components/web/webalizer/patches/01-fix-security-issue.patch

   1
   2 https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=158174
   3
   4 --- webalizer-2.23-05/webalizer.c.orig  2013-07-02 22:58:20.471324594 +0200
   5 +++ webalizer-2.23-05/webalizer.c       2013-07-02 23:01:59.618093806 +0200
   6 @@ -296,6 +296,8 @@
   7
   8     int    max_ctry;                      /* max countries defined       */
   9
  10 +   struct stat st;
  11 +
  12     /* month names used for parsing logfile (shouldn't be lang specific) */
  13     char *log_month[12]={ "jan", "feb", "mar",
  14                           "apr", "may", "jun",
  15 @@ -313,7 +315,9 @@
  16
  17     sprintf(tmp_buf,"%s/webalizer.conf",ETCDIR);
  18     /* check for default config file */
  19 -   if (!access("webalizer.conf",F_OK))
  20 +   /* and make sure running user is the owner */
  21 +   /* see: https://bugzilla.redhat.com/show_bug.cgi?id=158174 */
  22 +   if (stat("webalizer.conf", &st) == 0 && st.st_uid == getuid())
  23        get_config("webalizer.conf");
  24     else if (!access(tmp_buf,F_OK))
  25        get_config(tmp_buf);
  26
  27 --- webalizer-2.23-05/webalizer.1.orig  2013-07-02 23:02:17.691312738 +0200
  28 +++ webalizer-2.23-05/webalizer.1       2013-07-02 23:03:51.108079057 +0200
  29 @@ -45,9 +45,9 @@
  30  .B o
  31  A default configuration file is scanned for.  A file named
  32  \fIwebalizer.conf\fP is searched for in the current directory, and if
  33 -found, it's configuration data is parsed.  If the file is not
  34 -present in the current directory,  the file \fI/etc/webalizer.conf\fP
  35 -is searched for and, if found, is used instead.
  36 +found, and is owned by the invoking user, then its configuration data is parsed.
  37 +If the file is not present in the current directory,
  38 +the file \fI/etc/webalizer.conf\fP is searched for and, if found, is used instead.
  39  .TP 8
  40  .B o
  41  Any command line arguments given to the program are parsed.  This