On Thu, 21 Mar 2013 10:06:24 +0100 Julien Cristau <jcris...@debian.org> wrote: > Where is this undone? What happens if you call build twice? If the > package isn't already using a patch system, then apply the patch > directly, not through debian/rules, please.
Okay, thanks. I'll upload with as below changes (directly applied). diff -u smarty-2.6.26/debian/changelog smarty-2.6.26/debian/changelog --- smarty-2.6.26/debian/changelog +++ smarty-2.6.26/debian/changelog @@ -1,3 +1,12 @@ +smarty (2.6.26-0.2+squeeze1) stable-proposed-updates; urgency=high + + * QA upload. + * add debian/patches/avoid_possible_script_execution_from_2.6.27.patch + - CVE-2012-4437: cherry picked from upstream, prevent XSS (Closes: #702710) + Thanks to Yoshinari Takaoka <mum...@mumumu.org> for the report. + + -- Hideki Yamane <henr...@debian.org> Mon, 11 Mar 2013 01:18:46 +0900 + smarty (2.6.26-0.2) unstable; urgency=low * QA upload: only in patch2: unchanged: --- smarty-2.6.26.orig/debian/patches/avoid_possible_script_execution_from_2.6.27.patch +++ smarty-2.6.26/debian/patches/avoid_possible_script_execution_from_2.6.27.patch @@ -0,0 +1,22 @@ +Description: avoid possible XSS + As Yoshinari Takaoka <mum...@mumumu.org> pointed out, upstream puts + a (possible) security fix in Smarty 2.6.27. + . + See upstream commit as https://code.google.com/p/smarty-php/source/detail?r=4660 + +--- +Origin: upstream +Last-Update: 2013-03-11 + +--- smarty-2.6.26.orig/libs/Smarty.class.php ++++ smarty-2.6.26/libs/Smarty.class.php +@@ -1090,7 +1090,8 @@ class Smarty + */ + function trigger_error($error_msg, $error_type = E_USER_WARNING) + { +- trigger_error("Smarty error: $error_msg", $error_type); ++ $msg = htmlentities($error_msg); ++ trigger_error("Smarty error: $msg", $error_type); + } + + only in patch2: unchanged: --- smarty-2.6.26.orig/libs/Smarty.class.php +++ smarty-2.6.26/libs/Smarty.class.php @@ -1090,7 +1090,8 @@ */ function trigger_error($error_msg, $error_type = E_USER_WARNING) { - trigger_error("Smarty error: $error_msg", $error_type); + $msg = htmlentities($error_msg); + tri -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
