Kolab Groupware OBS

kolab-webadmin.spec Changed

0001-Fix-escaping-of-object-identifiers-in-javascript-com.patch Added

@@ -0,0 +1,53 @@
+From 3b4e4a7d263df3a864e542970dc27c21bd92bf97 Mon Sep 17 00:00:00 2001
+From: Aleksander Machniak <machniak@kolabsys.com>
+Date: Fri, 10 Oct 2014 20:02:16 +0200
+Subject: [PATCH 1/3] Fix escaping of object identifiers in javascript command
+ (#3675)
+
+---
+ lib/kolab_client_task.php |  2 +-
+ lib/kolab_utils.php       | 17 +++++++++++++++++
+ 2 files changed, 18 insertions(+), 1 deletion(-)
+
+diff --git a/lib/kolab_client_task.php b/lib/kolab_client_task.php
+index 1fe3761..5713a5b 100644
+--- a/lib/kolab_client_task.php
++++ b/lib/kolab_client_task.php
+@@ -1682,7 +1682,7 @@ class kolab_client_task
+                     $i++;
+                     $cells = array();
+                     $cells[] = array('class' => 'name', 'body' => kolab_html::escape($item),
+-                        'onclick' => "kadm.command('$task.info', '$idx')");
++                        'onclick' => "kadm.command('$task.info', '" . kolab_utils::js_escape($idx) . "')");
+                     $rows[] = array('id' => $i, 'class' => implode(' ', $class), 'cells' => $cells);
+                 }
+             }
+diff --git a/lib/kolab_utils.php b/lib/kolab_utils.php
+index e2602af..91dad55 100644
+--- a/lib/kolab_utils.php
++++ b/lib/kolab_utils.php
+@@ -206,4 +206,21 @@ class kolab_utils
+ 
+         return $str;
+     }
++
++    /**
++     * Escape string for use in javascript code
++     *
++     * @param string $str String
++     *
++     * @return string Escaped string
++     */
++    public static function js_escape($str)
++    {
++        return strtr($str, array(
++                '"'  => '\\"',
++                "'"  => "\\'",
++                "\\" => "\\\\",
++                "\n" => '\n',
++        ));
++    }
+ }
+-- 
+1.9.3
+

0002-Define-max-width-for-select-fields.patch Added

0003-Fix-handling-special-characters-e.g.-comma-in-organi.patch Added

@@ -0,0 +1,99 @@
+From 14b84021343d89f7f517709fc4d08b62f8f077d3 Mon Sep 17 00:00:00 2001
+From: Aleksander Machniak <machniak@kolabsys.com>
+Date: Fri, 10 Oct 2014 21:40:11 +0200
+Subject: [PATCH 3/3] Fix handling special characters (e.g. comma) in
+ organizational unit names (#3744) Fix escaping of object identifiers in
+ javascript command (#3675) - for organizational units list
+
+---
+ lib/client/kolab_client_task_ou.php | 45 ++++++++++++++++++++++++++-----------
+ 1 file changed, 32 insertions(+), 13 deletions(-)
+
+diff --git a/lib/client/kolab_client_task_ou.php b/lib/client/kolab_client_task_ou.php
+index 6179518..a286d34 100644
+--- a/lib/client/kolab_client_task_ou.php
++++ b/lib/client/kolab_client_task_ou.php
+@@ -108,7 +108,7 @@ class kolab_client_task_ou extends kolab_client_task
+             $cells[] = array(
+                 'class'   => 'name',
+                 'body'    => $tree . kolab_html::escape($item['name']),
+-                'onclick' => "kadm.command('ou.info', '$idx')",
++                'onclick' => "kadm.command('ou.info', '" . kolab_utils::js_escape($idx) . "')",
+             );
+ 
+             $rows[] = array(
+@@ -196,11 +196,8 @@ class kolab_client_task_ou extends kolab_client_task
+     {
+         // build the list for sorting
+         foreach (array_keys($list) as $dn) {
+-            $name = kolab_utils::dn2ufn($dn);
+-            $name = explode(',', $name);
+-
+-            $sort_name = array_pop($name) . ',' . implode(',', array_reverse($name));
+-
++            $names     = $this->explode_dn($dn);
++            $sort_name = $names['domain'] . ':' . implode(',', array_reverse($names['path']));
+             $list[$dn] = mb_strtolower($sort_name);
+         }
+ 
+@@ -237,7 +234,10 @@ class kolab_client_task_ou extends kolab_client_task
+                 $parent = $this->domain_dn($item['domain']);
+ 
+                 foreach ($item['path'] as $sub) {
++                    // convert special characters back into entities (#
++                    $sub    = str_replace(',', "\\2C", $sub);
+                     $parent = "ou=$sub,$parent";
++
+                     if (!isset($result[$parent])) {
+                         $result[$parent] = $this->parse_dn($parent);
+                         $last = $parent;
+@@ -260,15 +260,13 @@ class kolab_client_task_ou extends kolab_client_task
+      */
+     private function parse_dn($dn)
+     {
+-        $path   = kolab_utils::dn2ufn($dn);
+-        $path   = explode(', ', $path);
+-        $domain = array_pop($path); // remove domain
++        $items = $this->explode_dn($dn);
+ 
+         return array(
+-            'name'   => array_shift($path),
+-            'path'   => array_reverse($path),
+-            'level'  => count($path),
+-            'domain' => $domain,
++            'name'   => array_shift($items['path']),
++            'path'   => array_reverse($items['path']),
++            'level'  => count($items['path']),
++            'domain' => $items['domain'],
+         );
+     }
+ 
+@@ -279,4 +277,25 @@ class kolab_client_task_ou extends kolab_client_task
+     {
+         return "dc=" . implode(',dc=', explode('.', $domain));
+     }
++
++    private function explode_dn($dn)
++    {
++        $path   = kolab_utils::explode_dn($dn);
++        $domain = array();
++
++        foreach ($path as $idx => $item) {
++            if (strpos($item, 'dc=') === 0) {
++                unset($path[$idx]);
++                $domain[] = substr($item, 3);
++            }
++            else {
++                $path[$idx] = substr($item, 3);
++            }
++        }
++
++        return array(
++            'domain' => implode('.', $domain),
++            'path'   => $path,
++        );
++    }
+ }
+-- 
+1.9.3
+

debian.series Changed

Changes of Revision 48