--- moodle-1.8.2.orig/admin/index.php +++ moodle-1.8.2/admin/index.php @@ -1,7 +1,7 @@ \ No newline at end of file +?> --- moodle-1.8.2.orig/mod/forum/discuss.php +++ moodle-1.8.2/mod/forum/discuss.php @@ -107,7 +107,6 @@ if (abs($displaymode) == 1) { // If flat AND parent, then force nested display this time $displaymode = 3; } - $navtail = ''; } else { $parent = $discussion->firstpost; $navtail = '-> '.format_string($discussion->name); --- moodle-1.8.2.orig/debian/NEWS +++ moodle-1.8.2/debian/NEWS @@ -0,0 +1,11 @@ +moodle (1.6-1) unstable; urgency=low + + Since the upgrade from Moodle 1.5.x to Moodle 1.6 is a bit more complicated + than usual, you should definitely read the following page before doing the + real upgrade: http://docs.moodle.org/en/Upgrading_to_Moodle_1.6 + + Note that this package can be installed safely and will not mess with your + database by itself. The process to update the database must be manually + started. + + -- Isaac Clerencia Mon, 19 Jun 2006 18:36:20 +0200 --- moodle-1.8.2.orig/debian/cron.d +++ moodle-1.8.2/debian/cron.d @@ -0,0 +1,2 @@ +# Regular cron jobs for the moodle package +*/5 * * * * www-data [ -f /usr/share/moodle/admin/cron.php ] && /usr/bin/php -f /usr/share/moodle/admin/cron.php > /dev/null --- moodle-1.8.2.orig/debian/prerem +++ moodle-1.8.2/debian/prerem @@ -0,0 +1,9 @@ +#!/bin/sh -e + +if [ "$1" = "remove" ] || [ "$1" = "deconfigure" ] ; then + rm -f /var/lib/update-notifier/user.d/moodle-reconfigure-required +fi + +#DEBHELPER# + +exit 0 --- moodle-1.8.2.orig/debian/patches/mdl12079_essayquestions.dpatch +++ moodle-1.8.2/debian/patches/mdl12079_essayquestions.dpatch @@ -0,0 +1,20 @@ +#! /bin/sh /usr/share/dpatch/dpatch-run +## mdl12079_essayquestions.dpatch by Kees Cook +## +## All lines beginning with `## DP:' are a description of the patch. +## DP: Insufficient cleaning of essay questions (MDL-12079). +## DP: Thanks to Dan Poltawski. + +@DPATCH@ +diff -Nru moodle-1.8.2/question/type/essay/questiontype.php moodle-1.8.2.dfsg/question/type/essay/questiontype.php +--- moodle-1.8.2/question/type/essay/questiontype.php 2007-02-18 18:20:38.000000000 -0800 ++++ moodle-1.8.2.dfsg/question/type/essay/questiontype.php 2009-02-12 11:09:06.000000000 -0800 +@@ -107,7 +107,7 @@ + function grade_responses(&$question, &$state, $cmoptions) { + // All grading takes place in Manual Grading + +- clean_param($state->responses[''], PARAM_CLEANHTML); ++ $state->responses[''] = clean_param($state->responses[''], PARAM_CLEAN); + + $state->raw_grade = 0; + $state->penalty = 0; --- moodle-1.8.2.orig/debian/patches/msa080023_message-csrf.dpatch +++ moodle-1.8.2/debian/patches/msa080023_message-csrf.dpatch @@ -0,0 +1,30 @@ +#! /bin/sh /usr/share/dpatch/dpatch-run +## msa080023_message-csrf.dpatch by Kees Cook +## +## All lines beginning with `## DP:' are a description of the patch. +## DP: Fix CSRF in messaging settings (MSA-08-0023). +## DP: Thanks to Dan Poltawski. + +@DPATCH@ +diff -Nru moodle-1.8.2/message/lib.php moodle-1.8.2.dfsg/message/lib.php +--- moodle-1.8.2/message/lib.php 2007-01-12 18:03:15.000000000 -0800 ++++ moodle-1.8.2.dfsg/message/lib.php 2009-02-12 11:09:06.000000000 -0800 +@@ -263,7 +263,7 @@ + function message_print_settings() { + global $USER; + +- if ($frm = data_submitted()) { ++ if ($frm = data_submitted() and confirm_sesskey()) { + + $pref = array(); + $pref['message_showmessagewindow'] = (isset($frm->showmessagewindow)) ? '1' : '0'; +diff -Nru moodle-1.8.2/message/settings.html moodle-1.8.2.dfsg/message/settings.html +--- moodle-1.8.2/message/settings.html 2007-01-04 18:02:45.000000000 -0800 ++++ moodle-1.8.2.dfsg/message/settings.html 2009-02-12 11:09:06.000000000 -0800 +@@ -1,5 +1,6 @@ +
+ ++ + + + --- moodle-1.8.2.orig/debian/patches/fixdiscuss.dpatch +++ moodle-1.8.2/debian/patches/fixdiscuss.dpatch @@ -0,0 +1,18 @@ +#! /bin/sh /usr/share/dpatch/dpatch-run +## fixdiscuss.dpatch by Isaac Clerencia +## +## All lines beginning with `## DP:' are a description of the patch. +## DP: No description. + +@DPATCH@ +diff -urNad moodle-1.6.3~/mod/forum/discuss.php moodle-1.6.3/mod/forum/discuss.php +--- moodle-1.6.3~/mod/forum/discuss.php 2006-10-03 04:13:13.000000000 +0200 ++++ moodle-1.6.3/mod/forum/discuss.php 2006-12-14 14:13:32.000000000 +0100 +@@ -112,6 +112,7 @@ + if (abs($displaymode) == 1) { // If flat AND parent, then force nested display this time + $displaymode = 3; + } ++ $navtail = ''; + } else { + $parent = $discussion->firstpost; + $navtail = format_string($discussion->name); --- moodle-1.8.2.orig/debian/patches/msa090004.dpatch +++ moodle-1.8.2/debian/patches/msa090004.dpatch @@ -0,0 +1,62 @@ +#! /bin/sh /usr/share/dpatch/dpatch-run +## msa090004.dpatch by Francois Marier +## +## All lines beginning with `## DP:' are a description of the patch. +## DP: html block: proper cleanup of html + +@DPATCH@ +diff --git a/blocks/html/block_html.php b/blocks/html/block_html.php +index ff53961..7099a43 100755 +--- a/blocks/html/block_html.php ++++ b/blocks/html/block_html.php +@@ -12,7 +12,7 @@ class block_html extends block_base { + } + + function specialization() { +- $this->title = isset($this->config->title) ? $this->config->title : get_string('newhtmlblock', 'block_html'); ++ $this->title = isset($this->config->title) ? format_string($this->config->title) : get_string('newhtmlblock', 'block_html'); + } + + function instance_allow_multiple() { +@@ -24,8 +24,13 @@ class block_html extends block_base { + return $this->content; + } + +- $filteropt = new stdClass; +- $filteropt->noclean = true; ++ if (!empty($this->instance->pinned) or $this->instance->pagetype === 'course-view') { ++ // fancy html allowed only on course page and in pinned blocks for security reasons ++ $filteropt = new stdClass; ++ $filteropt->noclean = true; ++ } else { ++ $filteropt = null; ++ } + + $this->content = new stdClass; + $this->content->text = isset($this->config->text) ? format_text($this->config->text, FORMAT_HTML, $filteropt) : ''; +diff --git a/blocks/html/config_instance.html b/blocks/html/config_instance.html +index 8138488..ae2d460 100755 +--- a/blocks/html/config_instance.html ++++ b/blocks/html/config_instance.html +@@ -1,4 +1,11 @@ +- ++config->text) ? $this->config->text : ''; ++ if (empty($this->instance->pinned) and $this->instance->pagetype !== 'course-view') { ++ $text = clean_text($text, FORMAT_HTML); ++ } ++?> +
+ + +@@ -6,7 +13,7 @@ + + + +- ++ + + + '; + if ($course->id == SITEID) { +@@ -610,7 +610,7 @@ + + $log->url = strip_tags(urldecode($log->url)); // Some XSS protection + $log->info = strip_tags(urldecode($log->info)); // Some XSS protection +- $log->url = str_replace('&', '&', $log->url); /// XHTML compatibility ++ $log->url = s($log->url); /// XSS protection and XHTML compatibility - should be in link_to_popup_window() instead!! + + echo ''; + if ($course->id == SITEID) { --- moodle-1.8.2.orig/debian/patches/CVE-2008-1502.dpatch +++ moodle-1.8.2/debian/patches/CVE-2008-1502.dpatch @@ -0,0 +1,41 @@ +#! /bin/sh /usr/share/dpatch/dpatch-run +## CVE-2008-1502.dpatch by Kees Cook +## +## All lines beginning with `## DP:' are a description of the patch. +## DP: Upstream: http://tracker.moodle.org/browse/MDL-13705 +## DP: http://cvs.moodle.org/moodle/lib/kses.php?r1=1.3.8.2&r2=1.3.8.3 +## DP: http://cvs.moodle.org/moodle/lib/weblib.php?r1=1.812.2.99&r2=1.812.2.100 +## DP: Thanks to Nico Golde. + +@DPATCH@ +diff -urNad moodle-1.8.2~/lib/kses.php moodle-1.8.2/lib/kses.php +--- moodle-1.8.2~/lib/kses.php 2006-03-02 18:01:53.000000000 -0800 ++++ moodle-1.8.2/lib/kses.php 2008-10-22 13:46:01.000000000 -0700 +@@ -469,10 +469,12 @@ + # handling whitespace and HTML entities. + ############################################################################### + { +- return preg_replace('/^((&[^;]*;|[\sA-Za-z0-9])*)'. +- '(:|�*58;|&#[Xx]3[Aa];)\s*/e', +- 'kses_bad_protocol_once2("\\1", $allowed_protocols)', +- $string); ++ $string2 = preg_split('/:|:|:/i', $string, 2); ++ if(isset($string2[1]) && !preg_match('%/\?%',$string2[0])) ++ { ++ $string = kses_bad_protocol_once2($string2[0],$allowed_protocols).trim($string2[1]); ++ } ++ return $string; + } # function kses_bad_protocol_once + + +diff -urNad moodle-1.8.2~/lib/weblib.php moodle-1.8.2/lib/weblib.php +--- moodle-1.8.2~/lib/weblib.php 2007-07-03 19:55:40.000000000 -0700 ++++ moodle-1.8.2/lib/weblib.php 2008-10-22 13:46:01.000000000 -0700 +@@ -1758,6 +1758,7 @@ + } + $arreach['value'] = preg_replace("/j\s*a\s*v\s*a\s*s\s*c\s*r\s*i\s*p\s*t/i", "Xjavascript", $arreach['value']); + $arreach['value'] = preg_replace("/e\s*x\s*p\s*r\s*e\s*s\s*s\s*i\s*o\s*n/i", "Xexpression", $arreach['value']); ++ $arreach['value'] = preg_replace("/b\s*i\s*n\s*d\s*i\s*n\s*g/i", "Xbinding", $arreach['value']); + } else if ($arreach['name'] == 'href') { + //Adobe Acrobat Reader XSS protection + $arreach['value'] = preg_replace('/(\.(pdf|fdf|xfdf|xdp|xfd))[^a-z0-9_\.\-].*$/i', '$1', $arreach['value']); --- moodle-1.8.2.orig/debian/patches/msa090002.dpatch +++ moodle-1.8.2/debian/patches/msa090002.dpatch @@ -0,0 +1,29 @@ +#! /bin/sh /usr/share/dpatch/dpatch-run +## msa090002.dpatch by Francois Marier +## +## All lines beginning with `## DP:' are a description of the patch. +## DP: protect user profile images if $CFG->forcelogin enabled + +@DPATCH@ +diff --git a/user/pix.php b/user/pix.php +index b3509ef..d37d18b 100644 +--- a/user/pix.php ++++ b/user/pix.php +@@ -3,11 +3,15 @@ + // Syntax: pix.php/userid/f1.jpg or pix.php/userid/f2.jpg + // OR: ?file=userid/f1.jpg or ?file=userid/f2.jpg + +- $nomoodlecookie = true; // Because it interferes with caching +- + require_once('../config.php'); + require_once($CFG->libdir.'/filelib.php'); + ++ if (!empty($CFG->forcelogin) and !isloggedin()) { ++ // protect images if login required and not logged in; ++ // do not use require_login() because it is expensive and not suitable here anyway ++ redirect($CFG->pixpath.'/u/f1.png'); ++ } ++ + // disable moodle specific debug messages + disable_debugging(); + --- moodle-1.8.2.orig/debian/patches/msa08003_login-as.dpatch +++ moodle-1.8.2/debian/patches/msa08003_login-as.dpatch @@ -0,0 +1,22 @@ +#! /bin/sh /usr/share/dpatch/dpatch-run +## msa08003_login-as.dpatch by Kees Cook +## +## All lines beginning with `## DP:' are a description of the patch. +## DP: Fix insufficient access control in "Login as" feature (MSA-08-0003). +## DP: Thanks to Dan Poltawski. + +@DPATCH@ +diff -Nru moodle-1.8.2/course/loginas.php moodle-1.8.2.dfsg/course/loginas.php +--- moodle-1.8.2/course/loginas.php 2007-03-19 19:28:12.000000000 -0700 ++++ moodle-1.8.2.dfsg/course/loginas.php 2009-02-12 11:09:06.000000000 -0800 +@@ -57,8 +57,9 @@ + print_error('nologinas'); + } + $context = $systemcontext; +- } else if (has_capability('moodle/user:loginas', $coursecontext)) { ++ } else { + require_login($course); ++ require_capability('moodle/user:loginas', $coursecontext); + if (!has_capability('moodle/course:view', $coursecontext, $userid, false)) { + error('This user is not in this course!'); + } --- moodle-1.8.2.orig/debian/patches/MDL-11857_restore.dpatch +++ moodle-1.8.2/debian/patches/MDL-11857_restore.dpatch @@ -0,0 +1,40 @@ +#! /bin/sh /usr/share/dpatch/dpatch-run +## MDL-11857_restore.dpatch by Kees Cook +## +## All lines beginning with `## DP:' are a description of the patch. +## DP: Fix SQL injection bug in restore (MDL-11857). +## DP: Thanks to Dan Poltawski. + +@DPATCH@ +diff -Nru moodle-1.8.2/backup/restorelib.php moodle-1.8.2.dfsg/backup/restorelib.php +--- moodle-1.8.2/backup/restorelib.php 2007-06-14 19:40:00.000000000 -0700 ++++ moodle-1.8.2.dfsg/backup/restorelib.php 2009-02-12 11:09:06.000000000 -0800 +@@ -1576,17 +1576,8 @@ + if ($create_user) { + //Unset the id because it's going to be inserted with a new one + unset ($user->id); +- //We addslashes to necessary fields +- $user->username = addslashes($user->username); +- $user->firstname = addslashes($user->firstname); +- $user->lastname = addslashes($user->lastname); +- $user->email = addslashes($user->email); +- $user->institution = addslashes($user->institution); +- $user->department = addslashes($user->department); +- $user->address = addslashes($user->address); +- $user->city = addslashes($user->city); +- $user->url = addslashes($user->url); +- $user->description = restore_decode_absolute_links(addslashes($user->description)); ++ // relink the descriptions ++ $user->description = restore_decode_absolute_links($user->description); + + //We need to analyse the AUTH field to recode it: + // - if the field isn't set, we are in a pre 1.4 backup and we'll +@@ -1618,7 +1609,7 @@ + + //We are going to create the user + //The structure is exactly as we need +- $newid = insert_record ("user",$user); ++ $newid = insert_record ("user", addslashes_recursive($user)); + //Put the new id + $status = backup_putid($restore->backup_unique_code,"user",$userid,$newid,"new"); + } --- moodle-1.8.2.orig/debian/patches/msa080010_hotpot.dpatch +++ moodle-1.8.2/debian/patches/msa080010_hotpot.dpatch @@ -0,0 +1,30 @@ +#! /bin/sh /usr/share/dpatch/dpatch-run +## msa080010_hotpot.dpatch by Kees Cook +## +## All lines beginning with `## DP:' are a description of the patch. +## DP: Patch SQL injection bug in hotpot module (MSA-08-0010). +## DP: Thanks to Dan Poltawski. + +@DPATCH@ +diff -Nru moodle-1.8.2/mod/hotpot/report.php moodle-1.8.2.dfsg/mod/hotpot/report.php +--- moodle-1.8.2/mod/hotpot/report.php 2007-05-15 19:47:39.000000000 -0700 ++++ moodle-1.8.2.dfsg/mod/hotpot/report.php 2009-02-12 11:09:06.000000000 -0800 +@@ -366,10 +366,14 @@ + $select = "hotpot='$hotpot->id' AND status=".HOTPOT_STATUS_ABANDONED; + break; + case 'selection': +- $ids = (array)data_submitted(); +- unset($ids['del']); +- unset($ids['id']); +- if (!empty($ids)) { ++ $ids = array(); ++ $data = (array)data_submitted(); ++ foreach ($data as $name => $value) { ++ if (preg_match('/^box\d+$/', $name)) { ++ $ids[] = intval($value); ++ } ++ } ++ if (count($ids)) { + $select = "hotpot='$hotpot->id' AND clickreportid IN (".implode(',', $ids).")"; + } + break; --- moodle-1.8.2.orig/debian/patches/msa090001.dpatch +++ moodle-1.8.2/debian/patches/msa090001.dpatch @@ -0,0 +1,29 @@ +#! /bin/sh /usr/share/dpatch/dpatch-run +## msa090001.dpatch by Francois Marier +## +## All lines beginning with `## DP:' are a description of the patch. +## DP: user: profile images of deleted users are not accessible anymore + +@DPATCH@ +diff --git a/user/pix.php b/user/pix.php +index 8eb3c09..b3509ef 100644 +--- a/user/pix.php ++++ b/user/pix.php +@@ -17,10 +17,13 @@ + + if (count($args) == 2) { + $userid = (integer)$args[0]; +- $image = $args[1]; +- $pathname = $CFG->dataroot.'/users/'.$userid.'/'.$image; +- if (file_exists($pathname) and !is_dir($pathname)) { +- send_file($pathname, $image); ++ // do not serve images of deleted users ++ if ($user = get_record('user', 'id', $userid, 'deleted', 0, 'picture', 1)) { ++ $image = $args[1]; ++ $pathname = $CFG->dataroot.'/users/'.$userid.'/'.$image; ++ if (file_exists($pathname) and !is_dir($pathname)) { ++ send_file($pathname, $image); ++ } + } + } + --- moodle-1.8.2.orig/debian/patches/msa090007.dpatch +++ moodle-1.8.2/debian/patches/msa090007.dpatch @@ -0,0 +1,100 @@ +#! /bin/sh /usr/share/dpatch/dpatch-run +## msa090007.dpatch by Francois Marier +## +## All lines beginning with `## DP:' are a description of the patch. +## DP: proper log url sanitisation + +@DPATCH@ +diff --git a/course/lib.php b/course/lib.php +index c8c36d2..031d39f 100644 +--- a/course/lib.php ++++ b/course/lib.php +@@ -244,21 +244,50 @@ function make_log_url($module, $url) { + case 'message': + case 'calendar': + case 'blog': +- return "/$module/$url"; ++ if (strpos($url, '../') === 0) { ++ $url = ltrim($url, '.'); ++ } else { ++ $url = "/course/$url"; ++ } + break; + case 'upload': +- return $url; ++ $url = $url; + break; + case 'library': + case '': +- return '/'; ++ $url = '/'; + break; + default: +- return "/mod/$module/$url"; ++ $url = "/mod/$module/$url"; + break; + } +-} + ++ //now let's sanitise urls - there might be some ugly nasties:-( ++ $parts = explode('?', $url); ++ $script = array_shift($parts); ++ if (strpos($script, 'http') === 0) { ++ $script = clean_param($script, PARAM_URL); ++ } else { ++ $script = clean_param($script, PARAM_PATH); ++ } ++ $script = htmlspecialchars($script); ++ ++ $query = ''; ++ if ($parts) { ++ $query = implode('', $parts); ++ $query = str_replace('&', '&', $query); // both & and & are stored in db :-| ++ $parts = explode('&', $query); ++ $eq = urlencode('='); ++ foreach ($parts as $key=>$part) { ++ $part = urlencode(urldecode($part)); ++ $part = str_replace($eq, '=', $part); ++ $parts[$key] = $part; ++ } ++ $query = '?'.implode('&', $parts); ++ } ++ ++ return $script.$query; ++} + + function build_mnet_logs_array($hostid, $course, $user=0, $date=0, $order="l.time ASC", $limitfrom='', $limitnum='', + $modname="", $modid=0, $modaction="", $groupid=0) { +@@ -504,10 +532,6 @@ function print_log($course, $user=0, $date=0, $order="l.time ASC", $page=0, $per + //Filter log->info + $log->info = format_string($log->info); + +- $log->url = strip_tags(urldecode($log->url)); // Some XSS protection +- $log->info = strip_tags(urldecode($log->info)); // Some XSS protection +- $log->url = s($log->url); /// XSS protection and XHTML compatibility - should be in link_to_popup_window() instead!! +- + echo ''; + if ($course->id == SITEID) { + echo "'; + if ($course->id == SITEID) { + echo " + + + + + + + + + + + + + + + + + + + + +@@ -840,7 +841,7 @@ + + + + + --- moodle-1.8.2.orig/debian/patches/CVE-2008-4796_snoopy.dpatch +++ moodle-1.8.2/debian/patches/CVE-2008-4796_snoopy.dpatch @@ -0,0 +1,21 @@ +#! /bin/sh /usr/share/dpatch/dpatch-run +## CVE-2008-4796_snoopy.dpatch by Kees Cook +## +## All lines beginning with `## DP:' are a description of the patch. +## DP: Patch snoopy input sanitising (CVE-2008-4796). +## DP: Thanks to Francois Marier. + +@DPATCH@ +diff -Nru moodle-1.8.2/lib/snoopy/Snoopy.class.inc moodle-1.8.2.dfsg/lib/snoopy/Snoopy.class.inc +--- moodle-1.8.2/lib/snoopy/Snoopy.class.inc 2006-03-21 18:02:00.000000000 -0800 ++++ moodle-1.8.2.dfsg/lib/snoopy/Snoopy.class.inc 2009-02-12 11:09:06.000000000 -0800 +@@ -1013,8 +1013,7 @@ + + $headerfile = tempnam($temp_dir, "sno"); + +- $safer_URI = strtr( $URI, "\"", " " ); // strip quotes from the URI to avoid shell access +- exec($this->curl_path." -D \"$headerfile\"".$cmdline_params." \"".$safer_URI."\"",$results,$return); ++ exec($this->curl_path." -k -D \"$headerfile\"".$cmdline_params." \"".escapeshellcmd($URI)."\"",$results,$return); + + if($return) + { --- moodle-1.8.2.orig/debian/patches/msa090006_CVE-2009-0501_calendar.dpatch +++ moodle-1.8.2/debian/patches/msa090006_CVE-2009-0501_calendar.dpatch @@ -0,0 +1,26 @@ +#! /bin/sh /usr/share/dpatch/dpatch-run +## msa090006_CVE-2009-0501_calendar.dpatch by Kees Cook +## +## All lines beginning with `## DP:' are a description of the patch. +## DP: Backport upstream fix for calendar export leakage. +## DP: MSA-09-0006 / CVE-2009-0501, Thanks to Francois Marier. + +@DPATCH@ +diff -Nru moodle-1.8.2/calendar/export_execute.php moodle-1.8.2.dfsg/calendar/export_execute.php +--- moodle-1.8.2/calendar/export_execute.php 2007-06-19 23:33:11.000000000 -0700 ++++ moodle-1.8.2.dfsg/calendar/export_execute.php 2009-02-12 11:09:06.000000000 -0800 +@@ -11,12 +11,12 @@ + //Fetch user information + if (!$user = get_complete_user_data('username', $username)) { + //No such user +- die("No such user '$username'"); ++ die('Invalid authentication'); + } + + //Check authentication token + if ($authtoken != sha1($username . $user->password)) { +- die('Invalid authentication token'); ++ die('Invalid authentication'); + } + + $what = optional_param('preset_what', 'all', PARAM_ALPHA); --- moodle-1.8.2.orig/debian/patches/html2text-update.dpatch +++ moodle-1.8.2/debian/patches/html2text-update.dpatch @@ -0,0 +1,772 @@ +#! /bin/sh /usr/share/dpatch/dpatch-run +## html2text-update.dpatch by Kees Cook +## +## All lines beginning with `## DP:' are a description of the patch. +## DP: Update html2text to prevent code execution attacks. +## DP: Thanks to Francois Marier. + +@DPATCH@ +diff -Nru moodle-1.8.2/lib/html2text.php moodle-1.8.2.dfsg/lib/html2text.php +--- moodle-1.8.2/lib/html2text.php 2005-03-26 21:50:21.000000000 -0800 ++++ moodle-1.8.2.dfsg/lib/html2text.php 2009-02-12 11:09:06.000000000 -0800 +@@ -1,169 +1,595 @@ + ') && +- strpos($badStr, '-->', strpos($badStr, '', +- strpos( $badStr, '/', // Comments -- which strip_tags might have problem a with ++ '/]*>/i', //

++ '/]*>/i', //
++ '/]*>(.*?)<\/i>/i', // ++ '/]*>(.*?)<\/em>/i', // ++ '/(]*>|<\/ul>)/i', //

    and
++ '/(]*>|<\/ol>)/i', //
    and
++ '/]*>(.*?)<\/li>/i', //
  • and
    • ++ '/]*>/i', //
  • ++ '/]*>/i', //
    ++ '/(]*>|<\/table>)/i', //
    • :
    :config->text)?$this->config->text:'') ?>
    --- moodle-1.8.2.orig/debian/patches/msa080015_deleted-user-profiles.dpatch +++ moodle-1.8.2/debian/patches/msa080015_deleted-user-profiles.dpatch @@ -0,0 +1,20 @@ +#! /bin/sh /usr/share/dpatch/dpatch-run +## msa080015_deleted-user-profiles.dpatch by Kees Cook +## +## All lines beginning with `## DP:' are a description of the patch. +## DP: Profiles of deleted users were accessible allowing for spam (MSA-08-0015). +## DP: Thanks to Dan Poltawski. + +@DPATCH@ +diff -Nru moodle-1.8.2/user/view.php moodle-1.8.2.dfsg/user/view.php +--- moodle-1.8.2/user/view.php 2007-05-06 20:16:29.000000000 -0700 ++++ moodle-1.8.2.dfsg/user/view.php 2009-02-12 11:09:06.000000000 -0800 +@@ -146,6 +146,8 @@ + + if ($user->deleted) { + print_heading(get_string('userdeleted')); ++ print_footer($course); ++ die; + } + + /// OK, security out the way, now we are showing the user --- moodle-1.8.2.orig/debian/patches/CVE-2009-1171.dpatch +++ moodle-1.8.2/debian/patches/CVE-2009-1171.dpatch @@ -0,0 +1,191 @@ +#! /bin/sh /usr/share/dpatch/dpatch-run +## CVE-2009-1171.dpatch by Nico Golde +## +## All lines beginning with `## DP:' are a description of the patch. +## DP: No description. + +@DPATCH@ +diff -urNad moodle-1.8.2.dfsg~/filter/algebra/algebradebug.php moodle-1.8.2.dfsg/filter/algebra/algebradebug.php +--- moodle-1.8.2.dfsg~/filter/algebra/algebradebug.php 2007-03-15 03:29:15.000000000 +0100 ++++ moodle-1.8.2.dfsg/filter/algebra/algebradebug.php 2009-04-01 13:45:45.000000000 +0200 +@@ -16,6 +16,8 @@ + } + } + ++ require_once($CFG->dirroot.'/filter/tex/lib.php'); ++ + $CFG->texfilterdir = "filter/tex"; + $CFG->algebrafilterdir = "filter/algebra"; + $CFG->algebraimagedir = "filter/algebra"; +@@ -233,6 +235,7 @@ + } + $commandpath = ""; + $cmd = ""; ++ $texexp = tex_sanitize_formula($texexp); + $texexp = escapeshellarg($texexp); + switch (PHP_OS) { + case "Linux": +diff -urNad moodle-1.8.2.dfsg~/filter/algebra/pix.php moodle-1.8.2.dfsg/filter/algebra/pix.php +--- moodle-1.8.2.dfsg~/filter/algebra/pix.php 2007-03-15 03:29:15.000000000 +0100 ++++ moodle-1.8.2.dfsg/filter/algebra/pix.php 2009-04-01 13:46:09.000000000 +0200 +@@ -18,6 +18,7 @@ + + // disable moodle specific debug messages + disable_debugging(); ++ require_once($CFG->dirroot.'/filter/tex/lib.php'); + + require_once($CFG->libdir.'/filelib.php'); + +@@ -54,6 +55,7 @@ + $texexp = str_replace('>','>',$texexp); + $texexp = preg_replace('!\r\n?!',' ',$texexp); + $texexp = '\Large ' . $texexp; ++ $texexp = tex_sanitize_formula($texexp); + $texexp = escapeshellarg($texexp); + + if ((PHP_OS == "WINNT") || (PHP_OS == "WIN32") || (PHP_OS == "Windows")) { +diff -urNad moodle-1.8.2.dfsg~/filter/tex/latex.php moodle-1.8.2.dfsg/filter/tex/latex.php +--- moodle-1.8.2.dfsg~/filter/tex/latex.php 2006-05-22 04:00:42.000000000 +0200 ++++ moodle-1.8.2.dfsg/filter/tex/latex.php 2009-04-01 13:46:57.000000000 +0200 +@@ -44,9 +44,10 @@ + * @return string the latex document + */ + function construct_latex_document( $formula, $fontsize=12 ) { +- // $fontsize don't affects to formula's size. $density can change size + + global $CFG; ++ ++ $formula = tex_sanitize_formula($formula); + $doc = "\\documentclass[{$fontsize}pt]{article}\n"; + $doc .= $CFG->filter_tex_latexpreamble; + $doc .= "\\pagestyle{empty}\n"; +diff -urNad moodle-1.8.2.dfsg~/filter/tex/lib.php moodle-1.8.2.dfsg/filter/tex/lib.php +--- moodle-1.8.2.dfsg~/filter/tex/lib.php 1970-01-01 01:00:00.000000000 +0100 ++++ moodle-1.8.2.dfsg/filter/tex/lib.php 2009-04-01 13:48:13.000000000 +0200 +@@ -0,0 +1,37 @@ ++dataroot/filter/tex")) { ++ remove_dir("$CFG->dataroot/filter/tex"); ++ } ++ if (file_exists("$CFG->dataroot/filter/algebra")) { ++ remove_dir("$CFG->dataroot/filter/algebra"); ++ } ++ if (file_exists("$CFG->dataroot/temp/latex")) { ++ remove_dir("$CFG->dataroot/temp/latex"); ++ } ++ ++ delete_records('cache_filters', 'filter', 'tex'); ++ delete_records('cache_filters', 'filter', 'algebra'); ++} ++ ++?> +diff -urNad moodle-1.8.2.dfsg~/filter/tex/pix.php moodle-1.8.2.dfsg/filter/tex/pix.php +--- moodle-1.8.2.dfsg~/filter/tex/pix.php 2007-03-15 03:29:16.000000000 +0100 ++++ moodle-1.8.2.dfsg/filter/tex/pix.php 2009-04-01 13:49:11.000000000 +0200 +@@ -20,8 +20,9 @@ + disable_debugging(); + + require_once($CFG->libdir.'/filelib.php'); ++ require_once($CFG->dirroot.'/filter/tex/lib.php'); ++ require_once($CFG->dirroot.'/filter/tex/latex.php'); + require_once('defaultsettings.php' ); +- require_once('latex.php'); + + $CFG->texfilterdir = 'filter/tex'; + $CFG->teximagedir = 'filter/tex'; +@@ -68,6 +69,7 @@ + $texexp = str_replace('>','>',$texexp); + $texexp = preg_replace('!\r\n?!',' ',$texexp); + $texexp = '\Large ' . $texexp; ++ $texexp = tex_sanitize_formula($texexp); + $texexp = escapeshellarg($texexp); + + if ((PHP_OS == "WINNT") || (PHP_OS == "WIN32") || (PHP_OS == "Windows")) { +diff -urNad moodle-1.8.2.dfsg~/filter/tex/texdebug.php moodle-1.8.2.dfsg/filter/tex/texdebug.php +--- moodle-1.8.2.dfsg~/filter/tex/texdebug.php 2007-03-15 03:29:16.000000000 +0100 ++++ moodle-1.8.2.dfsg/filter/tex/texdebug.php 2009-04-01 13:52:03.000000000 +0200 +@@ -16,6 +16,9 @@ + } + } + ++ require_once($CFG->dirroot.'/filter/tex/lib.php'); ++ require_once($CFG->dirroot.'/filter/tex/latex.php'); ++ + $CFG->texfilterdir = "filter/tex"; + $CFG->teximagedir = "filter/tex"; + +@@ -111,6 +114,7 @@ + } + $commandpath = ""; + $cmd = ""; ++ $texexp = tex_sanitize_formula($texexp); + $texexp = escapeshellarg($texexp); + switch (PHP_OS) { + case "Linux": +diff -urNad moodle-1.8.2.dfsg~/filter/tex/texed.php moodle-1.8.2.dfsg/filter/tex/texed.php +--- moodle-1.8.2.dfsg~/filter/tex/texed.php 2007-03-15 03:29:16.000000000 +0100 ++++ moodle-1.8.2.dfsg/filter/tex/texed.php 2009-04-01 13:52:26.000000000 +0200 +@@ -6,6 +6,7 @@ + $nomoodlecookie = true; // Because it interferes with caching + + require_once("../../config.php"); ++ require_once($CFG->dirroot.'/filter/tex/lib.php'); + + if (empty($CFG->textfilters)) { + error ('Filter not enabled!'); +@@ -32,6 +33,7 @@ + make_upload_directory($CFG->teximagedir); + } + $pathname = "$CFG->dataroot/$CFG->teximagedir/$image"; ++ $texexp = tex_sanitize_formula($texexp); + $texexp = escapeshellarg($texexp); + + switch (PHP_OS) { +diff -urNad moodle-1.8.2.dfsg~/lib/db/upgrade.php moodle-1.8.2.dfsg/lib/db/upgrade.php +--- moodle-1.8.2.dfsg~/lib/db/upgrade.php 2007-07-07 05:36:35.000000000 +0200 ++++ moodle-1.8.2.dfsg/lib/db/upgrade.php 2009-04-01 13:56:40.000000000 +0200 +@@ -697,6 +697,11 @@ + set_field('user', 'mnethostid', $CFG->mnet_localhost_id, 'username', 'guest'); + } + ++ if ($result && $oldversion < 2007021581) { ++ require_once("$CFG->dirroot/filter/tex/lib.php"); ++ filter_tex_updatedcallback(null); ++ } ++ + return $result; + + } +diff -urNad moodle-1.8.2.dfsg~/version.php moodle-1.8.2.dfsg/version.php +--- moodle-1.8.2.dfsg~/version.php 2007-07-08 15:51:07.000000000 +0200 ++++ moodle-1.8.2.dfsg/version.php 2009-04-01 13:57:06.000000000 +0200 +@@ -6,7 +6,7 @@ + // This is compared against the values stored in the database to determine + // whether upgrades should be performed (see lib/db/*.php) + +- $version = 2007021520; // YYYYMMDD = date of the 1.8 branch (don't change) ++ $version = 2007021581; // YYYYMMDD = date of the 1.8 branch (don't change) + // X = release number 1.8.[0,1,2,3...] + // Y = micro-increments between releases + --- moodle-1.8.2.orig/debian/patches/mdl14806_wiki-params.dpatch +++ moodle-1.8.2/debian/patches/mdl14806_wiki-params.dpatch @@ -0,0 +1,67 @@ +#! /bin/sh /usr/share/dpatch/dpatch-run +## mdl14806_wiki-params.dpatch by Kees Cook +## +## All lines beginning with `## DP:' are a description of the patch. +## DP: Fix uncleaned params in wiki (MDL-14806). +## DP: Thanks to Dan Poltawski. + +@DPATCH@ +diff -Nru moodle-1.8.2/mod/wiki/view.php moodle-1.8.2.dfsg/mod/wiki/view.php +--- moodle-1.8.2/mod/wiki/view.php 2007-03-01 18:34:23.000000000 -0800 ++++ moodle-1.8.2.dfsg/mod/wiki/view.php 2009-02-12 11:09:06.000000000 -0800 +@@ -14,7 +14,7 @@ + $id = optional_param('id', 0, PARAM_INT); // Course Module ID, or + $wid = optional_param('wid', 0, PARAM_INT); // Wiki ID + $page = optional_param('page', false); // Wiki Page Name +- $q = optional_param('q',""); // Search Context ++ $q = optional_param('q',"", PARAM_PATH); // Search Context + $userid = optional_param('userid', 0, PARAM_INT); // User wiki. + $groupid = optional_param('groupid', 0, PARAM_INT); // Group wiki. + $canceledit = optional_param('canceledit','', PARAM_ALPHA); // Editing has been cancelled +@@ -59,8 +59,6 @@ + if (! $cm = get_coursemodule_from_instance("wiki", $wiki->id, $course->id)) { + error("Course Module ID was incorrect"); + } +- $id = $cm->id; +- $_REQUEST["id"] = $id; + } + + require_course_login($course, true, $cm); +@@ -71,9 +69,6 @@ + /// Default format: + $moodle_format=FORMAT_MOODLE; + +- ### SAVE ID from Moodle +- $moodleID=@$_REQUEST["id"]; +- + /// Globally disable CamelCase, if the option is selected for this wiki. + $moodle_disable_camel_case = ($wiki->disablecamelcase == 1); + +@@ -138,7 +133,7 @@ + + /// Build the ewsiki script constant + /// ewbase will also be needed by EWIKI_SCRIPT_BINARY +- $ewbase = 'view.php?id='.$moodleID; ++ $ewbase = 'view.php?id='.$cm->id; + if (isset($userid) && $userid!=0) $ewbase .= '&userid='.$userid; + if (isset($groupid) && $groupid!=0) $ewbase .= '&groupid='.$groupid; + $ewscript = $ewbase.'&page='; +@@ -247,9 +242,6 @@ + $content=ewiki_page($page); + $content2=''; + +- ### RESTORE ID from Moodle +- $_REQUEST["id"]=$moodleID; +- $id=$moodleID; + /// ################# EWIKI Part ########################### + } + else { +@@ -377,7 +369,7 @@ + $currenttab = ''; + foreach ($tabs as $tab) { + $tabname = get_string("tab$tab", 'wiki'); +- $row[] = new tabobject($tabname, $ewbase.'&page='.$tab.'/'.$ewiki_id, $tabname); ++ $row[] = new tabobject($tabname, $ewbase.'&page='.$tab.'/'.s($ewiki_id), $tabname); + if ($ewiki_action == "$tab" or in_array($page, $specialpages)) { + $currenttab = $tabname; + } --- moodle-1.8.2.orig/debian/patches/smarty_dollar_sign.dpatch +++ moodle-1.8.2/debian/patches/smarty_dollar_sign.dpatch @@ -0,0 +1,20 @@ +#! /bin/sh /usr/share/dpatch/dpatch-run +## CVE-2008-4810_smarty-templates.dpatch by Kees Cook +## +## All lines beginning with `## DP:' are a description of the patch. +## DP: Description: Smarty template compiler update (CVE-2008-4810). +## DP: Patch: http://code.google.com/p/smarty-php/source/diff?spec=svn2797&r=2797&format=side&path=/trunk/libs/Smarty_Compiler.class.php + +@DPATCH@ +diff -urNad moodle-1.8.2~/lib/smarty/Smarty_Compiler.class.php moodle-1.8.2/lib/smarty/Smarty_Compiler.class.php +--- moodle-1.8.2~/lib/smarty/Smarty_Compiler.class.php 2005-04-19 02:52:15.000000000 -0700 ++++ moodle-1.8.2/lib/smarty/Smarty_Compiler.class.php 2009-06-19 17:03:20.000000000 -0700 +@@ -1670,6 +1670,8 @@ + } + // replace double quoted literal string with single quotes + $_return = preg_replace('~^"([\s\w]+)"$~',"'\\1'",$_return); ++ // escape dollar sign if not printing a var ++ $_return = preg_replace('~\$(\W)~',"\\\\\$\\1",$_return); + return $_return; + } + --- moodle-1.8.2.orig/debian/patches/msa090007_cleanup-prep.dpatch +++ moodle-1.8.2/debian/patches/msa090007_cleanup-prep.dpatch @@ -0,0 +1,29 @@ +#! /bin/sh /usr/share/dpatch/dpatch-run +## msa090007_cleanup-prep.dpatch by Kees Cook +## +## All lines beginning with `## DP:' are a description of the patch. +## DP: Improve the fix for log URL filtering as suggested by Steffen Joeris +## DP: (MSA-09-0007 / CVE-2009-0500). Thanks to Francois Marier. + +@DPATCH@ +diff -Nru moodle-1.8.2/course/lib.php moodle-1.8.2.dfsg/course/lib.php +--- moodle-1.8.2/course/lib.php 2007-06-19 23:33:16.000000000 -0700 ++++ moodle-1.8.2.dfsg/course/lib.php 2009-02-12 11:09:06.000000000 -0800 +@@ -503,7 +503,7 @@ + + $log->url = strip_tags(urldecode($log->url)); // Some XSS protection + $log->info = strip_tags(urldecode($log->info)); // Some XSS protection +- $log->url = str_replace('&', '&', $log->url); /// XHTML compatibility ++ $log->url = s($log->url); /// XSS protection and XHTML compatibility - should be in link_to_popup_window() instead!! + + echo '
    \n"; +@@ -615,10 +639,6 @@ function print_mnet_log($hostid, $course, $user=0, $date=0, $order="l.time ASC", + //Filter log->info + $log->info = format_string($log->info); + +- $log->url = strip_tags(urldecode($log->url)); // Some XSS protection +- $log->info = strip_tags(urldecode($log->info)); // Some XSS protection +- $log->url = s($log->url); /// XSS protection and XHTML compatibility - should be in link_to_popup_window() instead!! +- + echo '
    \n"; +@@ -710,10 +730,7 @@ function print_log_csv($course, $user, $date, $order='l.time DESC', $modname, + + //Filter log->info + $log->info = format_string($log->info); +- +- $log->url = strip_tags(urldecode($log->url)); // Some XSS protection + $log->info = strip_tags(urldecode($log->info)); // Some XSS protection +- $log->url = str_replace('&', '&', $log->url); // XHTML compatibility + + $firstField = $courses[$log->course]; + $fullname = fullname($log, has_capability('moodle/site:viewfullnames', get_context_instance(CONTEXT_COURSE, $course->id))); --- moodle-1.8.2.orig/debian/patches/smarty_math_backticks.dpatch +++ moodle-1.8.2/debian/patches/smarty_math_backticks.dpatch @@ -0,0 +1,20 @@ +#! /bin/sh /usr/share/dpatch/dpatch-run +## smarty_math_backticks.dpatch by Kees Cook +## +## All lines beginning with `## DP:' are a description of the patch. +## DP: Description: patches CVE-2009-1669 +## DP: Patch: http://groups.google.com/group/smarty-svn/browse_thread/thread/b2da2e5d1ef8b462 + +@DPATCH@ +diff -urNad moodle-1.8.2~/lib/smarty/plugins/function.math.php moodle-1.8.2/lib/smarty/plugins/function.math.php +--- moodle-1.8.2~/lib/smarty/plugins/function.math.php 2005-04-19 02:52:16.000000000 -0700 ++++ moodle-1.8.2/lib/smarty/plugins/function.math.php 2009-06-19 17:31:51.000000000 -0700 +@@ -27,6 +27,8 @@ + } + + $equation = $params['equation']; ++ // strip out backticks, not necessary for math ++ $equation = str_replace('`','',$params['equation']); + + // make sure parenthesis are balanced + if (substr_count($equation,"(") != substr_count($equation,")")) { --- moodle-1.8.2.orig/debian/patches/msa080004_install.dpatch +++ moodle-1.8.2/debian/patches/msa080004_install.dpatch @@ -0,0 +1,65 @@ +#! /bin/sh /usr/share/dpatch/dpatch-run +## msa080004_install.dpatch by Kees Cook +## +## All lines beginning with `## DP:' are a description of the patch. +## DP: Fix XSS bug in install script (MSA-08-0004). +## DP: Thanks to Dan Poltawski. + +@DPATCH@ +diff -Nru moodle-1.8.2/install.php moodle-1.8.2.dfsg/install.php +--- moodle-1.8.2/install.php 2007-06-20 19:26:23.000000000 -0700 ++++ moodle-1.8.2.dfsg/install.php 2009-02-12 11:09:06.000000000 -0800 +@@ -103,6 +103,7 @@ + $nextstage = $_POST['stage']; + } + ++ $nextstage = (int)$nextstage; + + if ($nextstage < 0) { + $nextstage = WELCOME; +@@ -804,31 +805,31 @@ +

    		+- ++ +

    		+- ++ +

    		+- ++ +

    		+- ++ +

    		+- ++ +

    		+- ++ +
    and
    ++ '/(]*>|<\/tr>)/i', // and ++ '/]*>(.*?)<\/td>/i', // and ++ '/&(nbsp|#160);/i', // Non-breaking space ++ '/&(quot|rdquo|ldquo|#8220|#8221|#147|#148);/i', ++ // Double quotes ++ '/&(apos|rsquo|lsquo|#8216|#8217);/i', // Single quotes ++ '/>/i', // Greater-than ++ '/</i', // Less-than ++ '/&(amp|#38);/i', // Ampersand ++ '/&(copy|#169);/i', // Copyright ++ '/&(trade|#8482|#153);/i', // Trademark ++ '/&(reg|#174);/i', // Registered ++ '/&(mdash|#151|#8212);/i', // mdash ++ '/&(ndash|minus|#8211|#8722);/i', // ndash ++ '/&(bull|#149|#8226);/i', // Bullet ++ '/&(pound|#163);/i', // Pound sign ++ '/&(euro|#8364);/i', // Euro sign ++ '/&[^&;]+;/i', // Unknown/unhandled entities ++ '/[ ]{2,}/' // Runs of spaces, post-handling ++ ); ++ ++ /** ++ * List of pattern replacements corresponding to patterns searched. ++ * ++ * @var array $replace ++ * @access public ++ * @see $search ++ */ ++ var $replace = array( ++ '', // Non-legal carriage return ++ ' ', // Newlines and tabs ++ ' ', // Runs of spaces, pre-handling ++ '', //