www-apps/drupal: Security bump - bug 728660.

Bug: https://bugs.gentoo.org/728660
Security bump to releases 7.72, 8.8.8, 8.9.1 and 9.0.1.
CSRF - CVE-2020-13663 / SA-CORE-2020-004
Arbirtrary PHP code execution - SA-CORE-2020-005
Access bypass - SA-CORE-2020-006

Signed-off-by: Jorge Manuel B. S. Vicetto (jmbsvicetto) <jmbsvicetto@gentoo.org>

5 files changed, 266 insertions, 0 deletions

diff --git a/www-apps/drupal/Manifest b/www-apps/drupal/Manifest
index b40878a..8497053 100644
--- a/www-apps/drupal/Manifest
+++ b/www-apps/drupal/Manifest
@@ -1,5 +1,9 @@
 DIST drupal-7.71.tar.gz 3323316 BLAKE2B a34a6f35912130719867d3a1e9262d25d558d1ecd220b73f662134c3e1238bfd9dbedd71f076332e4dfac3b1ed0bab24ddf7603a4ad78faf9db5c7317e273b66 SHA512 3ed0bd4e8f176bfda89e5032728b22351951062e476956b8f0242a5a2606be65c109bb31770815a1ee74f38a6aea20b3bd7697e714597da8eaff0bdfa9ba548d
+DIST drupal-7.72.tar.gz 3323531 BLAKE2B 07d22cde80763e9d9e959907ae246b95dc611b6ae32f8bf69e5c2fa03ad023bcb3810703dbe2285b89f43709616d9302b0598012237fe97487820e71df1b9b70 SHA512 5ad91d9aa31a0d31ba07dba0de5fd4d0fb4b875ed3fed7d48e3b65d4e2e8d7e7f3e66dcbe9d2a7a78fa22923597a396f43d70ee7b5ac63469ca3e256ba4746b6
 DIST drupal-8.7.14.tar.gz 17930775 BLAKE2B 0a25ea095d8431075bb2d6506237a270131cef0548b0be4d801721fc850b504d0ea1969410a4b7493f983d9a9e80e9e8e45fb553e821759505882bac96266de3 SHA512 0dc5ee0d21c6da019aae6cf93d16d938b5fcf3179b74278d03c75cb6fd78f7fa698bc98ccb4040553b010e7b529f8a37640147b928616348abbcfd3060d42995
 DIST drupal-8.8.7.tar.gz 19504196 BLAKE2B 7414049a26fdb74d4dc5cde4d19cdd8f2631cfa1d2c97b87128f832efdafe734ef261a8423cdecad3c5ce56b6770806e2ca76a8b76fd71cfa5a056c6dfb75f6c SHA512 24608d809522878999f96c8e2fb561ee0f6e1460de54127570c75e08430a6ecfabdf080fe3f2177a70f12acdb0d1ef4c2f5f86f7304e69748eb1d82357034e74
+DIST drupal-8.8.8.tar.gz 19504669 BLAKE2B f98e772753ffc6df5e9404bcf1c30acaca284447040b73ba43e62aa413c712f3174f636efa24a3e24c5d2dfd3906ad920b40eab5c7ad51f485ef6b25647bcf84 SHA512 1170d4a6372f21d8817264f17998f3b29c5c158267d4d60d057475a773fe24eb85b4988c89daef80c08a89bf4d4ba1a85d1d35ac698ebd588109be0731b796ca
 DIST drupal-8.9.0.tar.gz 19776103 BLAKE2B 3dc9ee0db667c370de2f686dc34b7b60797fe0a8ad80c2ca9dc08e1c096d6b3f9629e05af156c004a20fecba8958ca4283b45a21f67d212fed254feb03618b79 SHA512 4cb05a4352aa04ce94252a2614f1d16822400e45250d0d67962b8a3c7a891d323d102fc6c7c44a5d8caa16aa8857096958bb56899314c3871dece4e8647d5264
+DIST drupal-8.9.1.tar.gz 19776948 BLAKE2B 34dafaddafb0a8e742ff8591aa016e1d8cdf40c5779236308427339087b2c2f552b8829de0ae3dc2eedf5e99d70922e89a281852b3e3f2f3c27a00efafdea849 SHA512 db518cc180508023025c2f7b898f85c4728712bafaa048fe1783aa471d0c38f24f27e62175a8cea314c330b0a147509d8285ee6f0838d990ae3c76aab83d081f
 DIST drupal-9.0.0.tar.gz 16833239 BLAKE2B 2202de1e352b181db3f85ba5ccf012987114b140afee055ba2475b63ae9738be9a669a534dc5470a3d41bf1e4eb81b269ccc34f4ac89ef5668396121d91ee1b0 SHA512 7a77a153f6e0b9f31c3d0e1350719b7677d8153a823b057efbe6e1cc21c59989755c96e497b1a4439e79361f35920eac13d1016019d4fd12dabc34c2c10d8244
+DIST drupal-9.0.1.tar.gz 16832166 BLAKE2B b783bb0282f0ee81fa1a3d606e3a97d65a537f20e2820270a2e5d554b737af45f31fac82f45e1322df8ee04ba1a4a5ee757a67fe2a09c272a32400c4d5b51424 SHA512 499459ebf72b1008266e6075667a4781b27d2e82635687744321513af1ac2289a0a33273666f251b90c4a2020e4fb52b83146b9a65007de788c5f3559bb4cb0a
diff --git a/www-apps/drupal/drupal-7.72.ebuild b/www-apps/drupal/drupal-7.72.ebuild
new file mode 100644
index 0000000..4fd21d3
--- /dev/null
+++ b/www-apps/drupal/drupal-7.72.ebuild
@@ -0,0 +1,58 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+inherit webapp
+
+MY_PV=${PV:0:3}.0
+
+DESCRIPTION="PHP-based open-source platform and content management system"
+HOMEPAGE="https://www.drupal.org/"
+SRC_URI="https://ftp.drupal.org/files/projects/${P}.tar.gz"
+
+LICENSE="GPL-2"
+KEYWORDS="~amd64 ~x86"
+IUSE="+mysql postgres sqlite +uploadprogress"
+
+RDEPEND="
+	dev-lang/php[gd,hash(+),mysql?,pdo,postgres?,simplexml,sqlite?,xml]
+	virtual/httpd-php
+	uploadprogress? ( dev-php/pecl-uploadprogress )
+"
+
+need_httpd_cgi
+
+REQUIRED_USE="|| ( mysql postgres sqlite )"
+
+src_install() {
+	webapp_src_preinst
+
+	local docs="MAINTAINERS.txt LICENSE.txt INSTALL.txt CHANGELOG.txt INSTALL.mysql.txt INSTALL.pgsql.txt INSTALL.sqlite.txt UPGRADE.txt "
+	dodoc ${docs}
+	rm -f ${docs} INSTALL COPYRIGHT.txt || die
+
+	cp sites/default/{default.settings.php,settings.php} || die
+	insinto "${MY_HTDOCSDIR}"
+	doins -r .
+
+	dodir "${MY_HTDOCSDIR}"/files
+	webapp_serverowned "${MY_HTDOCSDIR}"/files
+	webapp_serverowned "${MY_HTDOCSDIR}"/sites/default
+	webapp_serverowned "${MY_HTDOCSDIR}"/sites/default/settings.php
+
+	webapp_configfile "${MY_HTDOCSDIR}"/sites/default/settings.php
+	webapp_configfile "${MY_HTDOCSDIR}"/.htaccess
+
+	webapp_postinst_txt en "${FILESDIR}"/postinstall-en.txt
+
+	webapp_src_install
+}
+
+pkg_postinst() {
+	echo
+	ewarn "SECURITY NOTICE"
+	ewarn "If you plan on using SSL on your Drupal site, please consult the postinstall information:"
+	ewarn "\t# webapp-config --show-postinst ${PN} ${PV}"
+	echo
+}
diff --git a/www-apps/drupal/drupal-8.8.8.ebuild b/www-apps/drupal/drupal-8.8.8.ebuild
new file mode 100644
index 0000000..50acdd3
--- /dev/null
+++ b/www-apps/drupal/drupal-8.8.8.ebuild
@@ -0,0 +1,68 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+inherit webapp
+
+MY_PV=${PV:0:3}.0
+MY_P=${P/_/-}
+S="${WORKDIR}/${MY_P}"
+
+DESCRIPTION="PHP-based open-source platform and content management system"
+HOMEPAGE="https://www.drupal.org/"
+SRC_URI="https://ftp.drupal.org/files/projects/${MY_P}.tar.gz"
+
+LICENSE="GPL-2"
+KEYWORDS="~amd64 ~x86"
+IUSE="+mysql postgres sqlite +uploadprogress"
+
+RDEPEND="
+	dev-lang/php[gd,hash(+),mysql?,pdo,postgres?,simplexml,sqlite?,xml]
+	virtual/httpd-php
+	uploadprogress? ( dev-php/pecl-uploadprogress )
+"
+
+need_httpd_cgi
+
+REQUIRED_USE="|| ( mysql postgres sqlite )"
+
+src_install() {
+	webapp_src_preinst
+
+	local docs="LICENSE.txt README.txt core/MAINTAINERS.txt core/INSTALL.txt core/CHANGELOG.txt \
+		core/INSTALL.mysql.txt core/INSTALL.pgsql.txt core/INSTALL.sqlite.txt core/UPDATE.txt "
+
+	dodoc ${docs}
+	rm -f ${docs} core/INSTALL core/COPYRIGHT.txt core/LICENSE.txt || die
+
+	cp sites/default/{default.settings.php,settings.php} || die
+	insinto "${MY_HTDOCSDIR}"
+	doins -r .
+
+	dodir "${MY_HTDOCSDIR}"/files
+	webapp_serverowned "${MY_HTDOCSDIR}"/files
+
+	webapp_configfile "${MY_HTDOCSDIR}"/sites/default/settings.php
+	webapp_configfile "${MY_HTDOCSDIR}"/.htaccess
+
+	webapp_postinst_txt en "${FILESDIR}"/postinstall-en.txt
+
+	webapp_src_install
+}
+
+pkg_postinst() {
+	echo
+	ewarn "SECURITY NOTICE"
+	ewarn "If you plan on using SSL on your Drupal site, please consult the postinstall information:"
+	ewarn "\t# webapp-config --show-postinst ${PN} ${PV}"
+	echo
+	ewarn "If this is a new install, unless you want anyone with network access to your server to be"
+	ewarn "able to run the setup, you'll have to configure your web server to limit access to it."
+	echo
+	ewarn "If you're doing a new drupal-8 install, you'll have to copy /sites/default/default.services.yml"
+	ewarn "to /sites/default/services.yml and grant it write permissions to your web server."
+	ewarn "Just follow the instructions of the drupal setup and be sure to resolve any permissions issue"
+	ewarn "reported by the setup."
+	echo
+}
diff --git a/www-apps/drupal/drupal-8.9.1.ebuild b/www-apps/drupal/drupal-8.9.1.ebuild
new file mode 100644
index 0000000..50acdd3
--- /dev/null
+++ b/www-apps/drupal/drupal-8.9.1.ebuild
@@ -0,0 +1,68 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+inherit webapp
+
+MY_PV=${PV:0:3}.0
+MY_P=${P/_/-}
+S="${WORKDIR}/${MY_P}"
+
+DESCRIPTION="PHP-based open-source platform and content management system"
+HOMEPAGE="https://www.drupal.org/"
+SRC_URI="https://ftp.drupal.org/files/projects/${MY_P}.tar.gz"
+
+LICENSE="GPL-2"
+KEYWORDS="~amd64 ~x86"
+IUSE="+mysql postgres sqlite +uploadprogress"
+
+RDEPEND="
+	dev-lang/php[gd,hash(+),mysql?,pdo,postgres?,simplexml,sqlite?,xml]
+	virtual/httpd-php
+	uploadprogress? ( dev-php/pecl-uploadprogress )
+"
+
+need_httpd_cgi
+
+REQUIRED_USE="|| ( mysql postgres sqlite )"
+
+src_install() {
+	webapp_src_preinst
+
+	local docs="LICENSE.txt README.txt core/MAINTAINERS.txt core/INSTALL.txt core/CHANGELOG.txt \
+		core/INSTALL.mysql.txt core/INSTALL.pgsql.txt core/INSTALL.sqlite.txt core/UPDATE.txt "
+
+	dodoc ${docs}
+	rm -f ${docs} core/INSTALL core/COPYRIGHT.txt core/LICENSE.txt || die
+
+	cp sites/default/{default.settings.php,settings.php} || die
+	insinto "${MY_HTDOCSDIR}"
+	doins -r .
+
+	dodir "${MY_HTDOCSDIR}"/files
+	webapp_serverowned "${MY_HTDOCSDIR}"/files
+
+	webapp_configfile "${MY_HTDOCSDIR}"/sites/default/settings.php
+	webapp_configfile "${MY_HTDOCSDIR}"/.htaccess
+
+	webapp_postinst_txt en "${FILESDIR}"/postinstall-en.txt
+
+	webapp_src_install
+}
+
+pkg_postinst() {
+	echo
+	ewarn "SECURITY NOTICE"
+	ewarn "If you plan on using SSL on your Drupal site, please consult the postinstall information:"
+	ewarn "\t# webapp-config --show-postinst ${PN} ${PV}"
+	echo
+	ewarn "If this is a new install, unless you want anyone with network access to your server to be"
+	ewarn "able to run the setup, you'll have to configure your web server to limit access to it."
+	echo
+	ewarn "If you're doing a new drupal-8 install, you'll have to copy /sites/default/default.services.yml"
+	ewarn "to /sites/default/services.yml and grant it write permissions to your web server."
+	ewarn "Just follow the instructions of the drupal setup and be sure to resolve any permissions issue"
+	ewarn "reported by the setup."
+	echo
+}
diff --git a/www-apps/drupal/drupal-9.0.1.ebuild b/www-apps/drupal/drupal-9.0.1.ebuild
new file mode 100644
index 0000000..50acdd3
--- /dev/null
+++ b/www-apps/drupal/drupal-9.0.1.ebuild
@@ -0,0 +1,68 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+inherit webapp
+
+MY_PV=${PV:0:3}.0
+MY_P=${P/_/-}
+S="${WORKDIR}/${MY_P}"
+
+DESCRIPTION="PHP-based open-source platform and content management system"
+HOMEPAGE="https://www.drupal.org/"
+SRC_URI="https://ftp.drupal.org/files/projects/${MY_P}.tar.gz"
+
+LICENSE="GPL-2"
+KEYWORDS="~amd64 ~x86"
+IUSE="+mysql postgres sqlite +uploadprogress"
+
+RDEPEND="
+	dev-lang/php[gd,hash(+),mysql?,pdo,postgres?,simplexml,sqlite?,xml]
+	virtual/httpd-php
+	uploadprogress? ( dev-php/pecl-uploadprogress )
+"
+
+need_httpd_cgi
+
+REQUIRED_USE="|| ( mysql postgres sqlite )"
+
+src_install() {
+	webapp_src_preinst
+
+	local docs="LICENSE.txt README.txt core/MAINTAINERS.txt core/INSTALL.txt core/CHANGELOG.txt \
+		core/INSTALL.mysql.txt core/INSTALL.pgsql.txt core/INSTALL.sqlite.txt core/UPDATE.txt "
+
+	dodoc ${docs}
+	rm -f ${docs} core/INSTALL core/COPYRIGHT.txt core/LICENSE.txt || die
+
+	cp sites/default/{default.settings.php,settings.php} || die
+	insinto "${MY_HTDOCSDIR}"
+	doins -r .
+
+	dodir "${MY_HTDOCSDIR}"/files
+	webapp_serverowned "${MY_HTDOCSDIR}"/files
+
+	webapp_configfile "${MY_HTDOCSDIR}"/sites/default/settings.php
+	webapp_configfile "${MY_HTDOCSDIR}"/.htaccess
+
+	webapp_postinst_txt en "${FILESDIR}"/postinstall-en.txt
+
+	webapp_src_install
+}
+
+pkg_postinst() {
+	echo
+	ewarn "SECURITY NOTICE"
+	ewarn "If you plan on using SSL on your Drupal site, please consult the postinstall information:"
+	ewarn "\t# webapp-config --show-postinst ${PN} ${PV}"
+	echo
+	ewarn "If this is a new install, unless you want anyone with network access to your server to be"
+	ewarn "able to run the setup, you'll have to configure your web server to limit access to it."
+	echo
+	ewarn "If you're doing a new drupal-8 install, you'll have to copy /sites/default/default.services.yml"
+	ewarn "to /sites/default/services.yml and grant it write permissions to your web server."
+	ewarn "Just follow the instructions of the drupal setup and be sure to resolve any permissions issue"
+	ewarn "reported by the setup."
+	echo
+}