- fixprivilegeescalationbug.diff from debian

Changed files:
    dokuwiki.spec -> 1.59
    fixprivilegeescalationbug.diff -> 1.1

diff --git a/dokuwiki.spec b/dokuwiki.spec
index 8a17bfc07b49c6c93d9417c7f0c99aae653e5db8..7398dc3bc172b3e3a1d30b8ddb2081c8d5fc35e7 100644 (file)
--- a/dokuwiki.spec
+++ b/dokuwiki.spec
@@ -2,7 +2,7 @@ Summary:        PHP-based Wiki webapplication
 Summary(pl.UTF-8):     Aplikacja WWW Wiki oparta na PHP
 Name:          dokuwiki
 Version:       20091110
-Release:       0.5
+Release:       0.7
 License:       GPL v2
 Group:         Applications/WWW
 Source0:       http://dev.splitbrain.org/download/snapshots/dokuwiki-latest.tgz
@@ -35,6 +35,7 @@ Patch14:      interwiki-outputonly.patch
 Patch15:       simplepie.patch
 Patch18:       install.patch
 Patch19:       pld-branding.patch
+Patch20:       fixprivilegeescalationbug.diff
 URL:           http://wiki.splitbrain.org/wiki:dokuwiki
 BuildRequires: rpmbuild(macros) >= 1.520
 Requires:      geshi >= 1.0.7.19
@@ -108,13 +109,14 @@ pozostawienie plików instalacyjnych mogłoby być niebezpieczne.
 %patch14 -p1
 %patch15 -p1
 %patch18 -p1
+%patch19 -p1
+%patch20 -p1
 
 %patch66 -p1
 
 find -name _dummy | xargs rm
-rm -f lib/index.html lib/plugins/index.html
+rm lib/index.html lib/plugins/index.html inc/lang/.htaccess
 
-rm -f inc/lang/.htaccess
 # safe file
 mv conf/words.aspell{.dist,}
 

diff --git a/fixprivilegeescalationbug.diff b/fixprivilegeescalationbug.diff
new file mode 100644 (file)
index 0000000..30d46db
--- /dev/null
+++ b/fixprivilegeescalationbug.diff
@@ -0,0 +1,18 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## fixprivilegeescalationbug.dpatch by Matti Pöllä <mpo@iki.fi>
+##
+## DP: Hotfix for privilege escalation bug.
+
+@DPATCH@
+Index: dokuwiki-0.0.20090214/inc/actions.php
+===================================================================
+--- dokuwiki-0.0.20090214.orig/inc/actions.php 2009-02-14 13:13:25.000000000 +0100
++++ dokuwiki-0.0.20090214/inc/actions.php      2009-02-14 19:19:32.000000000 +0100
+@@ -141,6 +141,7 @@
+     act_redirect($ID,$preact);
+   }
+ 
++  $ACT = act_permcheck($ACT);
+   //call template FIXME: all needed vars available?
+   $headers[] = 'Content-Type: text/html; charset=utf-8';
+   trigger_event('ACTION_HEADERS_SEND',$headers,'act_sendheaders');