cpet/freebsd-ports
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Update Simgear & Flightgear ports to 2016.4.4

Browse Source
This commit is contained in:
Ganael LAPLANCHE 2017-01-06 17:45:29 +00:00
parent 2d8881b5e2
commit 87b99a924d
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=430720
8 changed files with 12 additions and 97 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
devel/simgear/Makefile
View File

@ -1,8 +1,7 @@
# $FreeBSD$
PORTNAME= simgear
PORTVERSION= 2016.4.3
PORTREVISION= 2
PORTVERSION= 2016.4.4
CATEGORIES= devel games
MASTER_SITES= SF/flightgear/release-${PORTVERSION:R}

6
devel/simgear/distinfo
View File

@ -1,3 +1,3 @@
TIMESTAMP = 1481013012
SHA256 (simgear-2016.4.3.tar.bz2) = 6933550215818c2043b84df01b6bf5f7adef218c8648b510b8202e394003d2bd
SIZE (simgear-2016.4.3.tar.bz2) = 1201326
TIMESTAMP = 1483648162
SHA256 (simgear-2016.4.4.tar.bz2) = 5514fd0006bbfcdbdc0e2dab7da41eae491ea03a6246cc6a009590032b2fc1dc
SIZE (simgear-2016.4.4.tar.bz2) = 1200320

28
devel/simgear/files/patch-a2b111b-simgear-io-HTTPRepository.cxx
View File

@ -1,28 +0,0 @@
commit a2b111bb09485769d75addf563cb6e44be6655b3
Author: James Turner <zakalawe@mac.com>
Date: Wed Dec 14 09:41:44 2016 +0000
Bugfix: reject dubious paths in HTTP repos.
This avoids a malicious repository writing to files outside the local
storage root.
diff --git simgear/io/HTTPRepository.cxx simgear/io/HTTPRepository.cxx
index 1c95f278..b0335783 100644
--- simgear/io/HTTPRepository.cxx
+++ simgear/io/HTTPRepository.cxx
@@ -503,6 +503,14 @@ private:
SG_LOG(SG_TERRASYNC, SG_WARN, "malformed .dirindex file: invalid type in line '" << line << "', expected 'd' or 'f', (ignoring line)" );
continue;
}
+
+ // security: prevent writing outside the repository via ../../.. filenames
+ // (valid filenames never contain / - subdirectories have their own .dirindex)
+ if ((tokens[1] == "..") || (tokens[1].find_first_of("/\\") != std::string::npos)) {
+ SG_LOG(SG_TERRASYNC, SG_WARN, "malformed .dirindex file: invalid filename in line '" << line << "', (ignoring line)" );
+ continue;
+ }
+
children.push_back(ChildInfo(typeData == "f" ? ChildInfo::FileType : ChildInfo::DirectoryType, tokens[1], tokens[2]));
if (tokens.size() > 3) {

2
games/flightgear-data/Makefile
View File

@ -2,7 +2,7 @@
# $FreeBSD$
PORTNAME= flightgear-data
PORTVERSION= 2016.4.3
PORTVERSION= 2016.4.4
CATEGORIES= games
MASTER_SITES= SF/flightgear/release-${PORTVERSION:R}
DISTNAME= FlightGear-${PORTVERSION}-data

6
games/flightgear-data/distinfo
View File

@ -1,3 +1,3 @@
TIMESTAMP = 1481013221
SHA256 (FlightGear-2016.4.3-data.tar.bz2) = e4f6b26624af3fa6cf874077a8fe2f57fc298d124a7899731946a593cd73c4f3
SIZE (FlightGear-2016.4.3-data.tar.bz2) = 1648602662
TIMESTAMP = 1483648719
SHA256 (FlightGear-2016.4.4-data.tar.bz2) = 3dfd4b82c99a8bf4b81dd31846efce52ed417be180eaa71020ccc914f9a49668
SIZE (FlightGear-2016.4.4-data.tar.bz2) = 1654119067

3
games/flightgear/Makefile
View File

@ -2,8 +2,7 @@
# $FreeBSD$
PORTNAME= flightgear
PORTVERSION= 2016.4.3
PORTREVISION= 2
PORTVERSION= 2016.4.4
CATEGORIES= games
MASTER_SITES= SF/flightgear/release-${PORTVERSION:R}

6
games/flightgear/distinfo
View File

@ -1,3 +1,3 @@
TIMESTAMP = 1481013038
SHA256 (flightgear-2016.4.3.tar.bz2) = 35a9c439265e4a9caf794458bb42917d93280b2e561cc7b9a02aaba1226d2822
SIZE (flightgear-2016.4.3.tar.bz2) = 7559919
TIMESTAMP = 1483648311
SHA256 (flightgear-2016.4.4.tar.bz2) = d51992cbe40f1812f9821ab27b838d52e04c10551772d57fc2e815f4444dfafc
SIZE (flightgear-2016.4.4.tar.bz2) = 7560911

55
games/flightgear/files/patch-280cd52-src-Autopilot-route_mgr.cxx
View File

@ -1,55 +0,0 @@
commit 280cd523686fbdb175d50417266d2487a8ce67d2
Author: Florent Rougon <f.rougon@free.fr>
Date: Fri Dec 9 11:29:13 2016 +0100
Security fix: don't allow the route manager to overwrite any file
Since the Save function can be triggered from Nasal with an arbitrary
path, we must check this path before overwriting the file.
(also add a missing include that is directly needed for this commit)
diff --git src/Autopilot/route_mgr.cxx src/Autopilot/route_mgr.cxx
index bae5b1d23..901c64e14 100644
--- src/Autopilot/route_mgr.cxx
+++ src/Autopilot/route_mgr.cxx
@@ -44,6 +44,7 @@
#include <simgear/timing/sg_time.hxx>
#include <simgear/sg_inlines.h>
+#include <Main/globals.hxx>
#include "Main/fg_props.hxx"
#include "Navaids/positioned.hxx"
#include <Navaids/waypoint.hxx>
@@ -54,6 +55,8 @@
#include "Airports/runways.hxx"
#include <GUI/new_gui.hxx>
#include <GUI/dialog.hxx>
+#include <Main/util.hxx> // fgValidatePath()
+#include <GUI/MessageBox.hxx>
#define RM "/autopilot/route-manager/"
@@ -709,7 +712,21 @@ void FGRouteMgr::InputListener::valueChanged(SGPropertyNode *prop)
mgr->loadRoute(path);
} else if (!strcmp(s, "@SAVE")) {
SGPath path(mgr->_pathNode->getStringValue());
- mgr->saveRoute(path);
+ SGPath authorizedPath = fgValidatePath(path, true /* write */);
+
+ if (!authorizedPath.isNull()) {
+ mgr->saveRoute(authorizedPath);
+ } else {
+ std::string msg =
+ "The route manager was asked to write the flightplan to '" +
+ path.utf8Str() + "', but this path is not authorized for writing. " +
+ "Please choose another location, for instance in the $FG_HOME/Export "
+ "folder (" + (globals->get_fg_home() / "Export").utf8Str() + ").";
+
+ SG_LOG(SG_AUTOPILOT, SG_ALERT, msg);
+ modalMessageBox("FlightGear", "Unable to write to the specified file",
+ msg);
+ }
} else if (!strcmp(s, "@NEXT")) {
mgr->jumpToIndex(mgr->currentIndex() + 1);
} else if (!strcmp(s, "@PREVIOUS")) {