+ ++ ++ ++ + + + +Index: mantis-1.1.2+dfsg/core/session_api.php +=================================================================== +--- mantis-1.1.2+dfsg.orig/core/session_api.php 2008-10-28 16:13:29.000000000 +0100 ++++ mantis-1.1.2+dfsg/core/session_api.php 2008-10-28 16:13:29.000000000 +0100 +@@ -48,12 +48,17 @@ + * to PHP's session.* settings in 'php.ini'. + */ + class MantisPHPSession extends MantisSession { +- function __construct() { ++ function __construct( $p_session_id=null ) { + if ( isset( $_SERVER['HTTPS'] ) && ( strtolower( $_SERVER['HTTPS'] ) != 'off' ) ) { + session_set_cookie_params( 0, config_get( 'cookie_path' ), config_get( 'cookie_domain' ), true, true ); + } else { + session_set_cookie_params( 0, config_get( 'cookie_path' ), config_get( 'cookie_domain' ), false, true ); + } ++ ++ if ( !is_null( $p_session_id ) ) { ++ session_id( $p_session_id ); ++ } ++ + session_start(); + $this->id = session_id(); + } +@@ -97,12 +102,12 @@ + /** + * Initialize the appropriate session handler. + */ +-function session_init() { ++function session_init( $p_session_id=null ) { + global $g_session, $g_session_handler; + + switch( strtolower( $g_session_handler ) ) { + case 'php': +- $g_session = new MantisPHPSession(); ++ $g_session = new MantisPHPSession( $p_session_id ); + break; + + case 'adodb': +@@ -184,4 +189,11 @@ + + + ##### Initialize the session +-session_init(); ++$t_session_id = gpc_get_string( 'session_id', '' ); ++ ++if ( empty( $t_session_id ) ) { ++ session_init(); ++} else { ++ session_init( $t_session_id ); ++} ++ only in patch2: unchanged: --- mantis-1.1.2+dfsg.orig/debian/patches/09-fix-CVE-2008-4688.patch +++ mantis-1.1.2+dfsg/debian/patches/09-fix-CVE-2008-4688.patch @@ -0,0 +1,21 @@ +# +# Ubuntu: https://bugs.edge.launchpad.net/ubuntu/+source/mantis/+bug/291531 +# Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=503588 +# Upstream: http://www.mantisbt.org/bugs/view.php?id=9665 +# Patch: http://mantisbt.svn.sourceforge.net/viewvc/mantisbt/branches/BRANCH_1_1_0/mantisbt/core/string_api.php?r1=5285&r2=5384&pathrev=5384&diff_format=h +# CVE: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4688 +# Description: CVE-2008-4688: Mantis does not check the privileges of the viewer before composing a link with issue data in the source anchor. +# +Index: mantis-1.1.2+dfsg/core/string_api.php +=================================================================== +--- mantis-1.1.2+dfsg.orig/core/string_api.php 2008-10-27 11:52:57.000000000 +0100 ++++ mantis-1.1.2+dfsg/core/string_api.php 2008-10-27 11:53:08.000000000 +0100 +@@ -306,7 +306,7 @@ + if ( !isset( $string_process_bug_link_callback[$p_include_anchor][$p_detail_info][$p_fqdn] ) ) { + if ($p_include_anchor) { + $string_process_bug_link_callback[$p_include_anchor][$p_detail_info][$p_fqdn] = create_function('$p_array',' +- if (bug_exists( (int)$p_array[2] ) ) { ++ if ( bug_exists( (int)$p_array[2] ) && access_has_bug_level( VIEWER, (int)$p_array[2] ) ) { + return $p_array[1] . string_get_bug_view_link( (int)$p_array[2], null, ' . ($p_detail_info ? 'true' : 'false') . ', ' . ($p_fqdn ? 'true' : 'false') . '); + } else { + return $p_array[0]; only in patch2: unchanged: --- mantis-1.1.2+dfsg.orig/debian/patches/08-fix-CVE-2008-4689.patch +++ mantis-1.1.2+dfsg/debian/patches/08-fix-CVE-2008-4689.patch @@ -0,0 +1,46 @@ +# +# Ubuntu: https://bugs.edge.launchpad.net/ubuntu/+source/mantis/+bug/291531 +# Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=503588 +# Upstream: http://www.mantisbt.org/bugs/view.php?id=9664 +# Patch: http://www.mantisbt.org/bugs/file_download.php?file_id=1988&type=bug +# CVE: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4689 +# Description: CVE-2008-4689: Mantis does not unset the session cookie during the logout. +# +Index: mantis-1.1.2+dfsg/core/authentication_api.php +=================================================================== +--- mantis-1.1.2+dfsg.orig/core/authentication_api.php 2008-10-27 11:49:38.000000000 +0100 ++++ mantis-1.1.2+dfsg/core/authentication_api.php 2008-10-27 11:50:45.000000000 +0100 +@@ -194,6 +194,9 @@ + if (auth_clear_cookies()) { + helper_clear_pref_cookies(); + } ++ ++ session_clean(); ++ + return true; + } + +Index: mantis-1.1.2+dfsg/core/session_api.php +=================================================================== +--- mantis-1.1.2+dfsg.orig/core/session_api.php 2008-10-27 11:49:06.000000000 +0100 ++++ mantis-1.1.2+dfsg/core/session_api.php 2008-10-27 11:50:45.000000000 +0100 +@@ -51,6 +51,8 @@ + function __construct() { + if ( isset( $_SERVER['HTTPS'] ) && ( strtolower( $_SERVER['HTTPS'] ) != 'off' ) ) { + session_set_cookie_params( 0, config_get( 'cookie_path' ), config_get( 'cookie_domain' ), true, true ); ++ } else { ++ session_set_cookie_params( 0, config_get( 'cookie_path' ), config_get( 'cookie_domain' ), false, true ); + } + session_start(); + $this->id = session_id(); +@@ -83,6 +85,10 @@ + } + + function destroy() { ++ if ( isset( $_COOKIE[ session_name() ] ) && !headers_sent() ) { ++ gpc_set_cookie( session_name(), '', time() - 42000 ); ++ } ++ + unset( $_SESSION ); + session_destroy(); + }