Fixes security bug #356893. This time it should work properly

Package-Manager: portage-2.1.9.41/cvs/Linux x86_64

4 files changed, 145 insertions, 12 deletions

diff --git a/dev-php/PEAR-PEAR/ChangeLog b/dev-php/PEAR-PEAR/ChangeLog
index 6a1434883ddb..e8153dc29537 100644
--- a/dev-php/PEAR-PEAR/ChangeLog
+++ b/dev-php/PEAR-PEAR/ChangeLog
@@ -1,6 +1,10 @@
 # ChangeLog for dev-php/PEAR-PEAR
 # Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/dev-php/PEAR-PEAR/ChangeLog,v 1.136 2011/03/14 17:13:18 olemarkus Exp $
+# $Header: /var/cvsroot/gentoo-x86/dev-php/PEAR-PEAR/ChangeLog,v 1.137 2011/03/14 22:19:24 olemarkus Exp $
+
+  14 Mar 2011; <olemarkus@gentoo.org> +PEAR-PEAR-1.9.2-r1.ebuild,
+  files/symlink-attack-fix.patch:
+  Fixes security bug #356893. This time it should work properly
 
 *PEAR-PEAR-1.9.2-r1 (14 Mar 2011)
 
diff --git a/dev-php/PEAR-PEAR/Manifest b/dev-php/PEAR-PEAR/Manifest
index 2b8334cdf9b5..0c8ed76e3316 100644
--- a/dev-php/PEAR-PEAR/Manifest
+++ b/dev-php/PEAR-PEAR/Manifest
@@ -2,8 +2,9 @@ AUX 1.6.2-accept-encoding-bug_12116.patch 603 RMD160 d19b8be3352e479c7316f259cfb
 AUX pear.conf 291 RMD160 311e624d97640448754aa2f3e643aa53501f9c25 SHA1 47b350c2bf4b882b5981504ac6acfd7c708367e6 SHA256 cbe9363c760952d00b90070d4a41e88a175e12c65f99668fbe16d8158f5fa7ab
 AUX pear.conf-r1 379 RMD160 df2595353d3a0ee5474dff41a445ebd2e642a5ec SHA1 a9971714efca2a84ef54b5f7c71f3adbbe3d2930 SHA256 43e78396b7b91cf16a3d33d36c19096c9e7281b7f771c379f383a16c7756c490
 AUX pear.conf-r2 379 RMD160 adaf8e0edd442e7a612754af1f594d8e9e776023 SHA1 098fd2a554643380bf09cc36e03d556459e00eeb SHA256 33296ad828fdbe5447edc93aea6e81351f643fc2e845c6e4bdfad84b299023aa
-AUX symlink-attack-fix.patch 4898 RMD160 17507378f94f61b47b92f29d12c87d63b35f8600 SHA1 4ad06a704337b50c1eb6aa5fc4d863da68c3ee17 SHA256 af94b54e313782a9306b2e5dad1563ebb9abc371531dfad2b8e14f4d26f4a475
+AUX symlink-attack-fix.patch 5860 RMD160 1fc6871359f78915be4b7cd8a26bbeb9705293e1 SHA1 87805d8fe243aa2a6e7e03b5199ecd9301bcb33a SHA256 d01dc9fe8fbb834d6c80ce4d943041526bea4af7f7a8925f9ae4278427ac3ead
 DIST PEAR-1.9.2.tgz 295120 RMD160 f12b6a0a4600b0b227a88687c124b515621ca803 SHA1 1dda2c7c1c87532f6a45a54b98521a2e9efa02b3 SHA256 7f1446f3d92b4e19d3d4ca38dff6f50b66882b9b11a901b069e89a60ff4aff82
+EBUILD PEAR-PEAR-1.9.2-r1.ebuild 3720 RMD160 ad0a47a9ccec7211d9ea45f4da702477022d28a8 SHA1 57837cb2685e6a0d96cb3c2327f2c034af361ecd SHA256 143b1f16162160035707d1f9e03420415a8a688ca99b9879ad2c381bc0208c18
 EBUILD PEAR-PEAR-1.9.2.ebuild 3636 RMD160 f88015f6e95a7250bef04756f69be35a5c1d7197 SHA1 d40a6dc8ded82e540d5cc4482ae1156b7c52b9a9 SHA256 2d565affd0b52d3d85b9914156fe04d49951c618a602b594061ae9eba68b7398
-MISC ChangeLog 19287 RMD160 96ae3acc0c05957e4c0240434fe23e406fa135bf SHA1 ea0d3f510492ac20a02f0242d080e9dd2d4e0bda SHA256 7dd141baa1797596ee7015042d34d3cdfe92f4b31633c87299dcf42d9fd3bd72
+MISC ChangeLog 19452 RMD160 ea87367467a6c9e9c8aaa74de7b8567b0997f282 SHA1 2c31ba59f9b52652c38ecb9116c53b1221c083c9 SHA256 ddb5250927d7f4be3a509b868c2ad71307670787f2b14eb88e9a1d927a9b0a4d
 MISC metadata.xml 248 RMD160 a52d2dcf8ab8231c5e8332d5022d921fb8b6754e SHA1 84c45cabf8e0959e44317f8db4449c0056c7959e SHA256 a98d66f97c0d4f6f57c10b1b2038cfb7c5a76a58ff187ddff241024dfa8dee51
diff --git a/dev-php/PEAR-PEAR/PEAR-PEAR-1.9.2-r1.ebuild b/dev-php/PEAR-PEAR/PEAR-PEAR-1.9.2-r1.ebuild
new file mode 100644
index 000000000000..9c29101f8aea
--- /dev/null
+++ b/dev-php/PEAR-PEAR/PEAR-PEAR-1.9.2-r1.ebuild
@@ -0,0 +1,108 @@
+# Copyright 1999-2011 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/dev-php/PEAR-PEAR/PEAR-PEAR-1.9.2-r1.ebuild,v 1.3 2011/03/14 22:19:24 olemarkus Exp $
+
+EAPI="3"
+
+inherit depend.php
+
+PEAR="${PV}"
+
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~amd64-linux ~ia64-linux ~x86-linux ~x86-macos"
+
+DESCRIPTION="PEAR Base System"
+HOMEPAGE="http://pear.php.net/package/PEAR"
+SRC_URI="http://pear.php.net/get/PEAR-${PEAR}.tgz"
+LICENSE="MIT"
+SLOT="0"
+IUSE=""
+
+DEPEND="|| ( <dev-lang/php-5.3[pcre] >=dev-lang/php-5.3 )
+		dev-lang/php[cli,xml,zlib]"
+
+RDEPEND="${DEPEND}"
+
+S="${WORKDIR}"
+
+pkg_setup() {
+	has_php
+
+	[[ -z "${PEAR_CACHEDIR}" ]] && PEAR_CACHEDIR="${EPREFIX}/var/cache/pear"
+	[[ -z "${PEAR_DOWNLOADDIR}" ]] && PEAR_DOWNLOADDIR="${EPREFIX}/var/tmp/pear"
+	[[ -z "${PEAR_TEMPDIR}" ]] && PEAR_TEMPDIR="${EPREFIX}/tmp"
+
+	elog
+	elog "cache_dir is set to: ${PEAR_CACHEDIR}"
+	elog "download_dir is set to: ${PEAR_DOWNLOADDIR}"
+	elog "temp_dir is set to: ${PEAR_TEMPDIR}"
+	elog
+	elog "If you want to change the above values, you need to set"
+	elog "PEAR_CACHEDIR, PEAR_DOWNLOADDIR and PEAR_TEMPDIR variable(s)"
+	elog "accordingly in /etc/make.conf and re-emerge ${PN}."
+	elog
+}
+
+src_prepare() {
+	epatch "${FILESDIR}/symlink-attack-fix2.patch"
+
+}
+
+src_install() {
+	# Prevent SNMP related sandbox violoation.
+	addpredict /usr/share/snmp/mibs/.index
+	addpredict /var/lib/net-snmp/
+
+	# install PEAR package
+	cd "${S}"/PEAR-${PEAR}
+
+	insinto /usr/share/php
+	doins -r PEAR/
+	doins -r OS/
+	doins PEAR.php PEAR5.php System.php
+	doins scripts/pearcmd.php
+	doins scripts/peclcmd.php
+
+	newbin scripts/pear.sh pear
+	newbin scripts/peardev.sh peardev
+	newbin scripts/pecl.sh pecl
+
+	# adjust some scripts for current version
+	for i in pearcmd.php peclcmd.php ; do
+		dosed "s:@pear_version@:${PEAR}:g" /usr/share/php/${i}
+	done
+
+	for i in pear peardev pecl ; do
+		dosed "s:@bin_dir@:${EPREFIX}/usr/bin:g" /usr/bin/${i}
+		dosed "s:@php_dir@:${EPREFIX}/usr/share/php:g" /usr/bin/${i}
+	done
+	dosed "s:-d output_buffering=1:-d output_buffering=1 -d memory_limit=32M:g" /usr/bin/pear
+
+	dosed "s:@package_version@:${PEAR}:g" /usr/share/php/PEAR/Command/Package.php
+	dosed "s:@PEAR-VER@:${PEAR}:g" /usr/share/php/PEAR/Dependency2.php
+	dosed "s:@PEAR-VER@:${PEAR}:g" /usr/share/php/PEAR/PackageFile/Parser/v1.php
+	dosed "s:@PEAR-VER@:${PEAR}:g" /usr/share/php/PEAR/PackageFile/Parser/v2.php
+
+	# finalize install
+	insinto /etc
+	newins "${FILESDIR}"/pear.conf-r2 pear.conf
+	dosed "s|s:PHPCLILEN:\"PHPCLI\"|s:${#PHPCLI}:\"${PHPCLI}\"|g" /etc/pear.conf
+	dosed "s|s:CACHEDIRLEN:\"CACHEDIR\"|s:${#PEAR_CACHEDIR}:\"${PEAR_CACHEDIR}\"|g" /etc/pear.conf
+	dosed "s|s:DOWNLOADDIRLEN:\"DOWNLOADDIR\"|s:${#PEAR_DOWNLOADDIR}:\"${PEAR_DOWNLOADDIR}\"|g" /etc/pear.conf
+	dosed "s|s:TEMPDIRLEN:\"TEMPDIR\"|s:${#PEAR_TEMPDIR}:\"${PEAR_TEMPDIR}\"|g" /etc/pear.conf
+
+	# Change the paths for eprefix!
+	dosed "s|s:19:\"/usr/share/php/docs\"|s:$(( ${#EPREFIX}+19 )):\"${EPREFIX}/usr/share/php/docs\"|g" /etc/pear.conf
+	dosed "s|s:19:\"/usr/share/php/data\"|s:$(( ${#EPREFIX}+19 )):\"${EPREFIX}/usr/share/php/data\"|g" /etc/pear.conf
+	dosed "s|s:20:\"/usr/share/php/tests\"|s:$(( ${#EPREFIX}+20 )):\"${EPREFIX}/usr/share/php/tests\"|g" /etc/pear.conf
+	dosed "s|s:14:\"/usr/share/php\"|s:$(( ${#EPREFIX}+14 )):\"${EPREFIX}/usr/share/php\"|g" /etc/pear.conf
+	dosed "s|s:8:\"/usr/bin\"|s:$(( ${#EPREFIX}+8 )):\"${EPREFIX}/usr/bin\"|g" /etc/pear.conf
+
+	[[ "${PEAR_TEMPDIR}" != "/tmp" ]] && keepdir "${PEAR_TEMPDIR#${EPREFIX}}"
+	keepdir "${PEAR_CACHEDIR#${EPREFIX}}"
+	diropts -m1777
+	keepdir "${PEAR_DOWNLOADDIR#${EPREFIX}}"
+}
+
+pkg_preinst() {
+	rm -f "${EROOT}/etc/pear.conf"
+}
diff --git a/dev-php/PEAR-PEAR/files/symlink-attack-fix.patch b/dev-php/PEAR-PEAR/files/symlink-attack-fix.patch
index 8101b2e592af..bd126e301ec0 100644
--- a/dev-php/PEAR-PEAR/files/symlink-attack-fix.patch
+++ b/dev-php/PEAR-PEAR/files/symlink-attack-fix.patch
@@ -2,8 +2,35 @@ Fixes issue with symlink attacks found in PEAR-PEAR-1.9.2
 Upstream bug: http://pear.php.net/bugs/bug.php?id=18056
 Gentoo bug: 356893
 
---- pear/pear-core/tags/PEAR-1.9.3/PEAR/REST.php	2011/03/08 22:46:27	309041
-+++ pear/pear-core/tags/PEAR-1.9.3/PEAR/REST.php	2011/03/08 23:16:30	309042
+--- PEAR-1.9.2/PEAR/REST.php.old	2011-03-14 18:21:59.000000000 +0100
++++ PEAR-1.9.2/PEAR/REST.php	2011-03-14 23:01:40.000000000 +0100
+@@ -102,7 +102,7 @@
+                 // reset the age of the cache if the server says it was unmodified
+                 $result = $this->saveCache($url, $ret, null, true, $cacheId);
+                 if (PEAR::isError($result)) {
+-                    return PEAR::raiseErro($result->getMessage());
++                    return PEAR::raiseError($result->getMessage());
+                 }
+             }
+ 
+@@ -122,7 +122,7 @@
+         if ($forcestring) {
+             $result = $this->saveCache($url, $content, $lastmodified, false, $cacheId);
+             if (PEAR::isError($result)) {
+-                return PEAR::raiseErro($result->getMessage());
++                return PEAR::raiseError($result->getMessage());
+             }
+ 
+             return $content;
+@@ -162,7 +162,7 @@
+ 
+         $result = $this->saveCache($url, $content, $lastmodified, false, $cacheId);
+         if (PEAR::isError($result)) {
+-            return PEAR::raiseErro($result->getMessage());
++            return PEAR::raiseError($result->getMessage());
+         }
+ 
+         return $content;
 @@ -228,59 +228,75 @@
          $cacheidfile = $d . 'rest.cacheid';
          $cachefile   = $d . 'rest.cachefile';
@@ -117,10 +144,3 @@ Gentoo bug: 356893
          fclose($cachefile_fp);
          return true;
      }
-@@ -464,4 +480,4 @@
- 
-         return $data;
-     }
--}
-+}
-\ No newline at end of file