Kolab Groupware OBS

roundcubemail.spec Changed

@@ -41,9 +41,9 @@
 %global tmpdir /var/lib/roundcubemail
 
 Name:           roundcubemail
-Version:        1.1.0
+Version:        1.1.5
 
-Release:        4%{?dist}
+Release:        2%{?dist}
 
 Summary:        Round Cube Webmail is a browser-based multilingual IMAP client
 
@@ -51,7 +51,7 @@
 License:        GPLv2
 URL:            http://www.roundcube.net
 
-# From bbbd02bd6a43ae0e2ee00519be8d56fb21161dcd
+# From 357cd5103d1c27f8416ef316c4a4c31588db45b8
 Source0:        roundcubemail-%{version}.tar.gz
 Source1:        comm.py
 
@@ -61,13 +61,21 @@
 Patch201:       ticket-466-changes.patch
 Patch202:       default-configuration.patch
 
+Patch203:       CVE-2016-5103.patch
+
 BuildArch:      noarch
 BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root%(%{__id_u} -n)
 
+BuildRequires:  php-Net-LDAP3
+BuildRequires:  php-pdo
+BuildRequires:  php-pear >= 1.9.0
+BuildRequires:  php-phpunit-PHPUnit
+
 %if 0%{?suse_version} < 1
 BuildRequires:  python-cssmin
 BuildRequires:  uglify-js
 %endif
+
 BuildRequires:  python
 
 Requires:       %{name}(core) = %{?epoch:%{epoch}:}%{version}-%{release}
@@ -1240,6 +1248,7 @@
 
 %patch201 -p1
 %patch202 -p1
+%patch203 -p1
 
 # Remove the results of patching when there's an incidental offset
 find . -type f -name "*.orig" -delete
@@ -1363,8 +1372,8 @@
         echo "    touch %%{_localstatedir}/lib/rpm-state/roundcubemail/httpd.restarted"
         echo "fi"
         echo ""
-        if [ ! -z "$(find ${plugin} -type d -name \"SQL\")" ]; then
-            echo "for dir in \$(find /usr/share/roundcubemail/plugins/$(basename $plugin)/ -type d -name \"SQL\"); do"
+        if [ ! -z "$(find ${plugin} -type d -name SQL)" ]; then
+            echo "for dir in \$(find /usr/share/roundcubemail/plugins/$(basename $plugin)/ -type d -name SQL); do"
             echo "    # Skip plugins with multiple drivers and no kolab driver"
             echo "    if [ ! -z \"\$(echo \$dir | grep driver)\" ]; then"
             echo "        if [ -z \"\$(echo \$dir | grep kolab)\" ]; then"
@@ -1932,6 +1941,11 @@
     %{__rm} -rf %{plugindir}/enigma/home >/dev/null 2>&1 || :
 fi
 
+%check
+pushd %{name}-%{version}/tests
+phpunit --debug || :
+popd
+
 %clean
 %{__rm} -rf %{buildroot}
 
@@ -2989,6 +3003,24 @@
 %defattr(-,root,root,-)
 
 %changelog
+* Fri May 27 2016 Timotheus Pokorra <tp@tbits.net> - 1.1.5-2
+- apply security patch for XSS vulnerability CVE-2016-5103
+
+* Fri May 13 2016 Timotheus Pokorra <tp@tbits.net> - 1.1.5-1
+- Check in maintenance upstream 1.1.5 release
+
+* Mon Jan 11 2016 Timotheus Pokorra <tp@tbits.net> - 1.1.4-1
+- Check in maintenance upstream 1.1.4 release
+
+* Thu Oct 15 2015 Timotheus Pokorra <tp@tbits.net> - 1.1.3-1
+- Check in maintenance upstream 1.1.3 release
+
+* Fri Jun 09 2015 Daniel Hoffend <dh@dotlan.net> - 1.1.2-1
+- Check in maintenance upstream 1.1.2 release
+
+* Fri Mar 27 2015 Jeroen van Meeuwen <vanmeeuwen@kolabsys.com> - 1.1.1.3-1
+- Check in 3 revisions ahead of 1.1.1 release
+
 * Wed Feb 25 2015 Jeroen van Meeuwen <vanmeeuwen@kolabsys.com> - 1.1.0-4
 - Repack of 1.1 release branch at bbbd02bd

CVE-2016-5103.patch Added

@@ -0,0 +1,67 @@
+From 7d14065baa6c51346e0ec0253c06ac822f082278 Mon Sep 17 00:00:00 2001
+From: Aleksander Machniak <alec@alec.pl>
+Date: Fri, 6 May 2016 08:28:15 +0200
+Subject: [PATCH] Fix XSS issue in href attribute on area tag (#5240, #5241)
+
+---
+ CHANGELOG                               |  1 +
+ program/lib/Roundcube/rcube_washtml.php |  2 +-
+ tests/Framework/Washtml.php             | 17 +++++++++++++++++
+ 3 files changed, 19 insertions(+), 1 deletion(-)
+
+diff --git a/CHANGELOG b/CHANGELOG
+index 4d7719a..7420e7c 100644
+--- a/CHANGELOG
++++ b/CHANGELOG
+@@ -1,6 +1,10 @@
+ CHANGELOG Roundcube Webmail
+ ===========================
+ 
++Security Update
++---------------
++- Fix XSS issue in href attribute on area tag (#5240)
++
+ RELEASE 1.1.5
+ -------------
+ - Plugin API: Add html2text hook
+diff --git a/program/lib/Roundcube/rcube_washtml.php b/program/lib/Roundcube/rcube_washtml.php
+index 54c1cd8..6535e3b 100644
+--- a/program/lib/Roundcube/rcube_washtml.php
++++ b/program/lib/Roundcube/rcube_washtml.php
+@@ -370,7 +370,7 @@ private function wash_uri($uri, $blocked_source = false)
+      */
+     private function is_link_attribute($tag, $attr)
+     {
+-        return $tag == 'a' && $attr == 'href';
++        return ($tag == 'a' || $tag == 'area') && $attr == 'href';
+     }
+ 
+     /**
+diff --git a/tests/Framework/Washtml.php b/tests/Framework/Washtml.php
+index 9515f0d..2e68179 100644
+--- a/tests/Framework/Washtml.php
++++ b/tests/Framework/Washtml.php
+@@ -38,6 +38,23 @@ function test_href()
+     }
+ 
+     /**
++     * Test XSS in area's href (#5240)
++     */
++    function test_href_area()
++    {
++        $html = '<p><area href="data:text/html,&lt;script&gt;alert(document.cookie)&lt;/script&gt;">'
++            . '<area href="vbscript:alert(document.cookie)">Internet Explorer</p>'
++            . '<area href="javascript:alert(document.domain)" shape=default>';
++
++        $washer = new rcube_washtml;
++        $washed = $washer->wash($html);
++
++        $this->assertNotRegExp('/data:text/', $washed, "data:text/html in area href");
++        $this->assertNotRegExp('/vbscript:/', $washed, "vbscript: in area href");
++        $this->assertNotRegExp('/javascript:/', $washed, "javascript: in area href");
++    }
++
++    /**
+      * Test handling HTML comments
+      */
+     function test_comments()

debian.changelog Changed

@@ -1,3 +1,45 @@
+roundcubemail (1:1.1.5.0-0~kolab2) unstable; urgency=low
+
+  * apply security patch for XSS vulnerability CVE-2016-5103
+
+ -- Timotheus Pokorra <tp@tbits.net>  Fri, 27 May 2016 08:42:00 +0200
+
+roundcubemail (1:1.1.5.0-0~kolab1) unstable; urgency=low
+
+  * Check in maintenance upstream 1.1.5 release
+
+ -- Timotheus Pokorra <tp@tbits.net>  Fri, 13 May 2016 08:42:00 +0200
+
+roundcubemail (1:1.1.4.0-0~kolab1) unstable; urgency=low
+
+  * Check in maintenance upstream 1.1.4 release
+
+ -- Timotheus Pokorra <tp@tbits.net>  Mon, 11 Jan 2016 08:42:00 +0200
+
+roundcubemail (1:1.1.3.0-0~kolab1) unstable; urgency=low
+
+  * Check in maintenance upstream 1.1.3 release
+
+ -- Timotheus Pokorra <tp@tbits.net>  Thu, 15 Oct 2015 08:42:00 +0200
+
+roundcubemail (1:1.1.2.0-0~kolab1) unstable; urgency=low
+
+  * Check in maintenance upstream 1.1.2 release
+
+ -- Daniel Hoffend <dh@dotlan.net>  Fri, 09 Jun 2015 22:42:00 +0200
+
+roundcubemail (1:1.1.1.3-0~kolab2) unstable; urgency=low
+
+  * enabled php gc for roundcubemail since it uses mysql instead of files #4850
+
+ -- Daniel Hoffend <dh@dotlan.net>  Wed, 01 Apr 2015 00:17:00 +0200
+
+roundcubemail (1:1.1.1.3-0~kolab1) unstable; urgency=low
+
+  * Check in 3 revisions ahead of upstream 1.1.1 release
+
+ -- Jeroen van Meeuwen (Kolab Systems) <vanmeeuwen@kolabsys.com>  Fri, 27 Mar 2015 07:14:39 +0200
+
 roundcubemail (1:1.1.0-0~kolab6) unstable; urgency=low
 
   * Repack of 1.1.0 at bbbd02bd6a43ae0e2ee00519be8d56fb21161dcd

debian.series Changed

debian.tar.gz/conf/roundcubemail.conf Changed

roundcubemail-1.1.0.tar.gz -> roundcubemail-1.1.5.tar.gz Changed

roundcubemail.dsc Changed

Difference Between Revision 10 and Kolab:3.4 / roundcubemail