diffstat for spip_2.1.1-3squeeze3 spip_2.1.1-3squeeze4

 debian/patches/fix_XSS_in_password.patch      |   18 ++++++++++++++++++
 debian/patches/fix_XSS_in_variable_name.patch |   19 +++++++++++++++++++
 spip-2.1.1/debian/changelog                   |   15 +++++++++++++++
 spip-2.1.1/debian/patches/series              |    2 ++
 spip-2.1.1/debian/security/ecran_securite.php |   20 +++++++++++++++-----
 5 files changed, 69 insertions(+), 5 deletions(-)

diff -u spip-2.1.1/debian/changelog spip-2.1.1/debian/changelog
--- spip-2.1.1/debian/changelog
+++ spip-2.1.1/debian/changelog
@@ -1,3 +1,18 @@
+spip (2.1.1-3squeeze4) stable-security; urgency=low
+
+  * Non-maintainer upload by the Security Team.
+  * Updated security screen to 1.1.2. Prevent cross site scripting on referer
+    (addresses missing bits of [CVE-2012-2151]), and cross site scripting
+    injection in internal function.
+  * Backport patch from 2.1.14:
+    - fix XSS on password.
+  Closes: #672961
+  * Backport patch from 2.1.15:
+    - fix XSS injection in variable name.
+  Closes: #677290
+
+ -- David Prévot <taffit@debian.org>  Tue, 12 Jun 2012 19:09:49 -0400
+
 spip (2.1.1-3squeeze3) stable-security; urgency=high
 
   * Non-maintainer upload by the Security Team.
diff -u spip-2.1.1/debian/security/ecran_securite.php spip-2.1.1/debian/security/ecran_securite.php
--- spip-2.1.1/debian/security/ecran_securite.php
+++ spip-2.1.1/debian/security/ecran_securite.php
@@ -5,7 +5,7 @@
  * ------------------
  */
 
-define('_ECRAN_SECURITE', '1.0.10'); // 17 avril  2012
+define('_ECRAN_SECURITE', '1.1.2'); // 12 juin  2012
 
 /*
  * Documentation : http://www.spip.net/fr_article4200.html
@@ -50,14 +50,14 @@
  */
 $cjpeg_command='';
 
-/*     - controle la variable lang, var_recherche, aide (XSS)
+/*     - controle de quelques variables (XSS)
  *
  */
-foreach(array('lang', 'var_recherche', 'aide', 'var_lang_r', 'lang_r') as $var) {
+foreach(array('lang', 'var_recherche', 'aide', 'var_lang_r', 'lang_r', 'var_ajax_ancre') as $var) {
 	if (isset($_GET[$var]))
-		$_REQUEST[$var] = $GLOBALS[$var] = $_GET[$var] = preg_replace(',[^\w-]+,',' ',(string)$_GET[$var]);
+		$_REQUEST[$var] = $GLOBALS[$var] = $_GET[$var] = preg_replace(',[^\w\,/#&;-]+,',' ',(string)$_GET[$var]);
 	if (isset($_POST[$var]))
-		$_REQUEST[$var] = $GLOBALS[$var] = $_POST[$var] = preg_replace(',[^\w-]+,',' ',(string)$_POST[$var]);
+		$_REQUEST[$var] = $GLOBALS[$var] = $_POST[$var] = preg_replace(',[^\w\,/#&;-]+,',' ',(string)$_POST[$var]);
 }
 
 /*     - filtre l'acces a spip_acces_doc (injection SQL en 1.8.2x)
@@ -215,6 +215,16 @@
 AND $_REQUEST['reinstall'] == 'oui')
 	$ecran_securite_raison = 'reinstall=oui';
 
+/* echappement xss referer */
+if (isset($_SERVER['HTTP_REFERER']))
+	$_SERVER['HTTP_REFERER'] = strtr($_SERVER['HTTP_REFERER'], '<>"\'', '[]##');
+
+/* Reinjection des cles en html dans l'admin r19561 */
+if (strpos($_SERVER['REQUEST_URI'],"ecrire/")!==false){
+	$zzzz=implode("",array_keys($_REQUEST));
+	if (strlen($zzzz)!=strcspn($zzzz,'<>"\''))
+		$ecran_securite_raison = 'Cle incorrecte en $_REQUEST';
+}
 
 /*
  * S'il y a une raison de mourir, mourons
diff -u spip-2.1.1/debian/patches/series spip-2.1.1/debian/patches/series
--- spip-2.1.1/debian/patches/series
+++ spip-2.1.1/debian/patches/series
@@ -14,0 +15,2 @@
+fix_XSS_in_password.patch
+fix_XSS_in_variable_name.patch
only in patch2:
unchanged:
--- spip-2.1.1.orig/debian/patches/fix_XSS_in_variable_name.patch
+++ spip-2.1.1/debian/patches/fix_XSS_in_variable_name.patch
@@ -0,0 +1,19 @@
+From: denisb <denisb@laposte.net>
+Subject: Don't reinject unsanitize variable name in HTML
+
+* ecrire/inc/admin.php: Fix XSS injection in variable name (thanks to
+  AS ASafety).
+
+Origin: upstream, http://core.spip.org/projects/spip/repository/revisions/19559
+Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=
+--- a/ecrire/inc/admin.php
++++ b/ecrire/inc/admin.php
+@@ -172,7 +172,7 @@
+         include_spip('inc/filtres');
+ 	foreach($_POST as $n => $c) {
+ 	  if (($n != 'fichier') AND !is_array($c))
+-		$suite .= "\n<input type='hidden' name='$n' value='" .
++		$suite .= "\n<input type='hidden' name='".htmlspecialchars($n)."' value='" .
+ 		  entites_html($c) .
+ 		  "'  />";
+ 	}
only in patch2:
unchanged:
--- spip-2.1.1.orig/debian/patches/fix_XSS_in_password.patch
+++ spip-2.1.1/debian/patches/fix_XSS_in_password.patch
@@ -0,0 +1,18 @@
+From: Cédric Morin <cedric.morin@yterium.com>
+Subject: Fix auto-XSS on password
+
+* prive/javascript/login.js: fix auto-XSS on password (thanks to zataz).
+
+Origin: upstream, http://core.spip.org/projects/spip/repository/revisions/19333
+Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=
+--- a/prive/javascript/login.js
++++ b/prive/javascript/login.js
+@@ -77,7 +77,7 @@
+ 			// - certains navigateurs memorisent le hash au lieu du pass ...
+ 			// on cree un input hidden a cote, on lui met le name="password"
+ 			// et on vide le champ visible
+-			inputpass.after('<input name="password" type="hidden" value="'+pass+'" />');
++			inputpass.after('<input name="password" type="hidden" value="" />').attr('value',pass);
+ 			inputpass.attr('name','nothing').attr('value','');
+ 			calcule_hash_pass(pass);
+ 		}