new diff for vmail.cgi to fully fix bug #111836.

(Portage version: 2.1_pre5-r3)

7 files changed, 296 insertions, 6 deletions

diff --git a/net-misc/asterisk/files/1.0.0/asterisk-1.0.10-vmail.cgi.patch b/net-misc/asterisk/files/1.0.0/asterisk-1.0.10-vmail.cgi.patch
new file mode 100644
index 000000000000..a441ee0b2eae
--- /dev/null
+++ b/net-misc/asterisk/files/1.0.0/asterisk-1.0.10-vmail.cgi.patch
@@ -0,0 +1,260 @@
+--- trunk/contrib/scripts/vmail.cgi	2004/09/15 05:11:41	3781
++++ trunk/contrib/scripts/vmail.cgi	2005/10/30 16:30:35	6896
+@@ -11,10 +11,15 @@
+ # (icky, I know....  if you know better perl please help!)
+ #
+ #
++# Synchronization added by GDS Partners (www.gdspartners.com)
++#			 Stojan Sljivic (stojan.sljivic@gdspartners.com)
++#
+ use CGI qw/:standard/;
+ use Carp::Heavy;
+ use CGI::Carp qw(fatalsToBrowser);
+ use DBI;
++use Fcntl qw ( O_WRONLY O_CREAT O_EXCL );
++use Time::HiRes qw ( usleep );
+ 
+ $context=""; # Define here your by default context (so you dont need to put voicemail@context in the login
+ 
+@@ -44,6 +49,57 @@
+ $footer = "<hr><font size=-1><a href=\"http://www.asterisk.org\">The Asterisk Open Source PBX</a> Copyright 2004, <a href=\"http://www.digium.com\">Digium, Inc.</a></a>";
+ $stdcontainerend = "</td></tr><tr><td align=right>$footer</td></tr></table>\n";
+ 
++sub lock_path() {
++
++	my($path) = @_;
++	my $rand;
++	my $rfile;
++	my $start;
++	my $res;
++	
++	$rand = rand 99999999;	
++	$rfile = "$path/.lock-$rand";
++	
++	sysopen(RFILE, $rfile, O_WRONLY | O_CREAT | O_EXCL, 0666) or return -1;
++	close(RFILE);
++	
++	$res = link($rfile, "$path/.lock");
++	$start = time;
++	if ($res == 0) {
++	while (($res == 0) && (time - $start <= 5)) {
++		$res = link($rfile, "$path/.lock");
++		usleep(1);
++	}
++	}
++	unlink($rfile);
++	
++	if ($res == 0) {
++		return -1;
++	} else {
++		return 0;
++	}
++}
++
++sub unlock_path() {
++
++	my($path) = @_;
++	
++	unlink("$path/.lock");
++}
++
++sub untaint() {
++
++	my($data) = @_;
++	
++	if ($data =~ /^([-\@\w.]+)$/) {
++		$data = $1;
++	} else {
++		die "Security violation.";
++	}
++	
++	return $data;
++}
++
+ sub login_screen() {
+ 	print header;
+ 	my ($message) = @_;
+@@ -120,7 +176,7 @@
+ 
+                                 # db variables are present.  Use db for authentication.
+                                 my $dbh = DBI->connect("DBI:mysql:$dbname:$dbhost",$dbuser,$dbpass);
+-                                my $sth = $dbh->prepare(qq{select fullname,context from users where mailbox='$mbox' and password='$pass' and context='$context'});
++                                my $sth = $dbh->prepare(qq{select fullname,context from voicemail where mailbox='$mbox' and password='$pass' and context='$context'});
+                                 $sth->execute();
+                                 if (($fullname, $category) = $sth->fetchrow_array()) {;
+                                         return ($fullname ? $fullname : "Extension $mbox in $context",$category);
+@@ -184,7 +240,7 @@
+ 
+                                 # db variables are present.  Use db for authentication.
+                                 my $dbh = DBI->connect("DBI:mysql:$dbname:$dbhost",$dbuser,$dbpass);
+-                                my $sth = $dbh->prepare(qq{select fullname,context from users where mailbox='$mbox' and password='$pass' and context='$context'});
++                                my $sth = $dbh->prepare(qq{select fullname,context from voicemail where mailbox='$mbox' and password='$pass' and context='$context'});
+                                 $sth->execute();
+ 				if (($fullname, $category) = $sth->fetchrow_array()) {;
+                                         return ($fullname ? $fullname : "unknown", $category);
+@@ -242,7 +298,7 @@
+ 
+                                 # db variables are present.  Use db for authentication.
+                                 my $dbh = DBI->connect("DBI:mysql:$dbname:$dbhost",$dbuser,$dbpass);
+-                                my $sth = $dbh->prepare(qq{select mailbox,fullname,context from users where context='$context' order by mailbox});
++                                my $sth = $dbh->prepare(qq{select mailbox,fullname,context from voicemail where context='$context' order by mailbox});
+                                 $sth->execute();
+                                 while (($mailbox, $fullname, $category) = $sth->fetchrow_array()) {
+                                         $text = $mailbox;
+@@ -489,14 +545,16 @@
+ sub message_audio()
+ {
+ 	my ($forcedownload) = @_;
+-	my $folder = param('folder');
+-	my $msgid = param('msgid');
+-	my $mailbox = param('mailbox');
+-	my $context = param('context');
++	my $folder = &untaint(param('folder'));
++	my $msgid = &untaint(param('msgid'));
++	my $mailbox = &untaint(param('mailbox'));
++	my $context = &untaint(param('context'));
+ 	my $format = param('format');
+ 	if (!$format) {
+ 		$format = &getcookie('format');
+ 	}
++	&untaint($format);
++
+ 	my $path = "/var/spool/asterisk/voicemail/$context/$mailbox/$folder/msg${msgid}.$format";
+ 
+ 	$msgid =~ /^\d\d\d\d$/ || die("Msgid Liar ($msgid)!");
+@@ -719,6 +777,8 @@
+ 	}
+ 	
+ 	my $path = "/var/spool/asterisk/voicemail/$context/$mbox/$newfolder";
++	$path =~ /^(.*)$/;
++	$path = $1;
+ 	mkdir $path, 0770;
+ 	my $path = "/var/spool/asterisk/voicemail/$context/$mbox/$oldfolder";
+ 	opendir(DIR, $path) || die("Unable to open directory\n");
+@@ -742,6 +802,10 @@
+ 	my ($orig, $new) = @_;
+ 	my $res;
+ 	my $data;
++	$orig =~ /^(.*)$/;
++	$orig = $1;
++	$new =~ /^(.*)$/;
++	$new = $1;
+ 	open(IN, "<$orig") || die("Unable to open '$orig'\n");
+ 	open(OUT, ">$new") || DIE("Unable to open '$new'\n");
+ 	while(($res = sysread(IN, $data, 4096)) > 0) {
+@@ -788,8 +852,12 @@
+ 	}
+ 	
+ 	my $path = "/var/spool/asterisk/voicemail/$context/$newmbox";
++	$path =~ /^(.*)$/;
++	$path = $1;
+ 	mkdir $path, 0770;
+ 	my $path = "/var/spool/asterisk/voicemail/$context/$newmbox/INBOX";
++	$path =~ /^(.*)$/;
++	$path = $1;
+ 	mkdir $path, 0770;
+ 	my $path = "/var/spool/asterisk/voicemail/$context/$mbox/$oldfolder";
+ 	opendir(DIR, $path) || die("Unable to open directory\n");
+@@ -863,19 +931,29 @@
+ 		die("Bah! Not a valid mailbox '$newmbox'\n");
+ 		return "";
+ 	}
+-	$msgcount = &msgcount($context, $newmbox, "INBOX");
++	
+ 	my $txt;
+-	if ($newmbox ne $mbox) {
+-#		print header;
+-		foreach $msg (@msgs) {
+-#			print "Forwarding $msg from $mbox to $newmbox<BR>\n";
+-			&message_copy($context, $mbox, $newmbox, $folder, $msg, sprintf "%04d", $msgcount);
+-			$msgcount++;
++	$context = &untaint($context);
++	$newmbox = &untaint($newmbox);
++	my $path = "/var/spool/asterisk/voicemail/$context/$newmbox/INBOX";
++	if (&lock_path($path) == 0) {
++		$msgcount = &msgcount($context, $newmbox, "INBOX");
++		
++		if ($newmbox ne $mbox) {
++#			print header;
++			foreach $msg (@msgs) {
++#				print "Forwarding $msg from $mbox to $newmbox<BR>\n";
++				&message_copy($context, $mbox, $newmbox, $folder, $msg, sprintf "%04d", $msgcount);
++				$msgcount++;
++			}
++			$txt = "Forwarded messages " . join(', ', @msgs) . "to $newmbox";
++		} else {
++			$txt = "Can't forward messages to yourself!\n";
+ 		}
+-		$txt = "Forwarded messages " . join(', ', @msgs) . "to $newmbox";
++		&unlock_path($path); 
+ 	} else {
+-		$txt = "Can't forward messages to yourself!\n";
+-	} 
++		$txt = "Cannot forward messages: Unable to lock path.\n";
++	}
+ 	if ($toindex) {
+ 		&message_index($folder, $txt);
+ 	} else {
+@@ -900,33 +978,42 @@
+ 		$context = "default";
+ 	}
+ 	my $passwd = param('password');
+-	my $msgcount = &msgcount($context, $mbox, $folder);
+-	my $omsgcount = &msgcount($context, $mbox, $newfolder) if $newfolder;
+-#	print header;
+-	if ($newfolder ne $folder) {
+-		$y = 0;
+-		for ($x=0;$x<$msgcount;$x++) {
+-			my $msg = sprintf "%04d", $x;
+-			my $newmsg = sprintf "%04d", $y;
+-			if (grep(/^$msg$/, @msgs)) {
+-				if ($newfolder) {
+-					&message_rename($context, $mbox, $folder, $msg, $newfolder, sprintf "%04d", $omsgcount);
+-					$omsgcount++;
++	$context = &untaint($context);
++	$mbox = &untaint($mbox);
++	$folder = &untaint($folder);
++	my $path = "/var/spool/asterisk/voicemail/$context/$mbox/$folder";
++	if (&lock_path($path) == 0) {
++		my $msgcount = &msgcount($context, $mbox, $folder);
++		my $omsgcount = &msgcount($context, $mbox, $newfolder) if $newfolder;
++	#	print header;
++		if ($newfolder ne $folder) {
++			$y = 0;
++			for ($x=0;$x<$msgcount;$x++) {
++				my $msg = sprintf "%04d", $x;
++				my $newmsg = sprintf "%04d", $y;
++				if (grep(/^$msg$/, @msgs)) {
++					if ($newfolder) {
++						&message_rename($context, $mbox, $folder, $msg, $newfolder, sprintf "%04d", $omsgcount);
++						$omsgcount++;
++					} else {
++						&message_delete($context, $mbox, $folder, $msg);
++					}
+ 				} else {
+-					&message_delete($context, $mbox, $folder, $msg);
++					&message_rename($context, $mbox, $folder, $msg, $folder, $newmsg);
++					$y++;
+ 				}
++			}
++			if ($del) {
++				$txt = "Deleted messages "  . join (', ', @msgs);
+ 			} else {
+-				&message_rename($context, $mbox, $folder, $msg, $folder, $newmsg);
+-				$y++;
++				$txt = "Moved messages "  . join (', ', @msgs) . " to $newfolder";
+ 			}
+-		}
+-		if ($del) {
+-			$txt = "Deleted messages "  . join (', ', @msgs);
+ 		} else {
+-			$txt = "Moved messages "  . join (', ', @msgs) . " to $newfolder";
++			$txt = "Can't move a message to the same folder they're in already";
+ 		}
++		&unlock_path($path);
+ 	} else {
+-		$txt = "Can't move a message to the same folder they're in already";
++		$txt = "Cannot move/delete messages: Unable to lock path.\n";
+ 	}
+ 	# Not as many messages now
+ 	$msgcount--;
diff --git a/net-misc/asterisk/files/digest-asterisk-1.0.10 b/net-misc/asterisk/files/digest-asterisk-1.0.10
deleted file mode 100644
index 56aaf160ad19..000000000000
--- a/net-misc/asterisk/files/digest-asterisk-1.0.10
+++ /dev/null
@@ -1,3 +0,0 @@
-MD5 f60f4c4edc36fa61dc55a5385fd82e71 asterisk-1.0.10.tar.gz 9609302
-MD5 2b6e1da3ff097f9792d3123e7e5a0059 asterisk-addons-1.0.9.tar.gz 73716
-MD5 215dd795ce8ea72370b2e9d1bb7d8f6a bristuff-0.2.0-RC8q.tar.gz 152037
diff --git a/net-misc/asterisk/files/digest-asterisk-1.0.10-r1 b/net-misc/asterisk/files/digest-asterisk-1.0.10-r1
new file mode 100644
index 000000000000..bf20f71508db
--- /dev/null
+++ b/net-misc/asterisk/files/digest-asterisk-1.0.10-r1
@@ -0,0 +1,9 @@
+MD5 f60f4c4edc36fa61dc55a5385fd82e71 asterisk-1.0.10.tar.gz 9609302
+RMD160 fa85ccd0a84de0eb4596dcc97ddd680b9aa72e1c asterisk-1.0.10.tar.gz 9609302
+SHA256 3f10fe074fe1469b13046493ee43efc2c9b2e1fa0896abeb2eb09e381d7c9f92 asterisk-1.0.10.tar.gz 9609302
+MD5 2b6e1da3ff097f9792d3123e7e5a0059 asterisk-addons-1.0.9.tar.gz 73716
+RMD160 98156861f790987fb4bf86b14c902aeca90b380b asterisk-addons-1.0.9.tar.gz 73716
+SHA256 4c878a4e5b5aabbdd93116ccbca5cf6465d55f480f4aa1e6438e9fc49c1f11fe asterisk-addons-1.0.9.tar.gz 73716
+MD5 4d8cc1e10d94f373e6dfd4cea2928ad2 bristuff-0.2.0-RC8q.tar.gz 152018
+RMD160 98b1328d4618ade310a5312d71ec0f1e27507a37 bristuff-0.2.0-RC8q.tar.gz 152018
+SHA256 03cf1f5920aa023f6a449da473159b4b447d3940d74590cbad95304a4fbcb1c4 bristuff-0.2.0-RC8q.tar.gz 152018
diff --git a/net-misc/asterisk/files/digest-asterisk-1.0.7-r3 b/net-misc/asterisk/files/digest-asterisk-1.0.7-r3
new file mode 100644
index 000000000000..6de4491b805b
--- /dev/null
+++ b/net-misc/asterisk/files/digest-asterisk-1.0.7-r3
@@ -0,0 +1,9 @@
+MD5 4cc3c1e4a1b12e0e4c748326ad153291 asterisk-1.0.7.tar.gz 9591705
+RMD160 bb738f0e3d100314fa7497c9ee81f8a022e536bb asterisk-1.0.7.tar.gz 9591705
+SHA256 552dd71917475eaf1866665d091909c2c50865d84c62ab35383f443141e08a74 asterisk-1.0.7.tar.gz 9591705
+MD5 e2a94a7c2e97de18b3cdc4dd42709c11 asterisk-addons-1.0.7.tar.gz 73646
+RMD160 52d73f32bcd1717b5cf057c5930a9aefae1040cf asterisk-addons-1.0.7.tar.gz 73646
+SHA256 22d5839b851ed83590bf670f0c958ec5103178f80706ce4b4b235c837adf0433 asterisk-addons-1.0.7.tar.gz 73646
+MD5 7a5ff01d3befff1fbd3de1c303cb10d1 bristuff-0.2.0-RC8g.tar.gz 139013
+RMD160 c0a037e0819b8985be2df60a010309335527f203 bristuff-0.2.0-RC8g.tar.gz 139013
+SHA256 19a0a7fdbb192fed4ea086251d5653abbe8525232dd5b613f9366400c97b213b bristuff-0.2.0-RC8g.tar.gz 139013
diff --git a/net-misc/asterisk/files/digest-asterisk-1.0.8-r2 b/net-misc/asterisk/files/digest-asterisk-1.0.8-r2
new file mode 100644
index 000000000000..88ae55242b46
--- /dev/null
+++ b/net-misc/asterisk/files/digest-asterisk-1.0.8-r2
@@ -0,0 +1,9 @@
+MD5 8400ebbd46e41cd772c7814b361de05a asterisk-1.0.8.tar.gz 9604563
+RMD160 6f1e63804ce4a2ec90a61571bf946d6b64dcea76 asterisk-1.0.8.tar.gz 9604563
+SHA256 26807ac82aa45758e538276301273c4493e1f4fdb2ba433bd732ab21d2340e9a asterisk-1.0.8.tar.gz 9604563
+MD5 07af0488fde431278fc840f39a9b38f2 asterisk-addons-1.0.8.tar.gz 73702
+RMD160 66c6ab0ab2941cb657828d45ab379ecbfb385a5d asterisk-addons-1.0.8.tar.gz 73702
+SHA256 3f5c9d03fd257781ec6c59189d37c492fbdf457a1d267bb509f3c852693a7dae asterisk-addons-1.0.8.tar.gz 73702
+MD5 3b264a75b1a17735572920655bf1a0f8 bristuff-0.2.0-RC8h.tar.gz 150270
+RMD160 a958bc8418618ca892f0fbdb8d8cf203375d3865 bristuff-0.2.0-RC8h.tar.gz 150270
+SHA256 74c2e40cd665a2a9ac29d5ddd31892c8ca15ca9b55e2a08523e9db5ca75ba207 bristuff-0.2.0-RC8h.tar.gz 150270
diff --git a/net-misc/asterisk/files/digest-asterisk-1.0.9-r2 b/net-misc/asterisk/files/digest-asterisk-1.0.9-r2
deleted file mode 100644
index 33f5aed3f4de..000000000000
--- a/net-misc/asterisk/files/digest-asterisk-1.0.9-r2
+++ /dev/null
@@ -1,3 +0,0 @@
-MD5 0d7f1c680ae53a739f26a069ef8b580a asterisk-1.0.9.tar.gz 9604582
-MD5 2b6e1da3ff097f9792d3123e7e5a0059 asterisk-addons-1.0.9.tar.gz 73716
-MD5 a6b5c61c16b35f02c616c8abadb9999d bristuff-0.2.0-RC8n.tar.gz 143979
diff --git a/net-misc/asterisk/files/digest-asterisk-1.0.9-r3 b/net-misc/asterisk/files/digest-asterisk-1.0.9-r3
new file mode 100644
index 000000000000..a1637fb67395
--- /dev/null
+++ b/net-misc/asterisk/files/digest-asterisk-1.0.9-r3
@@ -0,0 +1,9 @@
+MD5 0d7f1c680ae53a739f26a069ef8b580a asterisk-1.0.9.tar.gz 9604582
+RMD160 2e48dc00a3c290cc6b418ab0aee42feb93d9e76a asterisk-1.0.9.tar.gz 9604582
+SHA256 27e9437b3e6297f1a5e171b96e818c1ffa51dba78afe61277f5c3540809d2653 asterisk-1.0.9.tar.gz 9604582
+MD5 2b6e1da3ff097f9792d3123e7e5a0059 asterisk-addons-1.0.9.tar.gz 73716
+RMD160 98156861f790987fb4bf86b14c902aeca90b380b asterisk-addons-1.0.9.tar.gz 73716
+SHA256 4c878a4e5b5aabbdd93116ccbca5cf6465d55f480f4aa1e6438e9fc49c1f11fe asterisk-addons-1.0.9.tar.gz 73716
+MD5 a6b5c61c16b35f02c616c8abadb9999d bristuff-0.2.0-RC8n.tar.gz 143979
+RMD160 922b6b807bb48aa690412de3916eeb54c1454486 bristuff-0.2.0-RC8n.tar.gz 143979
+SHA256 a92d9d8e9777c0637d2db0375794fe011fd8ecf1461f0b8e6587c74670da637c bristuff-0.2.0-RC8n.tar.gz 143979