Bug#772764: CVE-2014-9277_2.patch

2014-12-17 Thread Sébastien Delafond
Thanks for the heads-up, this will be fixed shortly. Cheers, --Seb -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org

Bug#772764: CVE-2014-9277_2.patch breaks includes/api/ApiFormatJson.php / ApiFormatPhp.php

2014-12-15 Thread Merlijn van Deen
Hello, CVE-2014-9277_2.patch seems to contain htmlentities for quotes: + if ( preg_match( '/\<\s*cross-domain-policy\s*\>/i', $json ) ) { + $json = preg_replace( + '/\<(\s*cross-domain-policy\s*)\>/i', '\\u003C$1\\u003E', $json + ); + } which breaks both php files. Attached is a vers