Merge lp:~ari-tczew/ubuntu/jaunty/trac/fix-CVE-2009-4405 into lp:ubuntu/jaunty/trac

[Artur Rona]

[lp:~ari-tczew/ubuntu/jaunty/trac/fix-CVE-2009-4405]

21. By Artur Rona on 2010-05-19

* debian/rules:
  - Include /usr/share/python/python.mk
  - Pass $(py_setup_install_args) to setup.py
  - Use $(py_libdir_sh) for matching distutils installation paths
  - Fixes FTBFS

[Marc Deslauriers (mdeslaur)]

review: Approve

Unmerged revisions

21. By Artur Rona on 2010-05-19

* debian/rules:
  - Include /usr/share/python/python.mk
  - Pass $(py_setup_install_args) to setup.py
  - Use $(py_libdir_sh) for matching distutils installation paths
  - Fixes FTBFS

20. By Artur Rona on 2010-05-18

* SECURITY UPDATE (LP: #394290)
* debian/patches/20_CVE-2009-4405.dpatch:
  - Multiple unspecified vulnerabilities in Trac before 0.11.6 have
    unknown impact and attack vectors, possibly related to (1) "policy
    checks in report results when using alternate formats" or (2)
    a "check for the 'raw' role that is missing in docutils < 0.6."
  - CVE-2009-4405

=== modified file 'debian/changelog'
--- debian/changelog	2008-11-16 18:34:25 +0000
+++ debian/changelog	2010-05-19 15:59:33 +0000
@@ -1,3 +1,20 @@
+trac (0.11.1-2.1ubuntu0.1) jaunty-security; urgency=low
+
+  * SECURITY UPDATE (LP: #394290)
+  * debian/patches/20_CVE-2009-4405.dpatch:
+    - Multiple unspecified vulnerabilities in Trac before 0.11.6 have
+      unknown impact and attack vectors, possibly related to (1) "policy
+      checks in report results when using alternate formats" or (2)
+      a "check for the 'raw' role that is missing in docutils < 0.6."
+    - CVE-2009-4405
+  * debian/rules:
+    - Include /usr/share/python/python.mk
+    - Pass $(py_setup_install_args) to setup.py
+    - Use $(py_libdir_sh) for matching distutils installation paths
+    - Fixes FTBFS
+
+ -- Artur Rona <[e-mail]>  Wed, 19 May 2010 17:48:56 +0200
+
 trac (0.11.1-2.1) unstable; urgency=high
 
   * Non-maintainer upload.

=== modified file 'debian/control'
--- debian/control	2008-08-16 00:08:30 +0000
+++ debian/control	2010-05-19 15:59:33 +0000
@@ -3,7 +3,8 @@
 Priority: optional
 Build-Depends-Indep: python-setuptools (> 0.5)
 Build-Depends: python-genshi (>= 0.5), python-central, python-all-dev, debhelper (>= 6.0.7), dpatch 
-Maintainer: Debian Trac Team <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Debian Trac Team <[e-mail]>
 Uploaders: Otavio Salvador <[e-mail]>, Andres Salomon <[e-mail]>, Jesus Climent <[e-mail]>, Luis Matos <[e-mail]>
 Standards-Version: 3.8.0
 VCS-Git: git://git.debian.org/git/pkg-trac/trac.git

=== modified file 'debian/patches/00list'
--- debian/patches/00list	2008-11-16 18:34:25 +0000
+++ debian/patches/00list	2010-05-19 15:59:33 +0000
@@ -2,3 +2,4 @@
 15_remove_jquery_file.dpatch
 16_install_contrib_dir.dpatch
 17_SA32652.dpatch
+18_CVE-2009-4405.dpatch

=== added file 'debian/patches/18_CVE-2009-4405.dpatch'
--- debian/patches/18_CVE-2009-4405.dpatch	1970-01-01 00:00:00 +0000
+++ debian/patches/18_CVE-2009-4405.dpatch	2010-05-19 15:59:33 +0000
@@ -0,0 +1,71 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## From: Artur Rona <[e-mail]>
+## Description: CVE-2009-4405. Added a missing check for the "raw" role when using docutils < 0.6.
+##              Enforce same policy checks for tabular text alternate formats in report results.
+## Bug: https://launchpad.net/bugs/394290
+## Origin: upstream, http://trac.edgewall.org/changeset/8813
+##                   http://trac.edgewall.org/changeset/8816
+## Author: Remy Blank, Christian Boos
+
+@DPATCH@
+
+diff -Nru -x '*~' trac-0.11.1.orig/trac/mimeview/rst.py trac-0.11.1/trac/mimeview/rst.py
+--- trac-0.11.1.orig/trac/mimeview/rst.py	2008-08-07 03:00:20.000000000 +0200
++++ trac-0.11.1/trac/mimeview/rst.py	2010-04-24 03:37:42.000000000 +0200
+@@ -43,6 +43,23 @@
+ from trac.wiki.api import WikiSystem
+ from trac.wiki.formatter import WikiProcessor, Formatter, extract_link
+ 
++if has_docutils and StrictVersion(__version__) < StrictVersion('0.6'):
++    # Monkey-patch "raw" role handler in docutils to add a missing check
++    # See docutils bug #2845002 on SourceForge
++    def raw_role(role, rawtext, text, lineno, inliner, options={}, content=[]):
++        if not inliner.document.settings.raw_enabled:
++            msg = inliner.reporter.warning('raw (and derived) roles disabled')
++            prb = inliner.problematic(rawtext, rawtext, msg)
++            return [prb], [msg]
++        return _raw_role(role, rawtext, text, lineno, inliner, options,
++                         content)
++    
++    from docutils.parsers.rst import roles
++    raw_role.options = roles.raw_role.options
++    _raw_role = roles.raw_role
++    roles.raw_role = raw_role
++    roles.register_canonical_role('raw', raw_role)
++
+ class ReStructuredTextRenderer(Component):
+     """
+     Renders plain text in reStructuredText format as HTML.
+diff -Nru -x '*~' trac-0.11.1.orig/trac/ticket/report.py trac-0.11.1/trac/ticket/report.py
+--- trac-0.11.1.orig/trac/ticket/report.py	2008-08-07 03:00:20.000000000 +0200
++++ trac-0.11.1/trac/ticket/report.py	2010-04-24 03:37:42.000000000 +0200
+@@ -396,6 +396,7 @@
+         #  - group rows according to __group__ value, if defined
+         #  - group cells the same way headers are grouped
+         row_groups = []
++        authorized_results = [] 
+         prev_group_value = None
+         for row_idx, result in enumerate(results):
+             col_idx = 0
+@@ -435,6 +436,7 @@
+             # FIXME: for now, we still need to hardcode the realm in the action
+             if resource.realm.upper()+'_VIEW' not in req.perm(resource):
+                 continue
++            authorized_results.append(result)
+             if email_cells:
+                 for cell in email_cells:
+                     emails = Chrome(self.env).format_emails(context(resource),
+@@ -470,11 +472,11 @@
+             return 'report.rss', data, 'application/rss+xml'
+         elif format == 'csv':
+             filename = id and 'report_%s.csv' % id or 'report.csv'
+-            self._send_csv(req, cols, results, mimetype='text/csv',
++            self._send_csv(req, cols, authorized_results, mimetype='text/csv',
+                            filename=filename)
+         elif format == 'tab':
+             filename = id and 'report_%s.tsv' % id or 'report.tsv'
+-            self._send_csv(req, cols, results, '\t',
++            self._send_csv(req, cols, authorized_results, '\t',
+                            mimetype='text/tab-separated-values',
+                            filename=filename)
+         else:

=== modified file 'debian/rules'
--- debian/rules	2008-08-16 00:08:30 +0000
+++ debian/rules	2010-05-19 15:59:33 +0000
@@ -2,6 +2,7 @@
 
 PYVER=$(shell python -c 'import sys; print sys.version[:3]')
 include /usr/share/dpatch/dpatch.make
+include /usr/share/python/python.mk
 
 clean: unpatch 
 	dh_testdir
@@ -23,10 +24,12 @@
 	dh_installdirs
 	python setup.py install \
 		--root=$(CURDIR)/debian/trac \
-		--single-version-externally-managed
-	chmod +x $(CURDIR)/debian/trac/usr/lib/python$(PYVER)/site-packages/trac/admin/templates/deploy_trac.wsgi
-	chmod +x $(CURDIR)/debian/trac/usr/lib/python$(PYVER)/site-packages/trac/admin/templates/deploy_trac.fcgi
-	chmod +x $(CURDIR)/debian/trac/usr/lib/python$(PYVER)/site-packages/trac/admin/templates/deploy_trac.cgi
+		--single-version-externally-managed \
+		$(py_setup_install_args)
+	chmod +x $(CURDIR)/debian/trac/$(py_libdir_sh)/trac/admin/templates/deploy_trac.wsgi
+	chmod +x $(CURDIR)/debian/trac/$(py_libdir_sh)/trac/admin/templates/deploy_trac.fcgi
+	chmod +x $(CURDIR)/debian/trac/$(py_libdir_sh)/trac/admin/templates/deploy_trac.cgi
+	chmod +x $(CURDIR)/debian/trac/$(py_libdir_sh)/trac/web/*_frontend.py
 
 binary-indep: build install
 	dh_testdir