Merge remote-tracking branch 'origin/f32' into el6

Conflicts:
	.gitignore
	websvn.spec

.gitignore

@@ -1,10 +1,3 @@
 websvn-2.3.1.tar.gz
 /websvn-2.3.2.tar.gz
 /websvn-2.3.3.tar.gz
-/websvn-2.5.tar.gz
-/websvn-2.6.0.tar.gz
-/websvn-2.6.1.tar.gz
-/websvn-2.7.0.tar.gz
-/websvn-2.8.1.tar.gz
-/websvn-2.8.2.tar.gz
-/websvn-2.8.4.tar.gz

sources

@@ -1 +1 @@
-SHA512 (websvn-2.8.4.tar.gz) = 04eeb30c8b8e8b7d693a07d7857e41a50cf005c505a65ff05e2e27aea387d39163a8770e76532ff7c5aab73dc121fdd3008b4978fedd483ad3dd50b74a95d2d7
+bc1821caf77a3225aa810e8f19400ea6  websvn-2.3.3.tar.gz

websvn-2.3.3-CVE-2013-6892.patch

@@ -0,0 +1,31 @@
+diff -ur oud/dl.php nieuw/dl.php
+--- oud/dl.php	2015-01-18 16:03:30.688791512 +0100
++++ nieuw/dl.php	2015-01-18 16:27:00.950897749 +0100
+@@ -137,6 +137,18 @@
+ 		exit(0);
+ 	}
+ 
++	// For security reasons, disallow direct downloads of filenames that
++	// are a symlink, since they may be a symlink to anywhere (/etc/passwd)
++	// Deciding whether the symlink is relative and legal within the
++	// repository would be nice but seems to error prone at this moment.
++	if ( is_link($tempDir.DIRECTORY_SEPARATOR.$archiveName) ) {
++		header('HTTP/1.x 500 Internal Server Error', true, 500);
++		error_log('to be downloaded file is symlink, aborting: '.$archiveName);
++		print 'Download of symlinks disallowed: "'.xml_entities($archiveName).'".';
++		removeDirectory($tempDir);
++		exit(0);
++	}
++
+ 	// Set timestamp of exported directory (and subdirectories) to timestamp of
+ 	// the revision so every archive of a given revision has the same timestamp.
+ 	$revDate = $logEntry->date;
+@@ -180,7 +192,7 @@
+ 		$downloadMimeType = 'application/x-zip';
+ 		$downloadArchive .= '.zip';
+ 		// Create zip file
+-		$cmd = $config->zip.' -r '.quote($downloadArchive).' '.quote($archiveName);
++		$cmd = $config->zip.' --symlinks -r '.quote($downloadArchive).' '.quote($archiveName);
+ 		execCommand($cmd, $retcode);
+ 		if ($retcode != 0) {
+ 			error_log('Unable to call zip command: '.$cmd);

websvn-2.3.3-CVE-2016-1236.patch

@@ -0,0 +1,61 @@
+Description: CVE-2016-1236: XSS via directory or file in a repository containing XSS payload
+Origin: vendor
+Forwarded: no
+Author: Nitin Venkatesh <venkatesh.nitin@gmail.com>
+Reviewed-by: Salvatore Bonaccorso <carnil@debian.org>
+Last-Update: 2016-05-08
+
+--- a/revision.php
++++ b/revision.php
+@@ -145,7 +145,7 @@ if ($rep) {
+ 		}
+ 		$resourceExisted = $change->action == 'M' || $change->copyfrom;
+ 		$listing[] = array(
+-			'path' => $change->path,
++			'path' => escape($change->path),
+ 			'oldpath' => $change->copyfrom ? $change->copyfrom.' @ '.$change->copyrev : '',
+ 			'action' => $change->action,
+ 			'added' => $change->action == 'A',
+--- a/log.php
++++ b/log.php
+@@ -323,6 +323,9 @@ if ($rep) {
+ 					$listing[$index]['revadded'] = (isset($modpaths['A'])) ? implode('<br/>', $modpaths['A']) : '';
+ 					$listing[$index]['revdeleted'] = (isset($modpaths['D'])) ? implode('<br/>', $modpaths['D']) : '';
+ 					$listing[$index]['revmodified'] = (isset($modpaths['M'])) ? implode('<br/>', $modpaths['M']) : '';
++					$listing[$index]['revadded'] = escape($listing[$index]['revadded']);
++					$listing[$index]['revdeleted'] = escape($listing[$index]['revdeleted']);
++					$listing[$index]['revmodified'] = escape($listing[$index]['revmodified']);
+ 				}
+ 
+ 				$row = 1 - $row;
+--- a/comp.php
++++ b/comp.php
+@@ -381,7 +381,7 @@ if ($rep) {
+ 						$absnode .= $node;
+ 					}
+ 
+-					$listing[$index]['newpath'] = $absnode;
++					$listing[$index]['newpath'] = escape($absnode);
+ 
+ 					$listing[$index]['fileurl'] = $config->getURL($rep, $absnode, 'file').'rev='.$rev2;
+ 
+--- a/listing.php
++++ b/listing.php
+@@ -123,7 +123,7 @@ function showDirFiles($svnrep, $subs, $l
+ 				$listing[$index]['level'] = ($treeview) ? $level : 0;
+ 				$listing[$index]['node'] = 0; // t-node
+ 				$listing[$index]['path'] = $path.$file;
+-				$listing[$index]['filename'] = $file;
++				$listing[$index]['filename'] = escape($file);
+ 				if ($isDir) {
+ 					$listing[$index]['fileurl'] = urlForPath($path.$file, $passRevString);
+ 				} else {
+@@ -137,7 +137,7 @@ function showDirFiles($svnrep, $subs, $l
+ 				}
+ 
+ 				if ($treeview) {
+-					$listing[$index]['compare_box'] = '<input type="checkbox" name="compare[]" value="'.$path.$file.'@'.$passrev.'" onclick="checkCB(this)" />';
++					$listing[$index]['compare_box'] = '<input type="checkbox" name="compare[]" value="'.escape($path.$file).'@'.$passrev.'" onclick="checkCB(this)" />';
+ 				}
+ 				if ($config->showLastModInListing()) {
+ 					$listing[$index]['committime'] = $entry->committime;

websvn-2.3.3-CVE-2016-2511.patch

@@ -0,0 +1,11 @@
+--- orig/include/setup.php	2016-02-19 16:02:05.674756241 +0100
++++ new/include/setup.php	2016-02-19 16:02:10.166832543 +0100
+@@ -467,7 +467,7 @@
+ $vars['validationurl'] = getFullURL($_SERVER['SCRIPT_NAME']).'?'.buildQuery($queryParams + array('template' => $template, 'language' => $language), '%26');
+ 
+ // To avoid a possible XSS exploit, need to clean up the passed-in path first
+-$path = !empty($_REQUEST['path']) ? $_REQUEST['path'] : null;
++$path = !empty($_REQUEST['path']) ? escape($_REQUEST['path']) : null;
+ if ($path === null || $path === '')
+ 	$path = '/';
+ $vars['safepath'] = escape($path);

websvn-2.3.3-use_system_libs.patch

@@ -0,0 +1,33 @@
+diff -Naur websvn-2.3.3.orig/include/svnlook.php websvn-2.3.3/include/svnlook.php
+--- websvn-2.3.3.orig/include/svnlook.php	2011-06-27 11:12:51.000000000 +0200
++++ websvn-2.3.3/include/svnlook.php	2011-06-28 21:36:43.000000000 +0200
+@@ -752,7 +752,7 @@
+ 		foreach ($extGeshi as $language => $extensions) {
+ 			if (in_array($filename, $extensions) || in_array($ext, $extensions)) {
+ 				if ($this->geshi === null) {
+-					require_once 'lib/geshi.php';
++					require_once 'geshi.php';
+ 					$this->geshi = new GeSHi();
+ 				} else {
+ 					$this->geshi->error = false;
+@@ -796,7 +796,7 @@
+ 
+ 		$source = file_get_contents($filename);
+ 		if ($this->geshi === null) {
+-			require_once 'lib/geshi.php';
++			require_once 'geshi.php';
+ 			$this->geshi = new GeSHi();
+ 		}
+ 		$this->geshi->set_source($source);
+diff -Naur websvn-2.3.3.orig/wsvn.php websvn-2.3.3/wsvn.php
+--- websvn-2.3.3.orig/wsvn.php	2011-06-28 21:35:45.000000000 +0200
++++ websvn-2.3.3/wsvn.php	2011-06-28 21:36:43.000000000 +0200
+@@ -45,7 +45,7 @@
+ 	define('WSVN_MULTIVIEWS', 1);
+ }
+ 
+-ini_set('include_path', $locwebsvnreal);
++ini_set('include_path', ini_get('include_path').":".$locwebsvnreal);
+ 
+ require_once 'include/setup.php';
+ require_once 'include/svnlook.php';

websvn-httpd.conf

@@ -1,8 +1,8 @@
 Alias /websvn /usr/share/websvn/
 
 <Directory /usr/share/websvn/>
-   Options MultiViews FollowSymLinks
-   DirectoryIndex browse.php
+   Options MultiViews
+   DirectoryIndex wsvn.php
    <IfModule mod_authz_core.c>
       # Apache 2.4
       Require local

websvn.spec

@@ -1,30 +1,30 @@
 Name:           websvn
-Version:        2.8.4
-Release:        7%{?dist}
+Version:        2.3.3
+Release:        23%{?dist}
 Summary:        Online subversion repository browser
 
-License:        GPL-2.0-or-later
+License:        GPLv2+
 URL:            https://websvnphp.github.io
-Source0:        https://github.com/websvnphp/websvn/archive/%{version}/%{name}-%{version}.tar.gz
+Source0:        http://websvn.tigris.org/files/documents/1380/49056/websvn-2.3.3.tar.gz
 Source1:        websvn-httpd.conf
-
+Patch1:         websvn-2.3.3-use_system_libs.patch
+# https://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;filename=websvn_symlinks.patch;att=1;bug=775682
+Patch2:         websvn-2.3.3-CVE-2013-6892.patch
+Patch3:         websvn-2.3.3-CVE-2016-2511.patch
+Patch4:         websvn-2.3.3-CVE-2016-1236.patch
+Patch5:         websvn-2.3.3-geshi.patch
+Patch6:         websvn-2.3.3-fix_website_url.patch
 BuildArch:      noarch
 
 Requires(pre):  httpd
 Requires:       sed
 Requires:       enscript
-Requires:       php >= 5.4.0
+Requires:       php >= 4.3.0
 Requires:       php-mbstring
 Requires:       php-xml
 Requires:       php-geshi
 Requires:       php-pear(Archive_Tar)
-# Text_Diff is broken with PHP 8.
-# Use system diff instead where needed.
-%if 0%{?fedora} >= 35 || 0%{?rhel} >= 9
-Requires:       diffutils
-%else
 Requires:       php-pear(Text_Diff)
-%endif
 
 
 %description
@@ -48,9 +48,27 @@ SElinux context for %{name}.
 
 %prep
 %setup -q
-find -name .gitignore -delete
+### Let websvn use the system provided php classes and remove bundled ones.
+%patch1 -p1
+rm -rf lib/
+# CVE-2013-6892
+%patch2 -p1
+# CVE-2016-2511
+%patch3 -p1
+# CVE-2016-1236.patch
+%patch4 -p1
+# geshi.patch
+%patch5 -p1
+# website url
+%patch6 -p1
 
 mv include/distconfig.php include/config.php
+find templates/calm -type f -exec chmod -R a-x {} ';'
+sed -i -e 's/\r//' doc/style.css
+iconv -f iso8859-1 -t utf-8 changes.txt > changes.txt.conv \
+&& touch -r changes.txt changes.txt.conv \
+&& mv -f changes.txt.conv changes.txt
+sed -i -e "s#^\$locwebsvnhttp = '';#\$locwebsvnhttp = '/websvn';#" wsvn.php
 sed -i -e "s#^\/\/ \$config->useMultiViews();#\$config->useMultiViews();#" \
     include/config.php
 
@@ -60,6 +78,8 @@ sed -i -e "s#^\/\/ \$config->useMultiViews();#\$config->useMultiViews();#" \
 
 
 %install
+rm -rf $RPM_BUILD_ROOT
+
 # Install the code
 mkdir -p $RPM_BUILD_ROOT/%{_datadir}/%{name}
 cp -a *.php include javascript languages templates \
@@ -86,9 +106,6 @@ ln -s ../../..%{_localstatedir}/cache/%{name} \
 mkdir -p $RPM_BUILD_ROOT/%{_localstatedir}/tmp
 ln -s ../../..%{_localstatedir}/tmp $RPM_BUILD_ROOT/%{_datadir}/%{name}/temp
 
-# Add a compat symlink from removed wsvn.php to new browse.php
-# This needs FollowSymlinks option in the httpd conf
-ln -s %{_datadir}/%{name}/browse.php %{buildroot}/%{_datadir}/%{name}/wsvn.php
 
 
 %post selinux
@@ -103,8 +120,7 @@ fi
 
 
 %files
-%doc README.md changes.txt
-%license license.txt
+%doc changes.txt license.txt doc/
 %config(noreplace) %{_sysconfdir}/httpd/conf.d/%{name}.conf
 %config(noreplace) %{_sysconfdir}/%{name}/config.php
 %{_datadir}/%{name}
@@ -115,75 +131,6 @@ fi
 
 
 %changelog
-* Fri Jul 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 2.8.4-7
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
-
-* Sat Jan 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 2.8.4-6
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
-
-* Fri Jul 25 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.8.4-5
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
-
-* Mon Feb 03 2025 Christian Krause <chkr@fedoraproject.org> - 2.8.4-4
-- Fix FailsToInstall in F42 due to orphaned package (php-erusev-parsedown)
-  by removing that dependency (RHBZ#2342582)
-
-* Sun Jan 19 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.8.4-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
-
-* Sat Jul 20 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.8.4-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
-
-* Tue Jun 18 2024 Christian Krause <chkr@fedoraproject.org> - 2.8.4-1
-- Update to 2.8.4 (RHBZ#2255355)
-- Delete .gitignore files from source directory
-
-* Sat Jan 27 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.8.2-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Sat Jul 22 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.8.2-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
-
-* Mon Jun 26 2023 Xavier Bachelot <xavier@bachelot.org> - 2.8.2-1
-- Update to 2.8.2 (RHBZ#2215709)
-
-* Wed Jun 07 2023 Xavier Bachelot <xavier@bachelot.org> - 2.8.1-1
-- Update to 2.8.1 (RHBZ#2134251)
-- Convert License: to SPDX
-
-* Sat Jan 21 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.7.0-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
-
-* Sat Jul 23 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.7.0-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
-
-* Fri Mar 18 2022 Xavier Bachelot <xavier@bachelot.org> - 2.7.0-1
-- Update to 2.7.0 (RHBZ#2064103)
-
-* Sat Jan 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.6.1-4
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
-
-* Thu Sep 09 2021 Xavier Bachelot <xavier@bachelot.org> - 2.6.1-3
-- Use system diff rather than Text_Diff with PHP 8
-
-* Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.6.1-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
-
-* Mon May 17 2021 Xavier Bachelot <xavier@bachelot.org> - 2.6.1-1
-- Update to 2.6.1 (RHBZ#1960100)
-
-* Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.6.0-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
-
-* Mon Nov 30 2020 Xavier Bachelot <xavier@bachelot.org> - 2.6.0-1
-- Update to 2.6.0 (RHBZ#1893501)
-
-* Wed Jul 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.5-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
-
-* Fri Jul 10 2020 Xavier Bachelot <xavier@bachelot.org> 2.5-1
-- Update to 2.5
-
 * Fri Jul 10 2020 Xavier Bachelot <xavier@bachelot.org> 2.3.3-23
 - Better website URL fix