diff options
author | Alex Legler <a3li@gentoo.org> | 2009-08-17 10:14:28 +0000 |
---|---|---|
committer | Alex Legler <a3li@gentoo.org> | 2009-08-17 10:14:28 +0000 |
commit | 3ad5d735dbaf97b96438e9a58653b480f55a09b9 (patch) | |
tree | 0281b5b7dcbe25bb97f43c2f4427bcf35c3161ed /net-zope | |
parent | Add initial 10.6 (Snow Leopard) profile (diff) | |
download | gentoo-2-3ad5d735dbaf97b96438e9a58653b480f55a09b9.tar.gz gentoo-2-3ad5d735dbaf97b96438e9a58653b480f55a09b9.tar.bz2 gentoo-2-3ad5d735dbaf97b96438e9a58653b480f55a09b9.zip |
Non-maintainer commit: Version bump for security bug 278824.
(Portage version: 2.2_rc33/cvs/Linux x86_64)
Diffstat (limited to 'net-zope')
-rw-r--r-- | net-zope/zope/ChangeLog | 11 | ||||
-rw-r--r-- | net-zope/zope/files/CVE-2009-0668+0669.patch | 117 | ||||
-rw-r--r-- | net-zope/zope/zope-2.10.7-r1.ebuild | 80 | ||||
-rw-r--r-- | net-zope/zope/zope-2.9.10-r1.ebuild | 80 |
4 files changed, 286 insertions, 2 deletions
diff --git a/net-zope/zope/ChangeLog b/net-zope/zope/ChangeLog index 059dad0f29ef..55b832bbedf8 100644 --- a/net-zope/zope/ChangeLog +++ b/net-zope/zope/ChangeLog @@ -1,6 +1,13 @@ # ChangeLog for net-zope/zope -# Copyright 2002-2008 Gentoo Foundation; Distributed under the GPL v2 -# $Header: /var/cvsroot/gentoo-x86/net-zope/zope/ChangeLog,v 1.151 2008/11/24 09:14:04 tupone Exp $ +# Copyright 1999-2009 Gentoo Foundation; Distributed under the GPL v2 +# $Header: /var/cvsroot/gentoo-x86/net-zope/zope/ChangeLog,v 1.152 2009/08/17 10:14:28 a3li Exp $ + +*zope-2.10.7-r1 (17 Aug 2009) +*zope-2.9.10-r1 (17 Aug 2009) + + 17 Aug 2009; Alex Legler <a3li@gentoo.org> +zope-2.9.10-r1.ebuild, + +zope-2.10.7-r1.ebuild, +files/CVE-2009-0668+0669.patch: + Non-maintainer commit: Version bump for security bug 278824. 24 Nov 2008; Alfredo Tupone <tupone@gentoo.org> -zope-2.9.7.ebuild, -zope-2.9.8.ebuild, -zope-2.9.9.ebuild, -zope-2.10.3.ebuild, diff --git a/net-zope/zope/files/CVE-2009-0668+0669.patch b/net-zope/zope/files/CVE-2009-0668+0669.patch new file mode 100644 index 000000000000..ba8ca9711cc9 --- /dev/null +++ b/net-zope/zope/files/CVE-2009-0668+0669.patch @@ -0,0 +1,117 @@ +=== StorageServer.py +================================================================== +Index: lib/python/ZEO/StorageServer.py +=================================================================== +--- lib/python/ZEO/StorageServer.py ++++ lib/python/ZEO/StorageServer.py +@@ -98,7 +98,7 @@ class ZEOStorage: + for func in self.extensions: + self._extensions[func.func_name] = None + +- def finish_auth(self, authenticated): ++ def _finish_auth(self, authenticated): + if not self.auth_realm: + return 1 + self.authenticated = authenticated +@@ -350,6 +350,7 @@ class ZEOStorage: + + def new_oids(self, n=100): + """Return a sequence of n new oids, where n defaults to 100""" ++ n = min(n, 100) + if self.read_only: + raise ReadOnlyError() + if n <= 0: +Index: lib/python/ZEO/auth/auth_digest.py +=================================================================== +--- lib/python/ZEO/auth/auth_digest.py ++++ lib/python/ZEO/auth/auth_digest.py +@@ -121,7 +121,7 @@ class StorageClass(ZEOStorage): + check = hexdigest("%s:%s" % (h_up, challenge)) + if check == response: + self.connection.setSessionKey(session_key(h_up, self._key_nonce)) +- return self.finish_auth(check == response) ++ return self._finish_auth(check == response) + + extensions = [auth_get_challenge, auth_response] + +Index: lib/python/ZEO/tests/auth_plaintext.py +=================================================================== +--- lib/python/ZEO/tests/auth_plaintext.py ++++ lib/python/ZEO/tests/auth_plaintext.py +@@ -41,7 +41,7 @@ class StorageClass(ZEOStorage): + self.connection.setSessionKey(session_key(username, + self.database.realm, + password)) +- return self.finish_auth(dbpw == password_dig) ++ return self._finish_auth(dbpw == password_dig) + + class PlaintextClient(Client): + extensions = ["auth"] +Index: lib/python/ZEO/zrpc/connection.py +=================================================================== +--- lib/python/ZEO/zrpc/connection.py ++++ lib/python/ZEO/zrpc/connection.py +@@ -22,7 +22,7 @@ import logging + import ThreadedAsync + from ZEO.zrpc import smac + from ZEO.zrpc.error import ZRPCError, DisconnectedError +-from ZEO.zrpc.marshal import Marshaller ++from ZEO.zrpc.marshal import Marshaller, ServerMarshaller + from ZEO.zrpc.trigger import trigger + from ZEO.zrpc.log import short_repr, log + from ZODB.loglevels import BLATHER, TRACE +@@ -716,6 +716,7 @@ class ManagedServerConnection(Connection + def __init__(self, sock, addr, obj, mgr): + self.mgr = mgr + self.__super_init(sock, addr, obj, 'S') ++ self.marshal = ServerMarshaller() + self.obj.notifyConnected(self) + + def handshake(self): +Index: lib/python/ZEO/zrpc/marshal.py +=================================================================== +--- lib/python/ZEO/zrpc/marshal.py ++++ lib/python/ZEO/zrpc/marshal.py +@@ -53,6 +53,20 @@ class Marshaller: + level=logging.ERROR) + raise + ++class ServerMarshaller(Marshaller): ++ ++ def decode(self, msg): ++ """Decodes msg and returns its parts""" ++ unpickler = cPickle.Unpickler(StringIO(msg)) ++ unpickler.find_global = server_find_global ++ ++ try: ++ return unpickler.load() # msgid, flags, name, args ++ except: ++ log("can't decode message: %s" % short_repr(msg), ++ level=logging.ERROR) ++ raise ++ + _globals = globals() + _silly = ('__doc__',) + +@@ -77,3 +91,21 @@ def find_global(module, name): + return r + + raise ZRPCError("Unsafe global: %s.%s" % (module, name)) ++ ++def server_find_global(module, name): ++ """Helper for message unpickler""" ++ try: ++ m = __import__(module, _globals, _globals, _silly) ++ except ImportError, msg: ++ raise ZRPCError("import error %s: %s" % (module, msg)) ++ ++ try: ++ r = getattr(m, name) ++ except AttributeError: ++ raise ZRPCError("module %s has no global %s" % (module, name)) ++ ++ safe = getattr(r, '__no_side_effects__', 0) ++ if safe: ++ return r ++ ++ raise ZRPCError("Unsafe global: %s.%s" % (module, name)) diff --git a/net-zope/zope/zope-2.10.7-r1.ebuild b/net-zope/zope/zope-2.10.7-r1.ebuild new file mode 100644 index 000000000000..75102edfc336 --- /dev/null +++ b/net-zope/zope/zope-2.10.7-r1.ebuild @@ -0,0 +1,80 @@ +# Copyright 1999-2009 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/net-zope/zope/zope-2.10.7-r1.ebuild,v 1.1 2009/08/17 10:14:28 a3li Exp $ +EAPI=2 + +inherit eutils multilib + +DESCRIPTION="Zope is a web application platform used for building high-performance, dynamic web sites" +HOMEPAGE="http://www.zope.org" +SRC_URI="http://www.zope.org/Products/Zope/${PV}/Zope-${PV}-final.tgz" + +LICENSE="ZPL" +SLOT="${PV}" +KEYWORDS="~alpha ~amd64 ~ppc ~sparc ~x86" +IUSE="" + +DEPEND="=dev-lang/python-2.4*" + +S="${WORKDIR}/Zope-${PV}-final" +ZUID=zope +ZGID=zope +ZS_DIR=${ROOT%/}/usr/$(get_libdir) +ZSERVDIR=${ZS_DIR}/${P} + +# Narrow the scope of ownership/permissions. +# Security plan: +# * ZUID is the superuser for all zope instances. +# * ZGID is for a single instance's administration. +# * Other' should not have any access to ${ZSERVDIR}, +# because they can work through the Zope web interface. +# This should protect our code/data better. +# +# UPDATE: ${ZSERVDIR} is a lib directory and should be world readable +# like e.g /usr/lib/python we do not store any user data there, +# currently removed all custom permission stuff, for ${ZSERVDIR} +src_prepare() { + epatch "${FILESDIR}"/CVE-2009-0668+0669.patch +} + +src_configure() { + ./configure --prefix="${D}${ZSERVDIR}" --with-python=/usr/bin/python2.4 || die "Failed to execute ./configure ..." +} + +src_install() { + dodoc README.txt + dodoc doc/*.txt + docinto PLATFORMS ; dodoc doc/PLATFORMS/* + docinto ZEO ; dodoc doc/ZEO/* + + make install prefix="${D}${ZSERVDIR}" || die "Failed to install into ${D}${ZSERVDIR}" + rm -rf "${D}${ZSERVDIR}"/doc + dosym ../../share/doc/${PF} ${ZSERVDIR}/doc + + # copy the init script skeleton to skel directory of our installation + insinto "${ZSERVDIR}"/skel + doins "${FILESDIR}"/zope.initd +} + +src_test() { + einfo "Tests disabled by Gentoo team." +} + +pkg_postinst() { + # create the zope user and group for backward compatibility + enewgroup ${ZGID} 261 + usermod -g ${ZGID} ${ZUID} 2>&1 >/dev/null || \ + enewuser ${ZUID} 261 -1 /var/$(get_libdir)/zope ${ZGID} + + einfo "Be warned that you need at least one zope instance to run zope." + einfo "Please emerge zope-config for futher instance management." +} + +pkg_prerm() { + #Remove old compiled code + rm ${ZSERVDIR}/bin/copyzopeskel.pyc + + #need to remove this symlink because portage keeps links to + #existing targets + rm ${ZSERVDIR}/bin/python +} diff --git a/net-zope/zope/zope-2.9.10-r1.ebuild b/net-zope/zope/zope-2.9.10-r1.ebuild new file mode 100644 index 000000000000..feafff5d00bd --- /dev/null +++ b/net-zope/zope/zope-2.9.10-r1.ebuild @@ -0,0 +1,80 @@ +# Copyright 1999-2009 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/net-zope/zope/zope-2.9.10-r1.ebuild,v 1.1 2009/08/17 10:14:28 a3li Exp $ +EAPI=2 + +inherit eutils multilib + +DESCRIPTION="Zope is a web application platform used for building high-performance, dynamic web sites" +HOMEPAGE="http://www.zope.org" +SRC_URI="http://www.zope.org/Products/Zope/${PV}/Zope-${PV}-final.tgz" + +LICENSE="ZPL" +SLOT="${PV}" +KEYWORDS="~alpha ~amd64 ~ppc ~sparc ~x86" +IUSE="" + +DEPEND="=dev-lang/python-2.4*" + +S="${WORKDIR}/Zope-${PV}-final" +ZUID=zope +ZGID=zope +ZS_DIR=${ROOT%/}/usr/$(get_libdir) +ZSERVDIR=${ZS_DIR}/${P} + +# Narrow the scope of ownership/permissions. +# Security plan: +# * ZUID is the superuser for all zope instances. +# * ZGID is for a single instance's administration. +# * Other' should not have any access to ${ZSERVDIR}, +# because they can work through the Zope web interface. +# This should protect our code/data better. +# +# UPDATE: ${ZSERVDIR} is a lib directory and should be world readable +# like e.g /usr/lib/python we do not store any user data there, +# currently removed all custom permission stuff, for ${ZSERVDIR} + +src_prepare() { + epatch "${FILESDIR}"/CVE-2009-0668+0669.patch +} + +src_configure() { + ./configure --prefix="${D}${ZSERVDIR}" --with-python=/usr/bin/python2.4 || die "Failed to execute ./configure ..." +} + +src_install() { + dodoc README.txt + dodoc Zope/doc/*.txt + docinto PLATFORMS ; dodoc Zope/doc/PLATFORMS/* + docinto ZEO ; dodoc Zope/doc/ZEO/* + + make install prefix="${D}"${ZSERVDIR} || die "Failed to install into ${D}${ZSERVDIR}" + rm -rf "${D}"${ZSERVDIR}/doc + dosym ../../share/doc/${PF} ${ZSERVDIR}/doc + + # copy the init script skeleton to skel directory of our installation + cp "${FILESDIR}"/zope.initd "${D}"/${ZSERVDIR}/skel/zope.initd +} + +src_test() { + einfo "Tests disabled by Gentoo team." +} + +pkg_postinst() { + # create the zope user and group for backward compatibility + enewgroup ${ZGID} 261 + usermod -g ${ZGID} ${ZUID} 2>&1 >/dev/null || \ + enewuser ${ZUID} 261 -1 /var/$(get_libdir)/zope ${ZGID} + + einfo "Be warned that you need at least one zope instance to run zope." + einfo "Please emerge zope-config for futher instance management." +} + +pkg_prerm() { + #Remove old compiled code + rm ${ZSERVDIR}/bin/copyzopeskel.pyc + + #need to remove this symlink because portage keeps links to + #existing targets + rm ${ZSERVDIR}/bin/python +} |