From 40e14d07c17ea2bf31c180aa3cce4bfa749d1b31 Mon Sep 17 00:00:00 2001 From: Jesse Keating Date: Wed, 17 Feb 2010 03:27:36 +0000 Subject: [PATCH 1/3] Initialize branch F-13 for wordpress-mu --- branch | 1 + 1 file changed, 1 insertion(+) create mode 100644 branch diff --git a/branch b/branch new file mode 100644 index 0000000..baa94ef --- /dev/null +++ b/branch @@ -0,0 +1 @@ +F-13 From 0dea7f8c749adccd6e0d4e75071522874368a3fb Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 29 Jul 2010 15:23:57 +0000 Subject: [PATCH 2/3] dist-git conversion --- .cvsignore => .gitignore | 0 Makefile | 21 --------------------- branch | 1 - import.log | 1 - 4 files changed, 23 deletions(-) rename .cvsignore => .gitignore (100%) delete mode 100644 Makefile delete mode 100644 branch delete mode 100644 import.log diff --git a/.cvsignore b/.gitignore similarity index 100% rename from .cvsignore rename to .gitignore diff --git a/Makefile b/Makefile deleted file mode 100644 index 58736f5..0000000 --- a/Makefile +++ /dev/null @@ -1,21 +0,0 @@ -# Makefile for source rpm: wordpress-mu -# $Id: Makefile,v 1.1 2008/08/25 19:55:16 kevin Exp $ -NAME := wordpress-mu -SPECFILE = $(firstword $(wildcard *.spec)) - -define find-makefile-common -for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$d/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done -endef - -MAKEFILE_COMMON := $(shell $(find-makefile-common)) - -ifeq ($(MAKEFILE_COMMON),) -# attept a checkout -define checkout-makefile-common -test -f CVS/Root && { cvs -Q -d $$(cat CVS/Root) checkout common && echo "common/Makefile.common" ; } || { echo "ERROR: I can't figure out how to checkout the 'common' module." ; exit -1 ; } >&2 -endef - -MAKEFILE_COMMON := $(shell $(checkout-makefile-common)) -endif - -include $(MAKEFILE_COMMON) diff --git a/branch b/branch deleted file mode 100644 index baa94ef..0000000 --- a/branch +++ /dev/null @@ -1 +0,0 @@ -F-13 diff --git a/import.log b/import.log deleted file mode 100644 index 83b639a..0000000 --- a/import.log +++ /dev/null @@ -1 +0,0 @@ -wordpress-mu-2_6_1-1_fc8:HEAD:wordpress-mu-2.6.1-1.fc8.src.rpm:1220452323 From 97c4082295f4b24b8fc01fd11481a93143a96e60 Mon Sep 17 00:00:00 2001 From: Jon Ciesla Date: Tue, 11 Jan 2011 11:44:28 -0600 Subject: [PATCH 3/3] Security fixes. --- wordpress-mu-2.9.2-r17172.patch | 92 +++++++++++++++++++++++++++++++++ wordpress-mu.spec | 7 ++- 2 files changed, 98 insertions(+), 1 deletion(-) create mode 100644 wordpress-mu-2.9.2-r17172.patch diff --git a/wordpress-mu-2.9.2-r17172.patch b/wordpress-mu-2.9.2-r17172.patch new file mode 100644 index 0000000..b78b7ae --- /dev/null +++ b/wordpress-mu-2.9.2-r17172.patch @@ -0,0 +1,92 @@ +diff -r -U2 wordpress.orig/wp-includes/formatting.php wordpress/wp-includes/formatting.php +--- wordpress.orig/wp-includes/formatting.php 2009-11-11 17:10:13.000000000 -0600 ++++ wordpress/wp-includes/formatting.php 2011-01-11 10:34:13.970920002 -0600 +@@ -2092,6 +2092,7 @@ + // Replace ampersands and single quotes only when displaying. + if ( 'display' == $context ) { +- $url = preg_replace('/&([^#])(?![a-z]{2,8};)/', '&$1', $url); +- $url = str_replace( "'", ''', $url ); ++ $url = wp_kses_normalize_entities( $url ); ++ $url = str_replace( '&', '&', $url ); ++ $url = str_replace( "'", ''', $url ); + } + +diff -r -U2 wordpress.orig/wp-includes/kses.php wordpress/wp-includes/kses.php +--- wordpress.orig/wp-includes/kses.php 2009-07-08 04:53:22.000000000 -0500 ++++ wordpress/wp-includes/kses.php 2011-01-11 10:47:04.468920001 -0600 +@@ -534,5 +534,5 @@ + } + +- if ( $arreach['name'] == 'style' ) { ++ if ( strtolower($arreach['name']) == 'style' ) { + $orig_value = $arreach['value']; + +@@ -626,5 +626,5 @@ + { + $thisval = $match[1]; +- if ( in_array($attrname, $uris) ) ++ if ( in_array(strtolower($attrname), $uris) ) + $thisval = wp_kses_bad_protocol($thisval, $allowed_protocols); + +@@ -642,5 +642,5 @@ + { + $thisval = $match[1]; +- if ( in_array($attrname, $uris) ) ++ if ( in_array(strtolower($attrname), $uris) ) + $thisval = wp_kses_bad_protocol($thisval, $allowed_protocols); + +@@ -658,5 +658,5 @@ + { + $thisval = $match[1]; +- if ( in_array($attrname, $uris) ) ++ if ( in_array(strtolower($attrname), $uris) ) + $thisval = wp_kses_bad_protocol($thisval, $allowed_protocols); + +@@ -882,12 +882,7 @@ + */ + function wp_kses_bad_protocol_once($string, $allowed_protocols) { +- global $_kses_allowed_protocols; +- $_kses_allowed_protocols = $allowed_protocols; +- +- $string2 = preg_split('/:|:|:/i', $string, 2); +- if ( isset($string2[1]) && !preg_match('%/\?%', $string2[0]) ) +- $string = wp_kses_bad_protocol_once2($string2[0]) . trim($string2[1]); +- else +- $string = preg_replace_callback('/^((&[^;]*;|[\sA-Za-z0-9])*)'.'(:|:|&#[Xx]3[Aa];)\s*/', 'wp_kses_bad_protocol_once2', $string); ++ $string2 = preg_split( '/:|�*58;|�*3a;/i', $string, 2 ); ++ if ( isset($string2[1]) && ! preg_match('%/\?%', $string2[0]) ) ++ $string = wp_kses_bad_protocol_once2( $string2[0], $allowed_protocols ) . trim( $string2[1] ); + + return $string; +@@ -903,19 +898,9 @@ + * @since 1.0.0 + * +- * @param mixed $matches string or preg_replace_callback() matches array to check for bad protocols ++ * @param string $string URI scheme to check against the whitelist ++ * @param string $allowed_protocols Allowed protocols + * @return string Sanitized content + */ +-function wp_kses_bad_protocol_once2($matches) { +- global $_kses_allowed_protocols; +- +- if ( is_array($matches) ) { +- if ( ! isset($matches[1]) || empty($matches[1]) ) +- return ''; +- +- $string = $matches[1]; +- } else { +- $string = $matches; +- } +- ++function wp_kses_bad_protocol_once2( $string, $allowed_protocols ) { + $string2 = wp_kses_decode_entities($string); + $string2 = preg_replace('/\s/', '', $string2); +@@ -926,6 +911,6 @@ + + $allowed = false; +- foreach ( (array) $_kses_allowed_protocols as $one_protocol) +- if (strtolower($one_protocol) == $string2) { ++ foreach ( (array) $allowed_protocols as $one_protocol ) ++ if ( strtolower($one_protocol) == $string2 ) { + $allowed = true; + break; diff --git a/wordpress-mu.spec b/wordpress-mu.spec index 9a072c5..553378b 100644 --- a/wordpress-mu.spec +++ b/wordpress-mu.spec @@ -2,13 +2,14 @@ Summary: WordPress-MU multi-user blogging software URL: http://mu.wordpress.org/latest.tar.gz Name: wordpress-mu Version: 2.9.2 -Release: 2%{?dist} +Release: 3%{?dist} Group: Applications/Publishing License: GPLv2 Source0: %{name}-%{version}.tar.gz Source1: wordpress-mu-httpd-conf Source2: README.fedora.wordpress-mu Patch0: wordpress-mu-2.9.2-r16625.patch +Patch1: wordpress-mu-2.9.2-r17172.patch BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) Requires: php >= 4.1.0, webserver, php-mysql BuildArch: noarch @@ -21,6 +22,7 @@ one instance to serve multiple users. %setup -q -n wordpress-mu %patch0 -p0 -b .16625 +%patch1 -p1 -b .17172 # disable-wordpress-core-update, updates are always installed via rpm # @@ -102,6 +104,9 @@ rm -rf %{buildroot} %dir %{_sysconfdir}/wordpress-mu %changelog +* Tue Jan 11 2011 Jon Ciesla - 2.9.2-3 +- Patches for security flaws, BZ 668192. + * Thu Dec 23 2010 Jon Ciesla - 2.9.2-2 - Change Requires from httpd to webserver, BZ 523480. - Patch for security vulnerability, BZ 659319.