--- libphp-snoopy-1.2.3.orig/debian/control +++ libphp-snoopy-1.2.3/debian/control @@ -0,0 +1,25 @@ +Source: libphp-snoopy +Section: web +Priority: optional +Maintainer: Ubuntu MOTU Developers +XSBC-Original-Maintainer: Marcelo Jorge Vieira (metal) +Package: libphp-snoopy +Architecture: all +Depends: ${misc:Depends}, php5 +Description: Snoopy is a PHP class that simulates a web browser + It automates the task of retrieving web page content and posting forms, + for example + . + Some of Snoopy's features: + . + * easily fetch the contents of a web page + * easily fetch the text from a web page (strip html tags) + * easily fetch the the links from a web page + * supports proxy hosts + * supports basic user/pass authentication + * supports setting user_agent, referer, cookies and header content + * supports browser redirects, and controlled depth of redirects + * expands fetched links to fully qualified URLs (default) + * easily submit form data and retrieve the results + * supports following html frames (added v0.92) + * supports passing cookies on redirects (added v0.92) --- libphp-snoopy-1.2.3.orig/debian/watch +++ libphp-snoopy-1.2.3/debian/watch @@ -0,0 +1,2 @@ +version=3 +http://sourceforge.net/project/showfiles.php?group_id=2091&package_id=2027 .*Snoopy-([\d\.]+)\.tar\.gz.* --- libphp-snoopy-1.2.3.orig/debian/compat +++ libphp-snoopy-1.2.3/debian/compat @@ -0,0 +1 @@ +5 --- libphp-snoopy-1.2.3.orig/debian/copyright +++ libphp-snoopy-1.2.3/debian/copyright @@ -0,0 +1,28 @@ +This package was debianized by Marcelo Jorge Vieira (metal) on +Fri, 14 Sep 2007 13:29:04 -0300. + +It was downloaded from + +Upstream author: + + Author: Monte Ohrt + Copyright (c): 1999-2000 ispi, all rights reserved + +License: + + This library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + This library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with this library; if not, write to the Free Software + Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA + + On Debian GNU/Linux systems, the complete text of the GNU General + Public License can be found in `/usr/share/common-licenses/LGPL-2.1'. --- libphp-snoopy-1.2.3.orig/debian/rules +++ libphp-snoopy-1.2.3/debian/rules @@ -0,0 +1,6 @@ +#!/usr/bin/make -f + +include /usr/share/cdbs/1/rules/debhelper.mk +#include /usr/share/cdbs/1/class/makefile.mk + +# Add here any variable or target overrides you need. --- libphp-snoopy-1.2.3.orig/debian/libphp-snoopy.install +++ libphp-snoopy-1.2.3/debian/libphp-snoopy.install @@ -0,0 +1 @@ +Snoopy.class.php /usr/share/php/libphp-snoopy/ --- libphp-snoopy-1.2.3.orig/debian/docs +++ libphp-snoopy-1.2.3/debian/docs @@ -0,0 +1,4 @@ +FAQ +NEWS +README +TODO --- libphp-snoopy-1.2.3.orig/debian/changelog +++ libphp-snoopy-1.2.3/debian/changelog @@ -0,0 +1,21 @@ +libphp-snoopy (1.2.3-2ubuntu0.1) intrepid-security; urgency=low + + * SECURITY UPDATE: execute arbitrary commands via shell metacharacters in https URLs (LP: #292923) + - changed Snoopy.class.php with patch from version 1.2.4 in ubuntu jaunty + - CVE-2008-4796 + + -- Vincenzo Ampolo Sat, 28 Feb 2009 16:48:59 +0100 + +libphp-snoopy (1.2.3-2) unstable; urgency=low + + * Added watch file + * Updated Standards-Version to 3.7.3 + + -- Marcelo Jorge Vieira (metal) Thu, 31 Jan 2008 12:27:43 -0200 + +libphp-snoopy (1.2.3-1) unstable; urgency=low + + * Initial release (Closes: #442303) + + -- Marcelo Jorge Vieira (metal) Fri, 14 Sep 2007 13:29:04 -0300 + --- libphp-snoopy-1.2.3.orig/debian/patches/CVE-2008-4796.patch +++ libphp-snoopy-1.2.3/debian/patches/CVE-2008-4796.patch @@ -0,0 +1,13 @@ +diff -Nur -x '*.orig' -x '*~' libphp-snoopy-1.2.3/Snoopy.class.php libphp-snoopy-1.2.3.new/Snoopy.class.php +--- libphp-snoopy-1.2.3/Snoopy.class.php 2005-11-08 07:55:33.000000000 +0100 ++++ libphp-snoopy-1.2.3.new/Snoopy.class.php 2009-02-28 16:38:31.000000000 +0100 +@@ -1012,8 +1012,7 @@ + + $headerfile = tempnam($temp_dir, "sno"); + +- $safer_URI = strtr( $URI, "\"", " " ); // strip quotes from the URI to avoid shell access +- exec($this->curl_path." -D \"$headerfile\"".$cmdline_params." \"".$safer_URI."\"",$results,$return); ++ exec($this->curl_path." -k -D \"$headerfile\"".$cmdline_params." \"".escapeshellcmd($URI)."\"",$results,$return); + + if($return) + {