[SCM] BOINC packaging branch, wheezy, updated. debian/7.0.27+dfsg-5-21-g8ddb22e

[Guo Yixuan]

The following commit has been merged in the wheezy branch:
commit 7a97bbee0344a0b3245e9288f09d5f0d0b77cc20
Author: Guo Yixuan <culu.gyx at gmail.com>
Date:   Thu Jun 27 10:08:02 2013 +0800

    CVE-2013-2018 3rd patch
    
    boinc-v2: 6e205de096da83b12ffb2f0183b43e51261eb0c4

diff --git a/debian/patches/CVE-2013-2018-3-SQL-injections.patch b/debian/patches/CVE-2013-2018-3-SQL-injections.patch
new file mode 100644
index 0000000..846938f
--- /dev/null
+++ b/debian/patches/CVE-2013-2018-3-SQL-injections.patch
@@ -0,0 +1,33 @@
+From 6e205de096da83b12ffb2f0183b43e51261eb0c4 Mon Sep 17 00:00:00 2001
+From: David Anderson <davea at ssl.berkeley.edu>
+Date: Mon, 7 Jan 2013 23:33:22 -0800
+Subject: [PATCH] - user web: fix a security vulnerability
+
+---
+ html/user/team_search.php | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/html/user/team_search.php b/html/user/team_search.php
+index d70c20a..1a87bcd 100644
+--- a/html/user/team_search.php
++++ b/html/user/team_search.php
+@@ -149,7 +149,6 @@ function search($params) {
+         $tried = true;
+     }
+     if ($params->type and $params->type>1) {
+-        $type = BoincDb::escape_string($params->type);
+         $list2 = get_teams("type=$type", $params->active);
+         //echo "<br>type matches: ",sizeof($list2);
+         merge_lists($list2, $list, 2);
+@@ -169,7 +168,7 @@ if ($submit || $xml) {
+     $params = null;
+     $params->keywords = get_str('keywords', true);
+     $params->country = get_str("country", true);
+-    $params->type = get_str("type", true);
++    $params->type = get_int("type", true);
+     $params->active = get_str('active', true);
+     $list = search($params);
+     if ($xml) {
+-- 
+1.8.3.1
+
diff --git a/debian/patches/series b/debian/patches/series
index d3edb18..0971b9a 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -63,3 +63,4 @@ link_with_gold.patch
 wrapper.patch
 CVE-2013-2018-1-SQL-injections.patch
 CVE-2013-2018-2-SQL-injections.patch
+CVE-2013-2018-3-SQL-injections.patch

-- 
BOINC packaging