CVE-2007-4224

CVE-2007-3820
2007-08-25 08:03:02 +00:00 · 2007-08-25 08:03:02 +00:00 · ba6fc509e6
commit ba6fc509e6
parent 7a9f1afb15
7 changed files with 113 additions and 4 deletions
--- a/x11/kde/base3/Makefile
+++ b/x11/kde/base3/Makefile
@ -1,4 +1,4 @@
-# $OpenBSD: Makefile,v 1.75 2007/07/02 06:07:03 ajacoutot Exp $
+# $OpenBSD: Makefile,v 1.76 2007/08/25 08:03:02 espie Exp $

 COMMENT-main= 		"K Desktop Environment, basic applications"
 COMMENT-plugins=	"Konqueror nsplugins, essentially native JDK"
@ -6,7 +6,7 @@ COMMENT-samba=		"K Desktop Environment, samba support"
 CATEGORIES=		x11 x11/kde
 VERSION=		3.5.7
 DISTNAME=		kdebase-${VERSION}
-PKGNAME-main=		${DISTNAME}p0
+PKGNAME-main=		${DISTNAME}p1
 PKGNAME-samba=		kdesamba-${VERSION}
 MODKDE_VERSION?=	3.5.7
 SHARED_LIBS +=	konq                 7.0      # .6.0
--- a/x11/kde/base3/patches/patch-konqueror_konq_combo_cc
+++ b/x11/kde/base3/patches/patch-konqueror_konq_combo_cc
@ -0,0 +1,13 @@
+$OpenBSD: patch-konqueror_konq_combo_cc,v 1.1 2007/08/25 08:03:02 espie Exp $
+--- konqueror/konq_combo.cc.orig	Sun Oct  1 19:32:03 2006
+++ konqueror/konq_combo.cc	Wed Aug 15 13:55:38 2007
+@@ -158,6 +158,9 @@ void KonqCombo::setURL( const QString& url )
+         kapp->dcopClient()->send( "konqueror*", "KonquerorIface",
+                                   "addToCombo(QString,QCString)", data);
+     }
+    // important security consideration: always display the beginning
+    // of the url rather than its end to prevent spoofing attempts.
+    lineEdit()->setCursorPosition( 0 );
+ }
+ 
+ void KonqCombo::setTemporary( const QString& text )
--- a/x11/kde/base3/patches/patch-konqueror_konq_mainwindow_cc
+++ b/x11/kde/base3/patches/patch-konqueror_konq_mainwindow_cc
@ -0,0 +1,27 @@
+$OpenBSD: patch-konqueror_konq_mainwindow_cc,v 1.5 2007/08/25 08:03:02 espie Exp $
+--- konqueror/konq_mainwindow.cc.orig	Mon May 14 09:55:47 2007
+++ konqueror/konq_mainwindow.cc	Wed Aug 15 13:55:38 2007
+@@ -611,12 +611,11 @@ void KonqMainWindow::openURL( KonqView *_view, const K
+   }
+   else // no known serviceType, use KonqRun
+   {
+-      if ( ( view && view == m_currentView ) ||
+-              ( !view && !req.newTab ) ) // startup with argument
+      if ( ( !view || view->url().isEmpty() ) && !req.newTab ) // startup with argument
+       {
+           // Show it for now in the location bar, but we'll need to store it in the view
+           // later on (can't do it yet since either view == 0 or updateHistoryEntry will be called).
+-          kdDebug(1202) << "setLocationBarURL : url = " << url << endl;
+          kdDebug(1202) << "setLocationBarURL (startup) : url = " << url << endl;
+           setLocationBarURL( url );
+       }
+ 
+@@ -819,8 +818,6 @@ bool KonqMainWindow::openView( QString serviceType, co
+         if ( childView )
+         {
+             enableAllActions( true );
+-
+-            m_pViewManager->setActivePart( childView->part() );
+             m_currentView = childView;
+         }
+       }
--- a/x11/kde/base3/patches/patch-konqueror_konq_viewmgr_cc
+++ b/x11/kde/base3/patches/patch-konqueror_konq_viewmgr_cc
@ -0,0 +1,12 @@
+$OpenBSD: patch-konqueror_konq_viewmgr_cc,v 1.1 2007/08/25 08:03:02 espie Exp $
+--- konqueror/konq_viewmgr.cc.orig	Mon Jan 15 12:32:12 2007
+++ konqueror/konq_viewmgr.cc	Wed Aug 15 13:55:38 2007
+@@ -1395,6 +1395,8 @@ void KonqViewManager::slotActivePartChanged ( KParts::
+ 
+ void KonqViewManager::emitActivePartChanged()
+ {
+    // prevent unnecessary multiple calls to slotPartActivated:
+    m_activePartChangedTimer->stop();
+     m_pMainWindow->slotPartActivated( activePart() );
+ }
+ 
--- a/x11/kde/libs3/Makefile
+++ b/x11/kde/libs3/Makefile
@ -1,4 +1,4 @@
-# $OpenBSD: Makefile,v 1.81 2007/05/25 09:49:54 espie Exp $
+# $OpenBSD: Makefile,v 1.82 2007/08/25 08:03:02 espie Exp $

 COMMENT-main=		"K Desktop Environment, libraries"
 COMMENT-cups=		"K Desktop Environment, cups support"
@ -8,7 +8,7 @@ DISTNAME=		kdelibs-${VERSION}
 MASTER_SITES0=  ftp://ftp.kde.org/pub/kde/security_patches/
 #PATCHFILES=	post-3.4.3-kdelibs-kjs.diff:0

-PKGNAME-main=		${DISTNAME}
+PKGNAME-main=		${DISTNAME}p0
 PKGNAME-cups=		kdecups-${VERSION}
 MODKDE_VERSION=		3.5.7
 SHARED_LIBS +=	DCOP                 7.0      # .6.0
--- a/x11/kde/libs3/patches/patch-kdecore_kurl_cpp
+++ b/x11/kde/libs3/patches/patch-kdecore_kurl_cpp
@ -0,0 +1,21 @@
+$OpenBSD: patch-kdecore_kurl_cpp,v 1.2 2007/08/25 08:03:02 espie Exp $
+--- kdecore/kurl.cpp.orig	Sat Nov 19 10:09:18 2005
+++ kdecore/kurl.cpp	Wed Aug 15 13:51:42 2007
+@@ -183,7 +183,7 @@ static QString lazy_encode( const QString& segment, bo
+         (character == '?') || // Start of query delimiter
+         ((character == '@') && encodeAt) || // Username delimiter
+         (character == '#') || // Start of reference delimiter
+-        ((character == 32) && (i+1 == old_length))) // A trailing space
+        ((character == 32) && (i+1 == old_length || segment[i+1] == ' '))) // A trailing space
+     {
+       new_segment[ new_length++ ] = '%';
+ 
+@@ -1540,7 +1540,7 @@ QString KURL::prettyURL( int _trailing ) const
+     u += "//";
+     if ( hasUser() )
+     {
+-      u += lazy_encode(m_strUser);
+      u += encode(m_strUser, 0, 0);
+       // Don't show password!
+       u += "@";
+     }
--- a/x11/kde/libs3/patches/patch-kdecore_tests_kurltest_cpp
+++ b/x11/kde/libs3/patches/patch-kdecore_tests_kurltest_cpp
@ -0,0 +1,36 @@
+$OpenBSD: patch-kdecore_tests_kurltest_cpp,v 1.1 2007/08/25 08:03:02 espie Exp $
+--- kdecore/tests/kurltest.cpp.orig	Fri Mar 17 11:19:04 2006
+++ kdecore/tests/kurltest.cpp	Wed Aug 15 13:51:42 2007
+@@ -288,6 +288,16 @@ int main(int argc, char *argv[])
+   check("KURL::prettyURL()", url15582.prettyURL(), "http://alain.knaff.linux.lu/bug-reports/kde/percentage%in%url.html");
+   check("KURL::url()", url15582.url(), "http://alain.knaff.linux.lu/bug-reports/kde/percentage%25in%25url.html");
+ 
+  KURL whitespaceInUser("http://www.google.com%20%20%20%20%20@foobar.com/");
+  check("KURL::prettyURL()", whitespaceInUser.prettyURL(), "http://www.google.com%20%20%20%20%20@foobar.com/");
+
+  KURL whitespaceInPath("http://www.google.com/foo%20bar/");
+  check("KURL::prettyURL()", whitespaceInPath.prettyURL(), "http://www.google.com/foo bar/");
+
+   KURL whitespaceInPath2("http://www.google.com/foo%20%20%20%20%20%20%20bar/");
+  check("KURL::prettyURL()", whitespaceInPath2.prettyURL(),
+          "http://www.google.com/foo%20%20%20%20%20%20 bar/");
+
+   KURL carsten;
+   carsten.setPath("/home/gis/src/kde/kdelibs/kfile/.#kfiledetailview.cpp.1.18");
+   check("KURL::path()", carsten.path(), "/home/gis/src/kde/kdelibs/kfile/.#kfiledetailview.cpp.1.18");
+@@ -593,6 +603,15 @@ int main(int argc, char *argv[])
+         "http://meine.db24.de#link=home_c_login_login");
+   check("http: URL with empty path string path", waba1.path(),
+         "");
+
+  waba1 = "http://www.meinestadt.de&url_plain=http";
+  check("http: URL with empty path string", waba1.host(),
+         "www.meinestadt.de&url_plain=http");
+  check("http: URL with empty path string", waba1.htmlURL(),
+         "http://www.meinestadt.de&amp;url_plain=http");
+ 
+  check("http: URL with empty path string", waba1.path(),
+         "");
+ 
+   waba1 = "http://a:389#b=c";
+   check( "http: URL with port, ref, and empty path; url", waba1.url(), "http://a:389#b=c" );