components/wget/CVE-2010-2252.patch
changeset 115 c360825c3a3f
parent 114 6cc95ec7b1bb
child 116 ae6a90899b42
equal deleted inserted replaced
114:6cc95ec7b1bb 115:c360825c3a3f
     1 diff -rcu wget-1.12.orig/doc/wget.texi wget-1.12/doc/wget.texi
       
     2 --- wget-1.12.orig/doc/wget.texi	Fri Sep  4 14:22:04 2009
       
     3 +++ wget-1.12/doc/wget.texi	Tue Feb 15 03:26:00 2011
       
     4 @@ -1487,6 +1487,13 @@
       
     5  @code{Content-Disposition} headers to describe what the name of a
       
     6  downloaded file should be.
       
     7  
       
     8 +@cindex Trust server names
       
     9 +@item --trust-server-names
       
    10 +
       
    11 +If this is set to on, on a redirect the last component of the
       
    12 +redirection URL will be used as the local file name.  By default it is
       
    13 +used the last component in the original URL.
       
    14 +
       
    15  @cindex authentication
       
    16  @item --auth-no-challenge
       
    17  
       
    18 @@ -2799,6 +2806,10 @@
       
    19  Turn on recognition of the (non-standard) @samp{Content-Disposition}
       
    20  HTTP header---if set to @samp{on}, the same as @samp{--content-disposition}.
       
    21  
       
    22 +@item trust_server_names = on/off
       
    23 +If set to on, use the last component of a redirection URL for the local
       
    24 +file name.
       
    25 +
       
    26  @item continue = on/off
       
    27  If set to on, force continuation of preexistent partially retrieved
       
    28  files.  See @samp{-c} before setting it.
       
    29 diff -rcu wget-1.12.orig/src/http.c wget-1.12/src/http.c
       
    30 --- wget-1.12.orig/src/http.c	Mon Sep 21 20:02:18 2009
       
    31 +++ wget-1.12/src/http.c	Tue Feb 15 03:26:00 2011
       
    32 @@ -2410,8 +2410,9 @@
       
    33  /* The genuine HTTP loop!  This is the part where the retrieval is
       
    34     retried, and retried, and retried, and...  */
       
    35  uerr_t
       
    36 -http_loop (struct url *u, char **newloc, char **local_file, const char *referer,
       
    37 -           int *dt, struct url *proxy, struct iri *iri)
       
    38 +http_loop (struct url *u, struct url *original_url, char **newloc,
       
    39 +           char **local_file, const char *referer, int *dt, struct url *proxy,
       
    40 +           struct iri *iri)
       
    41  {
       
    42    int count;
       
    43    bool got_head = false;         /* used for time-stamping and filename detection */
       
    44 @@ -2457,7 +2458,8 @@
       
    45      }
       
    46    else if (!opt.content_disposition)
       
    47      {
       
    48 -      hstat.local_file = url_file_name (u);
       
    49 +      hstat.local_file =
       
    50 +        url_file_name (opt.trustservernames ? u : original_url);
       
    51        got_name = true;
       
    52      }
       
    53  
       
    54 @@ -2497,7 +2499,7 @@
       
    55  
       
    56    /* Send preliminary HEAD request if -N is given and we have an existing
       
    57     * destination file. */
       
    58 -  file_name = url_file_name (u);
       
    59 +  file_name = url_file_name (opt.trustservernames ? u : original_url);
       
    60    if (opt.timestamping
       
    61        && !opt.content_disposition
       
    62        && file_exists_p (file_name))
       
    63 diff -rcu wget-1.12.orig/src/http.h wget-1.12/src/http.h
       
    64 --- wget-1.12.orig/src/http.h	Fri Sep  4 09:31:54 2009
       
    65 +++ wget-1.12/src/http.h	Tue Feb 15 03:26:00 2011
       
    66 @@ -33,8 +33,8 @@
       
    67  
       
    68  struct url;
       
    69  
       
    70 -uerr_t http_loop (struct url *, char **, char **, const char *, int *,
       
    71 -		  struct url *, struct iri *);
       
    72 +uerr_t http_loop (struct url *, struct url *, char **, char **, const char *,
       
    73 +                  int *, struct url *, struct iri *);
       
    74  void save_cookies (void);
       
    75  void http_cleanup (void);
       
    76  time_t http_atotm (const char *);
       
    77 diff -rcu wget-1.12.orig/src/init.c wget-1.12/src/init.c
       
    78 --- wget-1.12.orig/src/init.c	Mon Sep 21 20:02:41 2009
       
    79 +++ wget-1.12/src/init.c	Tue Feb 15 03:26:00 2011
       
    80 @@ -243,6 +243,7 @@
       
    81    { "timeout",          NULL,                   cmd_spec_timeout },
       
    82    { "timestamping",     &opt.timestamping,      cmd_boolean },
       
    83    { "tries",            &opt.ntry,              cmd_number_inf },
       
    84 +  { "trustservernames", &opt.trustservernames,  cmd_boolean },
       
    85    { "useproxy",         &opt.use_proxy,         cmd_boolean },
       
    86    { "user",             &opt.user,              cmd_string },
       
    87    { "useragent",        NULL,                   cmd_spec_useragent },
       
    88 diff -rcu wget-1.12.orig/src/main.c wget-1.12/src/main.c
       
    89 --- wget-1.12.orig/src/main.c	Mon Sep 21 20:03:11 2009
       
    90 +++ wget-1.12/src/main.c	Tue Feb 15 03:26:00 2011
       
    91 @@ -266,6 +266,7 @@
       
    92      { "timeout", 'T', OPT_VALUE, "timeout", -1 },
       
    93      { "timestamping", 'N', OPT_BOOLEAN, "timestamping", -1 },
       
    94      { "tries", 't', OPT_VALUE, "tries", -1 },
       
    95 +    { "trust-server-names", 0, OPT_BOOLEAN, "trustservernames", -1 },
       
    96      { "user", 0, OPT_VALUE, "user", -1 },
       
    97      { "user-agent", 'U', OPT_VALUE, "useragent", -1 },
       
    98      { "verbose", 'v', OPT_BOOLEAN, "verbose", -1 },
       
    99 @@ -675,6 +676,8 @@
       
   100      N_("\
       
   101    -I,  --include-directories=LIST  list of allowed directories.\n"),
       
   102      N_("\
       
   103 +  --trust-server-names  use the name specified by the redirection url last component.\n"),
       
   104 +    N_("\
       
   105    -X,  --exclude-directories=LIST  list of excluded directories.\n"),
       
   106      N_("\
       
   107    -np, --no-parent                 don't ascend to the parent directory.\n"),
       
   108 diff -rcu wget-1.12.orig/src/options.h wget-1.12/src/options.h
       
   109 --- wget-1.12.orig/src/options.h	Mon Sep 21 20:03:47 2009
       
   110 +++ wget-1.12/src/options.h	Tue Feb 15 03:26:00 2011
       
   111 @@ -242,6 +242,7 @@
       
   112    char *encoding_remote;
       
   113    char *locale;
       
   114  
       
   115 +  bool trustservernames;
       
   116  #ifdef __VMS
       
   117    int ftp_stmlf;                /* Force Stream_LF format for binary FTP. */
       
   118  #endif /* def __VMS */
       
   119 diff -rcu wget-1.12.orig/src/retr.c wget-1.12/src/retr.c
       
   120 --- wget-1.12.orig/src/retr.c	Fri Sep  4 09:31:54 2009
       
   121 +++ wget-1.12/src/retr.c	Tue Feb 15 03:26:00 2011
       
   122 @@ -689,7 +689,8 @@
       
   123  #endif
       
   124        || (proxy_url && proxy_url->scheme == SCHEME_HTTP))
       
   125      {
       
   126 -      result = http_loop (u, &mynewloc, &local_file, refurl, dt, proxy_url, iri);
       
   127 +      result = http_loop (u, orig_parsed, &mynewloc, &local_file, refurl, dt,
       
   128 +                          proxy_url, iri);
       
   129      }
       
   130    else if (u->scheme == SCHEME_FTP)
       
   131      {