEOUTMULT@ @CALENDAR_SERVICE@
-   fi
-
-   /app/bin/evolution.bin "$@"
-fi

rpminspect.yaml

@@ -1,5 +0,0 @@
----
-runpath:
-    allowed_paths:
-        - /usr/lib/evolution
-        - /usr/lib64/evolution

sources

@@ -1 +1 @@
-SHA512 (evolution-3.59.1.tar.xz) = 26d6d4dfcdbc3d89f88d9e24096c7ff910d221119def75d7f80a397f682be96860726832c7c62b46769ce9cfcc15e5844cbcc016facc9b21b4eb9bbb2c17360d
+49f2617445dc552a1527e5a33a7ad8b9  evolution-3.0.3.tar.bz2